Export limit exceeded: 425860 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 21746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,746

Export CSV
CVE-2018-16822

SeaCMS 6.64 allows SQL Injection via the upload/admin/admin_video.php order parameter.

CVSS 3.0 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Seacms
Products
Seacms
CVE-2018-16809

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.

CVSS 3.0 · 9.8 Critical EPSS 2.3% KEV · Not listed
Vendors
Dolibarr
Products
Dolibarr
CVE-2018-16803

In CIMTechniques CIMScan 6.x through 6.2, the SOAP WSDL parser allows attackers to execute SQL code.

CVSS 3.0 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Cimtechniques
Products
Cimscan
CVE-2018-16762

FUEL CMS 1.4.1 allows SQL Injection via the layout, published, or search_term parameter to pages/items.

CVSS 3.0 · 9.8 Critical EPSS 1.4% KEV · Not listed
Vendors
Thedaylightstudio
Products
Fuel Cms
CVE-2018-16724

An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request.

CVSS 3.0 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Baijiacms Project
Products
Baijiacms
CVE-2018-16659

An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Rausoft
Products
Id.prove
CVE-2018-16445

An issue was discovered in SeaCMS through 6.61. SQL injection exists via the tid parameter in an adm1n/admin_topic_vod.php request.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Seacms
Products
Seacms
CVE-2018-16436

Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.

CVSS 3.0 · 7.2 High EPSS 1.5% KEV · Not listed
Vendors
Gxlcms
Products
Gxlcms
CVE-2018-16432

BlueCMS 1.6 allows SQL Injection via the user_name parameter to uploads/user.php?act=index_login.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Bluecms Project
Products
Bluecms
CVE-2018-16410

Vanilla before 2.6.1 allows SQL injection via an invitationID array to /profile/deleteInvitation, related to applications/dashboard/models/class.invitationmodel.php and applications/dashboard/controllers/class.profilecontroller.php.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vanillaforums
Products
Vanilla
CVE-2018-16389

e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter.

CVSS 3.0 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
E107
Products
E107
CVE-2018-16385

ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

CVSS 3.0 · 9.8 Critical EPSS 2.2% KEV · Not listed
Vendors
Thinkphp
Products
Thinkphp
CVE-2018-16384

A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Owasp
Products
Owasp Modsecurity Core Rule Set
CVE-2018-16357

An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Pbootcms
Products
Pbootcms
CVE-2018-16356

An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Pbootcms
Products
Pbootcms
CVE-2018-16354

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Fhcrm Project
Products
Fhcrm
CVE-2018-16353

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter.

CVSS 3.0 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Fhcrm Project
Products
Fhcrm
CVE-2018-16278

phpkaiyuancms PhpOpenSourceCMS (POSCMS) V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajax_save_draft function with the dir parameter.

CVSS 3.0 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Phpkaiyuancms
Products
Phpopensourcecms
CVE-2018-16251

A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Creatiwity
Products
Witycms
CVE-2018-16188

SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached (D5520, D6500, D6510, D7500, D8400), and the display versions with RICOH Interactive Whiteboard Controller Type2 V3.0 to V3.1.10137.0 attached (D5520, D6510, D7500, D8400) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS 3.0 · 9.8 Critical EPSS 1.9% KEV · Not listed
Vendors
Ricoh
Products
D2200 D2200 Firmware D5500 and 13 more