Export limit exceeded: 425899 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 21749 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,749

Export CSV
CVE-2023-4531

SQLi in Mestavs E-commerce Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mestav
Products
E-commerce Software
CVE-2023-4541

SQLi in Weens Admin Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Ween
Products
Management Panel
CVE-2023-4661

SQLi in Saphira Connect

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saphira Saphira Connect allows SQL Injection. This issue affects Saphira Connect: before 9.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Adobe
Products
Connect
CVE-2023-4674

SQLi in Yazteks E-Commerce Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Yaztekteknoloji
Products
E-commerce
CVE-2023-4670

SQLi in Innosa's Probbys

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Innosa Probbys allows SQL Injection. This issue affects Probbys: before 2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Innosa Probbys Project
Products
Innosa Probbys
CVE-2023-4671

SQLi in Talent Soft's ECOP

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software ECOP allows Command Line Execution through SQL Injection. This issue affects ECOP: before 32255.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Talentyazilim
Products
Ecop
CVE-2023-4673

SQLi in Sanalogy's Turasistan

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection. This issue affects Turasistan: before 20230911 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Sanalogi
Products
Turasistan
CVE-2026-42383

WordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL Injection. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.29.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Yithemes
Products
Wordpress Yith Woocommerce Product Add-ons
CVE-2023-4675

SQLi i GM Informatics MDO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GM Information Technologies MDO allows SQL Injection. This issue affects MDO: through 20231229.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Gmbilisim
Products
Multi-disciplinary Design Optimization
CVE-2023-4737

SQLi in Hedef Trackings Admin Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Hedeftakip
Products
Admin Portal
CVE-2023-4766

SQLi in Movus Admin Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection. This issue affects Movus: before 20230913.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Movus
Products
Movus
CVE-2023-4830

SQLi in Tura's Signalix

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection. This issue affects Signalix: 7T_0228.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Turaconsulting
Products
Signalix
CVE-2023-4832

SQLi in Aceka Holdings Company Management

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aceka Company Management allows SQL Injection. This issue affects Company Management: before 3072 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Acekaholding
Products
Company Management
CVE-2023-4833

SQLi in Besttem's Network Marketing Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection. This issue affects Network Marketing Software: before 1.0.2309.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Besttem Network Marketing Project
Products
Besttem Network Marketing
CVE-2023-5045

SQLi in Biltay's Kayısı

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Kayisi: before 1286.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Biltay
Products
Kayisi
CVE-2023-5046

SQLi in Biltay's Procost

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Procost: before 1390.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Biltay
Products
Procost
CVE-2023-5047

SQLi in DRDrive

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection. This issue affects DRDrive: before 20231006.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Drd
Products
Drdrive
CVE-2026-7472

Read More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.5.7. This is due to the use of esc_sql() without surrounding the value in quotes in an ORDER BY clause inside the getAllDataByLimit() and getAccordionAllDataByLimit() functions in ReadMoreData.php. The user-supplied $_GET['orderby'] value is only processed through esc_attr() (an HTML-escaping function) before being passed to these database functions, where esc_sql() is applied but the value is directly concatenated—unquoted—into the ORDER BY fragment of the SQL query before $wpdb->prepare() is called. Because esc_sql() only escapes quote characters and backslashes (which are irrelevant in an unquoted ORDER BY context), an attacker can inject arbitrary SQL expressions such as (SELECT SLEEP(5)) or conditional subqueries to perform time-based blind data extraction. This makes it possible for authenticated attackers with administrator-level access or above (or any role explicitly permitted access to the plugin's admin pages via the yrm-user-roles setting) to extract sensitive data from the database, including administrator credential hashes.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Edmonsoft Wordpress
Products
Read More & Accordion Wordpress