CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2021(SQL Injection)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
201 CVE-2021-33732 89 Exec Code Sql 2021-10-12 2021-10-18
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
202 CVE-2021-33731 89 Exec Code Sql 2021-10-12 2021-10-18
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
203 CVE-2021-33730 89 Exec Code Sql 2021-10-12 2021-10-18
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application.
204 CVE-2021-33729 89 Exec Code Sql 2021-10-12 2021-10-18
6.5
None Remote Low ??? Partial Partial Partial
A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). An authenticated attacker that is able to import firmware containers to an affected system could execute arbitrary commands in the local database.
205 CVE-2021-33701 89 +Priv Sql 2021-09-15 2021-12-15
6.5
None Remote Low ??? Partial Partial Partial
DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 102, 103, 104, 105, allows an attacker with access to highly privileged account to execute manipulated query in NDZT tool to gain access to Superuser account, leading to SQL Injection vulnerability, that highly impacts systems Confidentiality, Integrity and Availability.
206 CVE-2021-33688 89 Sql +Info 2021-09-14 2021-09-23
4.0
None Remote Low ??? Partial None None
SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. Due to framework restrictions, only some information can be obtained.
207 CVE-2021-33578 89 Sql Bypass 2021-07-13 2021-07-15
7.5
None Remote Low Not required Partial Partial Partial
Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language (SQL) records, and manipulate data.
208 CVE-2021-33470 89 Sql 2021-05-26 2021-06-09
7.5
None Remote Low Not required Partial Partial Partial
COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
209 CVE-2021-33180 89 Exec Code Sql 2021-06-01 2021-06-09
7.5
None Remote Low Not required Partial Partial Partial
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
210 CVE-2021-33177 89 Sql 2021-10-14 2021-10-20
6.5
None Remote Low ??? Partial Partial Partial
The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries.
211 CVE-2021-32983 89 Exec Code Sql 2021-08-30 2021-09-07
10.0
None Remote Low Not required Complete Complete Complete
A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter keyword before using it as part of an SQL query. A remote, unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\MSSQLSERVER.
212 CVE-2021-32932 89 Sql 2021-06-11 2021-06-21
5.0
None Remote Low Not required Partial None None
The affected product is vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information on the iView (versions prior to v5.7.03.6182).
213 CVE-2021-32790 89 Sql 2021-07-26 2021-08-04
4.0
None Remote Low ??? Partial None None
Woocommerce is an open source eCommerce plugin for WordPress. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce plugin between version 3.3.0 and 3.3.6. Malicious actors (already) having admin access, or API keys to the WooCommerce site can exploit vulnerable endpoints of `/wp-json/wc/v3/webhooks`, `/wp-json/wc/v2/webhooks` and other webhook listing API. Read-only SQL queries can be executed using this exploit, while data will not be returned, by carefully crafting `search` parameter information can be disclosed using timing and related attacks. Version 3.3.6 is the earliest version of Woocommerce with a patch for this vulnerability. There are no known workarounds other than upgrading.
214 CVE-2021-32789 89 Sql 2021-07-26 2021-08-05
5.0
None Remote Low Not required Partial None None
woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be executed against the `wc/store/products/collection-data?calculate_attribute_counts[][taxonomy]` endpoint that allows the execution of a read only sql query. There are patches for many versions of this package, starting with version 2.5.16. There are no known workarounds aside from upgrading.
215 CVE-2021-32704 89 Sql 2021-06-24 2021-07-08
6.5
None Remote Low ??? Partial Partial Partial
DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint in DHIS2 versions 2.34.4, 2.35.2, 2.35.3, 2.35.4, and 2.36.0. Earlier versions, such as 2.34.3 and 2.35.1 and all versions 2.33 and older are unaffected. The system is vulnerable to attack only from users that are logged in to DHIS2, and there is no known way of exploiting the vulnerability without first being logged in as a DHIS2 user. A successful exploit of this vulnerability could allow the malicious user to read, edit and delete data in the DHIS2 instance. There are no known exploits of the security vulnerabilities addressed by these patch releases. However, we strongly recommend that all DHIS2 implementations using versions 2.34, 2.35 and 2.36 install these patches as soon as possible. There is no straightforward known workaround for DHIS2 instances using the Tracker functionality other than upgrading the affected DHIS2 server to one of the patches in which this vulnerability has been fixed. For implementations which do NOT use Tracker functionality, it may be possible to block all network access to POST to the /api/trackedEntityInstance endpoint as a temporary workaround while waiting to upgrade.
216 CVE-2021-32615 89 Sql 2021-05-13 2021-05-21
7.5
None Remote Low Not required Partial Partial Partial
Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
217 CVE-2021-32590 89 Exec Code Sql 2021-08-04 2021-08-11
9.0
None Remote Low ??? Complete Complete Complete
Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, and 4.2.2 and earlier may allow an attacker with regular user's privileges to execute arbitrary commands on the underlying SQL database via specifically crafted HTTP requests.
218 CVE-2021-32582 89 Sql 2021-06-17 2021-06-22
5.0
None Remote Low Not required Partial None None
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status responses.
219 CVE-2021-32104 89 Sql 2021-05-07 2021-05-11
6.5
None Remote Low ??? Partial Partial Partial
A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.
220 CVE-2021-32102 89 Sql 2021-05-07 2021-05-11
6.5
None Remote Low ??? Partial Partial Partial
A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.
221 CVE-2021-32099 89 Sql Bypass 2021-05-07 2021-05-11
7.5
None Remote Low Not required Partial Partial Partial
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.
222 CVE-2021-32051 89 Sql 2021-05-14 2021-05-21
5.0
None Remote Low Not required Partial None None
Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.
223 CVE-2021-31869 89 Sql 2021-08-04 2021-08-12
5.0
None Remote Low Not required Partial None None
Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in version 6.9.4 of the product.
224 CVE-2021-31867 89 Sql 2021-08-04 2021-08-12
5.0
None Remote Low Not required Partial None None
Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application. This issue was fixed in version 3.0.2 of the product.
225 CVE-2021-31856 Exec Code Sql 2021-04-28 2021-04-28
0.0
None ??? ??? ??? ??? ??? ???
A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).
226 CVE-2021-31849 89 Sql 2021-11-01 2021-11-03
6.5
None Remote Low ??? Partial Partial Partial
SQL injection vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker logged into ePO as an administrator to inject arbitrary SQL into the ePO database through the user management section of the DLP ePO extension.
227 CVE-2021-31827 89 Sql 2021-05-18 2021-05-25
6.5
None Remote Low ??? Partial Partial Partial
In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. This is in MOVEit.DMZ.WebApp in SILHuman.vb.
228 CVE-2021-31818 89 Sql 2021-06-17 2021-06-21
4.0
None Remote Low ??? Partial None None
Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. Exploiting this vulnerability could allow unauthorised access to database tables.
229 CVE-2021-31777 89 Sql 2021-04-28 2021-08-27
4.0
None Remote Low ??? Partial None None
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
230 CVE-2021-31632 89 Exec Code Sql 2021-12-06 2021-12-07
7.5
None Remote Low Not required Partial Partial Partial
b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. This vulnerability allows attackers to execute arbitrary code via a crafted input.
231 CVE-2021-31586 89 Sql 2021-06-23 2021-06-25
6.5
None Remote Low ??? Partial Partial Partial
Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.
232 CVE-2021-31316 89 Sql 2021-05-18 2021-05-24
10.0
None Remote Low Not required Complete Complete Complete
The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter.
233 CVE-2021-30486 89 Sql 2021-07-22 2021-07-31
6.5
None Remote Low ??? Partial Partial Partial
SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (POST group1), AssetManagementList.jsp (GET computerID or group1), or AssetManagementSummary.jsp (GET group1).
234 CVE-2021-30459 89 Sql 2021-04-14 2021-04-21
7.5
None Remote Low Not required Partial Partial Partial
A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form.
235 CVE-2021-30177 89 Exec Code Sql 2021-04-07 2021-04-13
7.5
None Remote Low Not required Partial Partial Partial
There is a SQL Injection vulnerability in PHP-Nuke 8.3.3 in the User Registration section, leading to remote code execution. This occurs because the U.S. state is not validated to be two letters, and the OrderBy field is not validated to be one of LASTNAME, CITY, or STATE.
236 CVE-2021-30176 89 Sql 2021-04-13 2021-04-14
7.5
None Remote Low Not required Partial Partial Partial
The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint.
237 CVE-2021-30175 89 Sql 2021-04-13 2021-04-14
7.5
None Remote Low Not required Partial Partial Partial
ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page.
238 CVE-2021-30117 89 Sql 2021-07-09 2021-07-12
6.5
None Remote Low ??? Partial Partial Partial
SQL injection exists in Kaseya VSA before 9.5.6.
239 CVE-2021-30081 89 Sql 2021-05-24 2021-05-27
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via admin/navbar.php?action=add_page.
240 CVE-2021-30055 89 Sql 2021-04-05 2021-04-08
6.5
None Remote Low ??? Partial Partial Partial
A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year' parameter when running a report.
241 CVE-2021-30000 89 Exec Code Sql 2021-04-02 2021-04-07
7.5
None Remote Low Not required Partial Partial Partial
An issue was discovered in LATRIX 0.6.0. SQL injection in the txtaccesscode parameter of inandout.php leads to information disclosure and code execution.
242 CVE-2021-29903 89 Sql 2021-10-06 2021-10-14
7.5
None Remote Low Not required Partial Partial Partial
IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 207506.
243 CVE-2021-29798 89 Sql 2021-10-06 2021-10-14
7.5
None Remote Low Not required Partial Partial Partial
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 203734.
244 CVE-2021-29730 89 Sql 2021-07-09 2021-07-15
6.5
None Remote Low ??? Partial Partial Partial
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 201164.
245 CVE-2021-29350 89 Sql 2021-04-29 2021-09-21
6.5
None Remote Low ??? Partial Partial Partial
SQL injection in the getip function in conn/function.php in ??100-???????? 1.1 allows remote attackers to inject arbitrary SQL commands via the X-Forwarded-For header to admin/product_add.php.
246 CVE-2021-29343 89 Sql 2021-03-30 2021-04-05
5.5
None Remote Low ??? Partial Partial None
Ovidentia CMS 6.x contains a SQL injection vulnerability in the "id" parameter of index.php. The "checkbox" property into "text" data can be extracted and displayed in the text region or in source code.
247 CVE-2021-29114 89 Sql 2021-12-07 2021-12-07
7.5
None Remote Low Not required Partial Partial Partial
A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthenticated attacker to impact the confidentiality, integrity and availability of targeted services via specifically crafted queries.
248 CVE-2021-29099 89 Sql 2021-06-07 2021-06-10
5.0
None Remote Low Not required Partial None None
A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue.
249 CVE-2021-29090 89 Exec Code Sql 2021-06-02 2021-06-10
9.0
None Remote Low ??? Complete Complete Complete
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.
250 CVE-2021-29089 89 Exec Code Sql 2021-06-02 2021-06-10
10.0
None Remote Low Not required Complete Complete Complete
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.
Total number of vulnerabilities : 627   Page : 1 2 3 4 5 (This Page)6 7 8 9 10 11 12 13
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.