CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In May 2019(SQL Injection)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2019-12372 89 Sql 2019-05-28 2019-05-29
4.6
None Local Low Not required Partial Partial Partial
Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form.
2 CVE-2019-12279 89 Sql 2019-05-22 2019-08-09
7.5
None Remote Low Not required Partial Partial Partial
** DISPUTED ** Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck.
3 CVE-2019-12251 89 Sql 2019-05-21 2019-05-21
6.5
None Remote Low ??? Partial Partial Partial
sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadmin_ceditpost cvalue parameter.
4 CVE-2019-12239 352 Sql CSRF 2019-05-20 2020-08-24
6.5
None Remote Low ??? Partial Partial Partial
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access.
5 CVE-2019-11880 89 Sql 2019-05-22 2019-05-23
5.0
None Remote Low Not required Partial None None
CommSy through 8.6.5 has SQL Injection via the cid parameter. This is fixed in 9.2.
6 CVE-2019-11678 89 Sql 2019-05-02 2019-05-03
7.5
None Remote Low Not required Partial Partial Partial
The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection.
7 CVE-2019-11600 89 Exec Code Sql 2019-05-13 2019-05-14
6.8
None Remote Medium Not required Partial Partial Partial
A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.
8 CVE-2019-11057 89 Exec Code Sql 2019-05-17 2020-11-10
6.5
None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands.
9 CVE-2019-10916 89 Sql 2019-05-14 2021-10-28
9.0
None Remote Low ??? Complete Complete Complete
A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.
10 CVE-2019-10913 79 Sql XSS 2019-05-16 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.
11 CVE-2019-10910 89 Exec Code Sql 2019-05-16 2021-09-29
7.5
None Remote Low Not required Partial Partial Partial
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
12 CVE-2019-10866 89 Sql 2019-05-23 2019-08-03
7.5
None Remote Low Not required Partial Partial Partial
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.
13 CVE-2019-10852 89 Sql 2019-05-23 2019-11-12
6.5
None Remote Low ??? Partial Partial Partial
Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=start_pulling&id= substring.
14 CVE-2019-10123 89 Exec Code Sql 2019-05-31 2019-06-03
7.5
None Remote Low Not required Partial Partial Partial
SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user.
15 CVE-2019-8923 89 Sql 2019-05-14 2019-05-16
7.5
None Remote Low Not required Partial Partial Partial
XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discontinued.
16 CVE-2019-5934 89 Exec Code Sql 2019-05-17 2019-05-20
6.5
None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in the Cybozu Garoon 4.0.0 to 4.10.0 allows attacker with administrator rights to execute arbitrary SQL commands via the Log Search function of application 'logging'.
17 CVE-2019-1825 89 Sql 2019-05-16 2019-10-09
5.5
None Remote Low ??? Partial Partial None
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
18 CVE-2019-1824 89 Sql 2019-05-16 2019-10-09
5.5
None Remote Low ??? Partial Partial None
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
19 CVE-2018-18800 89 Sql 2019-05-14 2019-05-15
7.5
None Remote Low Not required Partial Partial Partial
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php.
20 CVE-2018-17843 89 Sql 2019-05-24 2019-05-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection exists in ADD Clicking MLM Software 1.0, Binary MLM Software 1.0, Level MLM Software 1.0, Singleleg MLM Software 1.0, Autopool MLM Software 1.0, Investment MLM Software 1.0, Bidding MLM Software 1.0, Moneyorder MLM Software 1.0, Repurchase MLM Software 1.0, and Gift MLM Software 1.0 via the member/readmsg.php msg_id parameter, the member/tree.php pid parameter, or the member/downline.php m_id parameter.
21 CVE-2018-17181 89 Sql 2019-05-17 2019-05-20
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php.
22 CVE-2018-17179 89 Sql 2019-05-17 2019-05-20
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.
23 CVE-2018-17048 89 Sql 2019-05-16 2019-05-17
5.0
None Remote Low Not required Partial None None
admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection.
24 CVE-2018-16137 89 Sql 2019-05-13 2019-05-15
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections.
25 CVE-2018-12295 89 Exec Code Sql 2019-05-13 2019-05-13
7.5
None Remote Low Not required Partial Partial Partial
SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter.
26 CVE-2018-7841 89 Exec Code Sql 2019-05-22 2019-05-23
7.5
None Remote Low Not required Partial Partial Partial
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.
27 CVE-2017-12761 89 Sql 2019-05-09 2019-05-10
5.0
None Remote Low Not required Partial None None
http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download (remote). The component is: $file = $_GET['id'] in download.php. The attack vector is: http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?id=WebExplorer/../config.php.
28 CVE-2017-12760 89 Exec Code Sql 2019-05-09 2019-05-10
6.5
None Remote Low ??? Partial Partial Partial
Ynet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection. The impact is: Code execution (remote).
29 CVE-2017-12759 89 Exec Code Sql 2019-05-09 2019-05-13
7.5
None Remote Low Not required Partial Partial Partial
Ynet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection. The impact is: Code execution (remote).
30 CVE-2017-12758 89 Exec Code Sql 2019-05-09 2019-05-09
7.5
None Remote Low Not required Partial Partial Partial
https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. The impact is: Code execution (remote). The component is: com_appointment component.
31 CVE-2017-12757 89 Exec Code Sql 2019-05-09 2019-05-10
7.5
None Remote Low Not required Partial Partial Partial
Certain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business Networking Script 8.26i and Tech Caregiver Script 2.71i and Tech Classifieds Script 7.41i and Tech Dating Script 3.40i and Tech Freelancer Script 5.27i and Tech Image Sharing Script 4.13i and Tech Job Script 9.27i and Tech Movie Script 7.51i and Tech Multi Vendor Script 6.63i and Tech Social Networking Script 3.08i and Tech Travel Script 9.49. The impact is: Code execution (remote).
32 CVE-2017-11738 89 Sql 2019-05-23 2020-07-27
6.8
None Remote Medium Not required Partial Partial Partial
In Zoho ManageEngine Application Manager prior to 14.6 Build 14660, the 'haid' parameter of the '/auditLogAction.do' module is vulnerable to a Time-based Blind SQL Injection attack.
33 CVE-2017-11559 89 Sql 2019-05-23 2019-05-24
5.0
None Remote Low Not required Partial None None
An issue was discovered in ZOHO ManageEngine OpManager 12.2. The 'apiKey' parameter of "/api/json/admin/getmailserversettings" and "/api/json/dashboard/gotoverviewlist" is vulnerable to a Blind SQL Injection attack.
34 CVE-2016-10755 89 Sql 2019-05-24 2019-05-29
4.0
None Remote Low ??? Partial None None
AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to admin/controller/pages/localisation/language.php and core/lib/language_manager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php.
35 CVE-2016-10754 89 Sql 2019-05-24 2019-05-29
6.5
None Remote Low ??? Partial Partial Partial
modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter.
36 CVE-2016-10753 502 Sql 2019-05-24 2019-05-29
6.5
None Remote Low ??? Partial Partial Partial
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.
37 CVE-2016-8898 89 Sql 2019-05-24 2019-05-28
7.5
None Remote Low Not required Partial Partial Partial
Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.
38 CVE-2016-8897 89 Sql 2019-05-23 2019-05-24
7.5
None Remote Low Not required Partial Partial Partial
Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.
Total number of vulnerabilities : 38   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.