CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2019(SQL Injection)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
51 CVE-2019-17292 89 Sql 2019-10-07 2019-10-10
6.5
None Remote Low ??? Partial Partial Partial
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user.
52 CVE-2019-17271 89 Sql 2019-10-08 2019-10-09
4.0
None Remote Low ??? Partial None None
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
53 CVE-2019-17197 89 Sql 2019-10-05 2019-10-08
7.5
None Remote Low Not required Partial Partial Partial
OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc.
54 CVE-2019-17128 89 Sql 2019-10-09 2019-10-11
5.0
None Remote Low Not required Partial None None
Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of the login page through a GET request. The injection allows an attacker to read sensitive information from the database used by the application.
55 CVE-2019-17119 89 Exec Code Sql 2019-10-17 2019-10-22
6.5
None Remote Low ??? Partial Partial Partial
Multiple SQL injection vulnerabilities in Logs.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allow authenticated users to execute arbitrary SQL commands via the source or subString parameter.
56 CVE-2019-17117 89 Exec Code Sql 2019-10-17 2019-10-22
6.5
None Remote Low ??? Partial Partial Partial
A SQL injection vulnerability in processPref.jsp in WiKID 2FA Enterprise Server through 4.2.0-b2053 allows an authenticated user to execute arbitrary SQL commands via the processPref.jsp key parameter.
57 CVE-2019-17072 89 Sql 2019-10-10 2019-10-10
7.5
None Remote Low Not required Partial Partial Partial
The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
58 CVE-2019-17049 89 Sql 2019-09-30 2019-10-04
5.0
None Remote Low Not required None Partial None
NETGEAR SRX5308 4.3.5-3 devices allow SQL Injection, as exploited in the wild in September 2019 to add a new user account.
59 CVE-2019-16999 89 Sql 2019-09-30 2019-10-02
7.5
None Remote Low Not required Partial Partial Partial
CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device/getNumByStatus URI.
60 CVE-2019-16997 89 Sql 2019-09-30 2019-10-04
6.5
None Remote Low ??? Partial Partial Partial
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the admin/?n=language&c=language_general&a=doExportPack appno parameter.
61 CVE-2019-16996 89 Sql 2019-09-30 2019-10-04
6.5
None Remote Low ??? Partial Partial Partial
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?n=product&c=product_admin&a=dopara&app_type=shop id parameter.
62 CVE-2019-16980 89 Sql 2019-10-21 2019-10-23
6.5
None Remote Low ??? Partial Partial Partial
In FusionPBX up to v4.5.7, the file app\call_broadcast\call_broadcast_edit.php uses an unsanitized "id" variable coming from the URL in an unparameterized SQL query, leading to SQL injection.
63 CVE-2019-16917 89 Sql 2019-10-17 2019-10-22
6.5
None Remote Low ??? Partial Partial Partial
WiKID Enterprise 2FA (two factor authentication) Enterprise Server through 4.2.0-b2047 is vulnerable to SQL injection through the searchDevices.jsp endpoint. The uid and domain parameters are used, unsanitized, in a SQL query constructed in the buildSearchWhereClause function.
64 CVE-2019-16894 89 Sql 2019-09-26 2020-08-24
7.5
None Remote Low Not required Partial Partial Partial
download.php in inoERP 4.15 allows SQL injection through insecure deserialization.
65 CVE-2019-16745 89 Sql 2019-09-30 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection.
66 CVE-2019-16744 89 Sql 2019-09-30 2019-10-03
6.5
None Remote Low ??? Partial Partial Partial
eBrigade before 5.0 has evenements.php cid SQL Injection.
67 CVE-2019-16743 89 Sql 2019-09-30 2019-10-02
6.5
None Remote Low ??? Partial Partial Partial
eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.
68 CVE-2019-16696 89 Sql 2019-09-22 2019-09-23
7.5
None Remote Low Not required Partial Partial Partial
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used.
69 CVE-2019-16695 89 Sql 2019-09-22 2019-09-23
7.5
None Remote Low Not required Partial Partial Partial
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used.
70 CVE-2019-16694 89 Sql 2019-09-22 2019-09-23
7.5
None Remote Low Not required Partial Partial Partial
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used.
71 CVE-2019-16693 89 Sql 2019-09-22 2019-09-23
7.5
None Remote Low Not required Partial Partial Partial
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used.
72 CVE-2019-16692 89 Sql 2019-09-22 2019-10-01
7.5
None Remote Low Not required Partial Partial Partial
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.
73 CVE-2019-16682 89 Sql 2019-10-16 2019-10-21
7.5
None Remote Low Not required Partial Partial Partial
The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.
74 CVE-2019-16644 89 Sql 2019-09-20 2019-09-20
7.5
None Remote Low Not required Partial Partial Partial
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring.
75 CVE-2019-16642 89 Sql 2019-09-20 2019-09-20
7.5
None Remote Low Not required Partial Partial Partial
App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring.
76 CVE-2019-16404 89 Sql 2019-10-21 2019-10-22
6.5
None Remote Low ??? Partial Partial Partial
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
77 CVE-2019-16383 89 Sql 2019-09-24 2020-04-14
7.5
None Remote Low Not required Partial Partial Partial
MOVEit.DMZ.WebApi.dll in Progress MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1 allows an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or may be able to alter the database via the REST API, aka SQL Injection.
78 CVE-2019-16309 89 Sql 2019-09-14 2019-09-16
7.5
None Remote Low Not required Partial Partial Partial
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
79 CVE-2019-16264 89 Sql 2019-09-16 2019-09-17
7.5
None Remote Low Not required Partial Partial Partial
In Escuela de Gestion Publica Plurinacional (EGPP) Sistema Integrado de Gestion Academica (GESAC) v1, the username parameter of the authentication form is vulnerable to SQL injection, allowing attackers to access the database.
80 CVE-2019-16194 89 Sql 2019-09-25 2019-09-25
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
81 CVE-2019-16125 89 Sql 2019-09-09 2019-09-09
7.5
None Remote Low Not required Partial Partial Partial
In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injection.
82 CVE-2019-16119 89 Sql 2019-09-08 2019-09-10
7.5
None Remote Low Not required Partial Partial Partial
SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.
83 CVE-2019-15995 89 Sql 2019-11-26 2019-12-09
5.5
None Remote Low ??? None Partial Partial
A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicious SQL statements in an affected field in the web UI. A successful exploit could allow the attacker to remove the SQL database, which would require the reinstallation of the Connector VM.
84 CVE-2019-15972 89 Sql 2019-11-26 2019-12-09
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database.
85 CVE-2019-15933 89 Sql 2019-12-12 2019-12-13
7.5
None Remote Low Not required Partial Partial Partial
Intesync Solismed 3.3sp has SQL Injection.
86 CVE-2019-15872 89 Sql 2019-09-03 2019-09-05
7.5
None Remote Low Not required Partial Partial Partial
The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.
87 CVE-2019-15659 89 Sql 2019-08-27 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The pie-register plugin before 3.1.2 for WordPress has SQL injection, a different issue than CVE-2018-10969.
88 CVE-2019-15658 89 Sql 2019-08-26 2019-08-30
7.5
None Remote Low Not required Partial Partial Partial
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
89 CVE-2019-15646 89 Sql 2019-08-27 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The rsvpmaker plugin before 6.2 for WordPress has SQL injection.
90 CVE-2019-15574 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows serviceID SQL injection in accountmanagement.php.
91 CVE-2019-15573 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows SQL injection in tankyou.php.
92 CVE-2019-15572 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
Gesior-AAC before 2019-05-01 allows ServiceCategoryID SQL injection in shop.php.
93 CVE-2019-15571 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.
94 CVE-2019-15570 89 Sql 2019-08-26 2019-08-29
7.5
None Remote Low Not required Partial Partial Partial
BEdita through 4.0.0-RC2 allows SQL injection during a save operation for a relation with parameters.
95 CVE-2019-15569 89 Sql 2019-08-26 2019-09-03
7.5
None Remote Low Not required Partial Partial Partial
HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java.
96 CVE-2019-15568 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels.
97 CVE-2019-15567 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature.
98 CVE-2019-15566 89 Sql 2019-08-26 2019-08-27
7.5
None Remote Low Not required Partial Partial Partial
The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.
99 CVE-2019-15565 89 Sql 2019-08-26 2019-08-28
7.5
None Remote Low Not required Partial Partial Partial
The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.
100 CVE-2019-15564 89 Sql 2019-08-26 2019-08-27
7.5
None Remote Low Not required Partial Partial Partial
The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.
Total number of vulnerabilities : 551   Page : 1 2 (This Page)3 4 5 6 7 8 9 10 11 12
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.