Export limit exceeded: 19010 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (19010 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-37590 | 1 Sourcecodester | 1 Storage Unit Rental Management System | 2026-04-17 | 2.7 Low |
| SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php. | ||||
| CVE-2026-37597 | 1 Sourcecodester | 1 Online Employees Work From Home Attendance System | 2026-04-17 | 2.7 Low |
| SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php. | ||||
| CVE-2026-27743 | 1 Spip | 2 Referer Spam, Spip | 2026-04-17 | 9.8 Critical |
| The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_supprimer action handlers. The handlers read the url parameter from a GET request and interpolate it directly into SQL LIKE clauses without input validation or parameterization. The endpoints do not enforce authorization checks and do not use SPIP action protections such as securiser_action(), allowing remote attackers to execute arbitrary SQL queries. | ||||
| CVE-2026-3148 | 2 Haben-cs9, Sourcecodester | 2 Simple And Nice Shopping Cart Script, Simple And Nice Shopping Cart Script | 2026-04-17 | 7.3 High |
| A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-3149 | 2 Angeljudesuarez, Itsourcecode | 2 College Management System, College Management System | 2026-04-17 | 6.3 Medium |
| A weakness has been identified in itsourcecode College Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/asign-single-student-subjects.php. Executing a manipulation of the argument course_code can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-3150 | 2 Angeljudesuarez, Itsourcecode | 2 College Management System, College Management System | 2026-04-17 | 6.3 Medium |
| A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php. The manipulation of the argument teacher_id leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-3151 | 2 Angeljudesuarez, Itsourcecode | 2 College Management System, College Management System | 2026-04-17 | 7.3 High |
| A vulnerability was detected in itsourcecode College Management System 1.0. This vulnerability affects unknown code of the file /login/login.php. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. | ||||
| CVE-2026-3152 | 2 Angeljudesuarez, Itsourcecode | 2 College Management System, College Management System | 2026-04-17 | 7.3 High |
| A flaw has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/teacher-salary.php. This manipulation of the argument teacher_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2026-3153 | 2 Admerc, Itsourcecode | 2 Document Management System, Document Management System | 2026-04-17 | 7.3 High |
| A vulnerability has been found in itsourcecode Document Management System 1.0. Impacted is an unknown function of the file /register.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-36944 | 1 Sourcecodester | 1 Computer And Mobile Repair Shop Management System | 2026-04-17 | 2.7 Low |
| Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php. | ||||
| CVE-2026-36937 | 1 Sourcecodester | 1 Online Resort Management System | 2026-04-17 | 2.7 Low |
| Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php. | ||||
| CVE-2026-36941 | 1 Sourcecodester | 1 Online Resort Management System | 2026-04-17 | 2.7 Low |
| Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php. | ||||
| CVE-2026-36945 | 1 Sourcecodester | 1 Computer And Mobile Repair Shop Management System | 2026-04-17 | 2.7 Low |
| Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php | ||||
| CVE-2026-36948 | 1 Sourcecodester | 1 Online Thesis Archiving System | 2026-04-17 | 7.3 High |
| Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php. | ||||
| CVE-2026-36942 | 1 Sourcecodester | 1 Online Resort Management System | 2026-04-17 | 2.7 Low |
| Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php. | ||||
| CVE-2026-36938 | 1 Sourcecodester | 1 Online Resort Management System | 2026-04-17 | 2.7 Low |
| Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php. | ||||
| CVE-2026-36952 | 1 Sourcecodester | 1 Online Thesis Archiving System | 2026-04-17 | 2.7 Low |
| Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php. | ||||
| CVE-2026-36943 | 1 Sourcecodester | 1 Computer And Mobile Repair Shop Management System | 2026-04-17 | 2.7 Low |
| Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php. | ||||
| CVE-2026-36950 | 1 Sourcecodester | 1 Online Thesis Archiving System | 2026-04-17 | 2.7 Low |
| Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php. | ||||
| CVE-2026-32271 | 1 Craftcms | 1 Commerce | 2026-04-17 | N/A |
| Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the Commerce TotalRevenue widget which allows any authenticated control panel user to achieve remote code execution through a four-step exploitation chain. The attack exploits unsanitized widget settings interpolated into SQL expressions, combined with PDO's default multi-statement query support, to inject a maliciously serialized PHP object into the queue table. When the queue consumer processes the injected job, the unrestricted unserialize() call in yii2-queue instantiates a GuzzleHttp FileCookieJar gadget chain whose __destruct() method writes a PHP webshell to the server's webroot. The complete chain requires only three HTTP requests, no administrative privileges, and results in arbitrary command execution as the PHP process user, with queue processing triggered via an unauthenticated endpoint. This issue has been fixed in versions 4.10.3 and 5.5.5. | ||||