Total
14524 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-25695 | 2 Debian, Postgresql | 2 Debian Linux, Postgresql | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. | |||||
| CVE-2020-25608 | 1 Mitel | 1 Micollab | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection. | |||||
| CVE-2020-25514 | 1 Simple Library Management System Project | 1 Simple Library Management System | 2024-11-21 | 4.6 MEDIUM | 8.4 HIGH |
| Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php. | |||||
| CVE-2020-25487 | 1 Phpgurukul | 1 Zoo Management System | 2024-11-21 | 4.6 MEDIUM | 7.8 HIGH |
| PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php. | |||||
| CVE-2020-25475 | 1 Newsscriptphp | 1 News Script Php Pro | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action. | |||||
| CVE-2020-25409 | 1 College Management System Project | 1 College Management System | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters. | |||||
| CVE-2020-25379 | 1 Recall-products Project | 1 Recall-products | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query. | |||||
| CVE-2020-25362 | 1 Online Shopping Alphaware Project | 1 Online Shopping Alphaware | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| The id paramater in Online Shopping Alphaware 1.0 has been discovered to be vulnerable to an Error-Based blind SQL injection in the /alphaware/details.php path. This allows an attacker to retrieve all databases. | |||||
| CVE-2020-25273 | 1 Online Bus Booking System Project | 1 Online Bus Booking System | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection. | |||||
| CVE-2020-25254 | 1 Hyland | 1 Onbase | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by TestConnection_LocalOrLinkedServer, CreateFilterFriendlyView, or AddWorkViewLinkedServer. | |||||
| CVE-2020-25253 | 1 Hyland | 1 Onbase | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by the TableName, ColumnName, Name, UserId, or Password parameter. | |||||
| CVE-2020-25157 | 1 Advantech | 1 R-seenet | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive information. | |||||
| CVE-2020-25147 | 1 Observium | 1 Observium | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username[0] to the default URI, because of includes/authenticate.inc.php. | |||||
| CVE-2020-25143 | 1 Observium | 1 Observium | 2024-11-21 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via /ajax/device_entities.php?entity_type=netscalervsvr&device_id[]= because of /ajax/device_entities.php. | |||||
| CVE-2020-25132 | 1 Observium | 1 Observium | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injection sanitization. Users are able to inject malicious statements in multiple functions. This vulnerability leads to full authentication bypass: any unauthorized user with access to the application is able to exploit this vulnerability. This can occur via the Cookie header to the default URI, within includes/authenticate.inc.php. | |||||
| CVE-2020-25130 | 1 Observium | 1 Observium | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL Injection sanitization. Authenticated users are able to inject malicious SQL queries. This vulnerability leads to full database leak including ckeys that can be used in the authentication process without knowing the username and cleartext password. This can occur via the ajax/actions.php group_id field. | |||||
| CVE-2020-25034 | 1 Fireeye | 2 Email Malware Protection System, Ex 3500 | 2024-11-21 | 4.0 MEDIUM | 6.5 MEDIUM |
| eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, search{URL], or search[attachment] parameter to the email search feature. | |||||
| CVE-2020-25006 | 1 Heybbs Project | 1 Heybbs | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code. | |||||
| CVE-2020-25005 | 1 Heybbs Project | 1 Heybbs | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary code. | |||||
| CVE-2020-25004 | 1 Heybbs Project | 1 Heybbs | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code. | |||||