CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Related To CWE-89

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-3537 89 Exec Code Sql 2013-05-13 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id_post or (2) pg parameter.
2 CVE-2013-3536 89 1 Exec Code Sql 2013-05-13 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the gp_LoadUserFromHash function in functions_hash.php in the Group Pay module 1.5 and earlier for WHMCS allows remote attackers to execute arbitrary SQL commands via the hash parameter.
3 CVE-2013-3533 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Virtual Access Monitor 3.10.17 and earlier allow attackers to execute arbitrary SQL commands via unspecified vectors.
4 CVE-2013-3532 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for Drupal allows remote attackers to execute arbitrary SQL commands via the theme parameter.
5 CVE-2013-3531 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in meneger.php in RadioCMS 2.2 allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
6 CVE-2013-3530 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in playlist.php in the Spiffy XSPF Player plugin 0.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the playlist_id parameter.
7 CVE-2013-3527 89 1 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.
8 CVE-2013-3525 89 Exec Code Sql 2013-05-10 2013-05-16
7.5
 None Remote Low Not required Partial Partial Partial
** DISPUTED ** SQL injection vulnerability in Approvals/ in Request Tracker (RT) 4.0.10 and earlier allows remote attackers to execute arbitrary SQL commands via the ShowPending parameter. NOTE: the vendor disputes this issue, stating "We were unable to replicate it, and the individual that reported it retracted their report," and "we had verified that the claimed exploit did not function according to the author's claims."
9 CVE-2013-3524 89 1 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in popupnewsitem/ in the Pop Up News module 2.0 and possibly earlier for phpVMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter. NOTE: this was originally reported as a problem in phpVMS.
10 CVE-2013-3523 89 Exec Code Sql 2013-05-10 2013-05-13
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in This HTML Is Simple (THIS) before 1.2.4 allows remote to execute arbitrary SQL commands via unspecified vectors.
11 CVE-2013-3522 89 1 Exec Code Sql 2013-05-10 2013-05-13
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in index.php/ajax/api/reputation/vote in vBulletin 5.0.0 Beta 11, 5.0.0 Beta 28, and earlier allows remote authenticated users to execute arbitrary SQL commands via the nodeid parameter.
12 CVE-2013-3510 89 Exec Code Sql 2013-05-08 2013-05-08
6.5
 None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users to execute arbitrary SQL commands via (1) nedi/html/System-Export.php, (2) nedi/html/Devices-List.php, or (3) the Noma component.
13 CVE-2013-3050 89 1 Exec Code Sql 2013-04-12 2013-04-15
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ZAPms 1.41 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter to product.
14 CVE-2013-2690 89 1 Exec Code Sql 2013-03-28 2013-05-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Synchroweb Technology SynConnect 2.0 allows remote attackers to execute arbitrary SQL commands via the loginid parameter in a logoff action.
15 CVE-2013-1842 89 Exec Code Sql 2013-03-20 2013-03-21
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
16 CVE-2013-1748 89 Exec Code Sql 2013-04-18 2013-04-18
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) edit.php or (2) import.php. NOTE: the view.php id vector is already covered by CVE-2008-2565.1 and the edit.php id vector is already covered by CVE-2008-2565.2.
17 CVE-2013-1177 89 Exec Code Sql 2013-04-18 2013-04-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Cisco Network Admission Control (NAC) Manager before 4.8.3.1 and 4.9.x before 4.9.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCub23095.
18 CVE-2013-1163 89 Exec Code Sql 2013-04-01 2013-04-02
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the device-management implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCue14553 and CSCue38746.
19 CVE-2013-0701 89 Exec Code Sql 2013-02-14 2013-02-14
6.0
 None Remote Medium Single system Partial Partial Partial
SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users to execute arbitrary SQL commands by leveraging a logging privilege.
20 CVE-2013-0684 89 Exec Code Sql 2013-05-09 2013-05-09
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
21 CVE-2013-0511 89 Exec Code Sql 2013-03-29 2013-03-29
6.5
 None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified parameters.
22 CVE-2013-0140 89 Exec Code Sql 2013-05-01 2013-05-01
7.9
 None Local Network Medium Not required Complete Complete Complete
SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.
23 CVE-2013-0135 89 Exec Code Sql 2013-04-08 2013-04-09
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.
24 CVE-2013-0123 89 Exec Code Sql 2013-03-21 2013-03-22
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to execute arbitrary SQL commands via (1) the nHistoryId parameter to WebProd/pages/pgHistory.asp or (2) the OrderBy parameter to WebProd/pages/pgadmin.asp.
25 CVE-2012-6529 89 1 Exec Code Sql 2013-01-31 2013-01-31
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Marinet CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) galleryphoto.php or (2) gallery.php; or the roomid parameter to (3) room.php or (4) room2.php.
26 CVE-2012-6526 89 1 Exec Code Sql 2013-01-31 2013-01-31
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in show_code.php in Vastal I-Tech Freelance Zone allows remote attackers to execute arbitrary SQL commands via the code_id parameter.
27 CVE-2012-6525 89 1 Exec Code Sql 2013-01-31 2013-01-31
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in members.php in PHPBridges allows remote attackers to execute arbitrary SQL commands via the id parameter.
28 CVE-2012-6524 89 1 Exec Code Sql 2013-01-31 2013-01-31
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in kommentar.php in pGB 2.12 allows remote attackers to execute arbitrary SQL commands via the id parameter.
29 CVE-2012-6520 89 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the advanced search in Wikidforum 2.10 allow remote attackers to execute arbitrary SQL commands via the (1) select_sort or (2) opt_search_select parameters. NOTE: this issue could not be reproduced by third parties.
30 CVE-2012-6519 89 2 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php.
31 CVE-2012-6516 89 1 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php.
32 CVE-2012-6507 89 1 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in admin.php in ChurchCMS 0.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pass parameters in a login action.
33 CVE-2012-6504 89 1 Exec Code Sql 2013-01-23 2013-01-29
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in mods/hours/data/get_hours.php in PHP Volunteer Management 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
34 CVE-2012-6496 89 Exec Code Sql 2013-01-03 2013-03-01
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
35 CVE-2012-6427 89 Exec Code Sql 2012-12-23 2012-12-24
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Carlo Gavazzi EOS-Box with firmware before 1.0.0.1080_2.1.10 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, a similar issue to CVE-2012-5861.
36 CVE-2012-6273 89 Exec Code Sql 2013-02-24 2013-02-25
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in BigAntSoft BigAnt IM Message Server allows remote attackers to execute arbitrary SQL commands via an SHU (aka search user) request.
37 CVE-2012-6039 89 1 Exec Code Sql 2012-11-26 2012-11-27
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in view_comments.php in YABSoft Advanced Image Hosting (AIH) Script, possibly 2.3, allows remote attackers to execute arbitrary SQL commands via the gal parameter.
38 CVE-2012-5967 89 Exec Code Sql 2012-12-19 2013-01-29
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 allows remote authenticated users to execute arbitrary SQL commands via the menu parameter.
39 CVE-2012-5912 89 2 Exec Code Sql 2012-11-17 2012-11-19
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in PicoPublisher 2.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) page.php or (2) single.php.
40 CVE-2012-5910 89 1 Exec Code Sql 2012-11-17 2012-11-19
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.
41 CVE-2012-5909 89 1 Exec Code Sql 2012-11-17 2012-11-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php.
42 CVE-2012-5900 89 2 Exec Code Sql 2012-11-17 2013-01-15
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in SAMEDIA LandShop 0.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) OB_ID parameter in a single action to admin/action/objects.php, (2) AREA_ID parameter in a single action to admin/action/areas.php, or (3) start parameter in a show action to admin/action/pdf.php.
43 CVE-2012-5894 89 1 Exec Code Sql 2012-11-17 2012-11-19
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter.
44 CVE-2012-5874 89 1 Exec Code Sql 2013-01-11 2013-01-21
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the (1) update_whosonline_reg and (2) update_whosonline_guest functions in Elite Bulletin Board before 2.1.22 allow remote attackers to execute arbitrary SQL commands via the PATH_INFO to (a) checkuser.php, (b) groups.php, (c) index.php, (d) login.php, (e) quicklogin.php, (f) register.php, (g) Search.php, (h) viewboard.php, or (i) viewtopic.php.
45 CVE-2012-5861 89 1 Exec Code Sql 2012-11-23 2013-02-02
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities on the Sinapsi eSolar Light Photovoltaic System Monitor (aka Schneider Electric Ezylog photovoltaic SCADA management server), Sinapsi eSolar, and Sinapsi eSolar DUO with firmware before 2.0.2870_2.2.12 allow remote attackers to execute arbitrary SQL commands via (1) the inverterselect parameter in a primo action to dettagliinverter.php or (2) the lingua parameter to changelanguagesession.php.
46 CVE-2012-5760 89 Exec Code Sql 2013-02-20 2013-02-20
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
47 CVE-2012-5664 89 Exec Code Sql 2012-12-26 2012-12-27
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Authlogic gem for Ruby on Rails allows remote attackers to execute arbitrary SQL commands via a crafted parameter in conjunction with a secret_token value, related to certain behavior of find_by_id and other find_by_ methods.
48 CVE-2012-5590 89 Exec Code Sql 2012-12-26 2013-02-25
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Webmail Plus module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
49 CVE-2012-5550 89 Exec Code Sql 2012-12-03 2012-12-04
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
50 CVE-2012-5453 89 Exec Code Sql 2012-10-22 2013-04-10
6.5
 None Remote Low Single system Partial Partial Partial
SQL injection vulnerability in user/index_inline_editor_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167.
Total number of vulnerabilities : 3530   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.