Total
16324 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-39650 | 1 Themevolty | 1 Theme Volty Cms Blog | 2024-11-21 | N/A | 9.8 CRITICAL |
| Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single. | |||||
| CVE-2023-39649 | 1 Themevolty | 1 Theme Volty Cms Category Slider | 2024-11-21 | N/A | 9.8 CRITICAL |
| Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop. In the module “Theme Volty CMS Category Slider” (tvcmscategoryslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | |||||
| CVE-2023-39648 | 1 Themevolty | 1 Theme Volty Cms Testimonial | 2024-11-21 | N/A | 9.8 CRITICAL |
| Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop. In the module “Theme Volty CMS Testimonial” (tvcmstestimonial) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | |||||
| CVE-2023-39647 | 1 Themevolty | 1 Theme Volty Cms Category Product | 2024-11-21 | N/A | 9.8 CRITICAL |
| Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop. In the module “Theme Volty CMS Category Product” (tvcmscategoryproduct) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | |||||
| CVE-2023-39646 | 1 Themevolty | 1 Theme Volty Cms Category Chain Slider | 2024-11-21 | N/A | 9.8 CRITICAL |
| Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"(tvcmscategorychainslider) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | |||||
| CVE-2023-39645 | 1 Themevolty | 1 Cms Payment Icon | 2024-11-21 | N/A | 9.8 CRITICAL |
| Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop. In the module “Theme Volty CMS Payment Icon” (tvcmspaymenticon) up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions. | |||||
| CVE-2023-39643 | 1 Blmodules | 1 Xmlfeeds Pro | 2024-11-21 | N/A | 9.8 CRITICAL |
| Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds(). | |||||
| CVE-2023-39642 | 1 Carts.guru | 1 Cartsguru | 2024-11-21 | N/A | 9.8 CRITICAL |
| Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontController::display(). | |||||
| CVE-2023-39641 | 1 Activedesign | 1 Full Affiliates | 2024-11-21 | N/A | 9.8 CRITICAL |
| Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesdetailsModuleFrontController::initContent(). | |||||
| CVE-2023-39640 | 1 Uplight | 1 Cookie Law | 2024-11-21 | N/A | 9.8 CRITICAL |
| UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList(). | |||||
| CVE-2023-39639 | 1 Leotheme | 1 Leoblog | 2024-11-21 | N/A | 9.8 CRITICAL |
| LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs. | |||||
| CVE-2023-39582 | 1 Chamilo | 1 Chamilo Lms | 2024-11-21 | N/A | 4.9 MEDIUM |
| SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions. | |||||
| CVE-2023-39560 | 1 Ectouch | 1 Ectouch | 2024-11-21 | N/A | 9.8 CRITICAL |
| ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php. | |||||
| CVE-2023-39551 | 1 Phpgurukul | 1 Online Security Guards Hiring System | 2024-11-21 | N/A | 9.8 CRITICAL |
| PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php. | |||||
| CVE-2023-39526 | 1 Prestashop | 1 Prestashop | 2024-11-21 | N/A | 9.1 CRITICAL |
| PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds. | |||||
| CVE-2023-39524 | 1 Prestashop | 1 Prestashop | 2024-11-21 | N/A | 6.7 MEDIUM |
| PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, SQL injection possible in the product search field, in BO's product page. Version 8.1.1 contains a patch for this issue. There are no known workarounds. | |||||
| CVE-2023-39423 | 1 Resortdata | 1 Internet Reservation Module Next Generation | 2024-11-21 | N/A | 8.6 HIGH |
| The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user. | |||||
| CVE-2023-39417 | 3 Debian, Postgresql, Redhat | 4 Debian Linux, Postgresql, Enterprise Linux and 1 more | 2024-11-21 | N/A | 7.5 HIGH |
| IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-bundled extension, an attacker with database-level CREATE privilege can execute arbitrary code as the bootstrap superuser. | |||||
| CVE-2023-39378 | 1 Siberiancms | 1 Siberiancms | 2024-11-21 | N/A | 8.8 HIGH |
| SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user | |||||
| CVE-2023-39361 | 2 Cacti, Fedoraproject | 2 Cacti, Fedora | 2024-11-21 | N/A | 9.8 CRITICAL |
| Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||