CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In 2010(SQL Injection)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2010-4641 89 Exec Code Sql 2010-12-30 2010-12-31
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in XWiki Enterprise before 2.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
2 CVE-2010-4639 89 2 Exec Code Sql 2010-12-30 2010-12-31
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in MySource Matrix allows remote attackers to execute arbitrary SQL commands via the id parameter.
3 CVE-2010-4638 89 1 Exec Code Sql 2010-12-30 2010-12-31
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in the submitSurvey function in controller.php in JQuarks4s (com_jquarks4s) component 1.0.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the q parameter in a submitSurvey action to index.php.
4 CVE-2010-4636 89 1 Exec Code Sql 2010-12-30 2010-12-31
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in Site2Nite Business e-Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
5 CVE-2010-4635 89 2 Exec Code Sql 2010-12-30 2010-12-31
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in detail.asp in Site2Nite Vacation Rental (VRBO) Listings allows remote attackers to execute arbitrary SQL commands via the ID parameter.
6 CVE-2010-4633 89 2 Exec Code Sql 2010-12-30 2010-12-31
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in cart.php in digiSHOP 2.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vulnerability than CVE-2005-4614.1.
7 CVE-2010-4632 89 2 Exec Code Sql 2010-12-30 2010-12-31
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in ASPilot Pilot Cart 7.3 allow remote attackers to execute arbitrary SQL commands via the (1) article parameter to kb.asp, (2) specific parameter to cart.asp, (3) countrycode parameter to contact.asp, and the (4) srch parameter to search.asp. NOTE: the article parameter to pilot.asp is already covered by CVE-2008-2688.
8 CVE-2010-4619 89 1 Exec Code Sql 2010-12-29 2011-01-03
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in profil.php in Mafya Oyun Scrpti (aka Mafia Game Script) allows remote attackers to execute arbitrary SQL commands via the id parameter.
9 CVE-2010-4615 89 1 Exec Code Sql 2010-12-29 2010-12-30
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Oto Galeri Sistemi 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) arac parameter to carsdetail.asp and the (2) marka parameter to twohandscars.asp.
10 CVE-2010-4614 89 1 Exec Code Sql 2010-12-29 2010-12-30
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in item.php in Ero Auktion 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-0723.
11 CVE-2010-4612 89 1 Exec Code Sql 2010-12-29 2011-01-11
6.8
None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in Hycus CMS 1.0.3, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) usr_email parameters to user/1/hregister.html, (3) usr_email parameter to user/1/hlogin.html, (4) useremail parameter to user/1/forgotpass.html, and the (5) q parameter to search/1.html. NOTE: some of these details are obtained from third party information.
12 CVE-2010-4609 89 1 Exec Code Sql 2010-12-29 2011-01-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to execute arbitrary SQL commands via the nuser parameter in a registrate action.
13 CVE-2010-4517 89 1 Exec Code Sql 2010-12-09 2010-12-10
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in the JExtensions JE Auto (com_jeauto) component 1.0 for Joomla!, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the char parameter in an item action to index.php.
14 CVE-2010-4505 89 Exec Code Sql 2010-12-08 2010-12-09
6.8
None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in login.php in Injader 2.4.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) un and (2) pw parameters.
15 CVE-2010-4503 89 1 Exec Code Sql 2010-12-08 2010-12-09
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in indexlight.php in Aigaion 1.3.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter in an export action.
16 CVE-2010-4500 89 Exec Code Sql 2010-12-08 2010-12-09
6.8
None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in contact.php in MRCGIGUY (MCG) FreeTicket 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) subject, and (4) message parameters in a sendmess action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
17 CVE-2010-4404 89 Exec Code Sql 2010-12-06 2010-12-16
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Yannick Gaultier sh404SEF component before 2.1.8.777 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
18 CVE-2010-4400 89 2 Exec Code Sql 2010-12-06 2010-12-20
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in _rights.php in DynPG CMS 4.2.0 allows remote attackers to execute arbitrary SQL commands via the giveRights_UserId parameter.
19 CVE-2010-4365 89 2 Exec Code Sql 2010-12-01 2010-12-02
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in JE Ajax Event Calendar (com_jeajaxeventcalendar) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the event_id parameter in an alleventlist_more action to index.php.
20 CVE-2010-4363 89 1 Exec Code Sql 2010-12-01 2010-12-02
6.8
None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in contact.php in MRCGIGUY (MCG) FreeTicket 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) email parameters in a showtickets action.
21 CVE-2010-4362 89 1 Exec Code Sql 2010-12-01 2011-04-08
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in MicroNetsoft RV Dealer Website allow remote attackers to execute arbitrary SQL commands via the (1) selStock parameter to search.asp and the (2) orderBy parameter to showAlllistings.asp.
22 CVE-2010-4360 89 Exec Code Sql 2010-12-01 2010-12-02
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in index.php in Jurpopage 0.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) note and (2) pg parameters, different vectors than CVE-2010-4359. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
23 CVE-2010-4359 89 2 Exec Code Sql 2010-12-01 2010-12-02
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Jurpopage 0.2.0 allows remote attackers to execute arbitrary SQL commands via the category parameter.
24 CVE-2010-4357 89 1 Exec Code Sql 2010-12-01 2010-12-02
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter.
25 CVE-2010-4356 89 2 Exec Code Sql 2010-12-01 2010-12-02
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in news_default.asp in Site2Nite Big Truck Broker allows remote attackers to execute arbitrary SQL commands via the txtSiteId parameter.
26 CVE-2010-4298 89 Exec Code Sql 2010-11-26 2010-11-29
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the download module in Free Simple Software 1.0 allows remote attackers to execute arbitrary SQL commands via the downloads_id parameter in a download_now action to index.php.
27 CVE-2010-4280 89 2 Exec Code Sql 2010-12-02 2013-07-17
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group parameter in an operation/agentes/ver_agente action to ajax.php or (2) the group_id parameter in an operation/agentes/estado_agente action to index.php, related to operation/agentes/estado_agente.php.
28 CVE-2010-4273 89 2 Exec Code Sql 2010-11-16 2010-11-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in imoveis.php in DescargarVista ACC IMoveis 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
29 CVE-2010-4272 89 2 Exec Code Sql 2010-11-16 2010-11-17
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Pulse Infotech Sponsor Wall (com_sponsorwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
30 CVE-2010-4271 89 Exec Code Sql 2010-11-16 2010-11-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ImpressCMS before 1.2.3 RC2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
31 CVE-2010-4269 89 2 Exec Code Sql 2010-11-16 2010-11-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in managechat.php in Collabtive 0.65 allows remote attackers to execute arbitrary SQL commands via the chatstart[USERTOID] cookie in a pull action.
32 CVE-2010-4268 89 2 Exec Code Sql 2010-11-16 2010-11-18
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Pulse Infotech Flip Wall (com_flipwall) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
33 CVE-2010-4257 89 Exec Code Sql 2010-12-07 2011-01-19
6.0
None Remote Medium Single system Partial Partial Partial
SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.
34 CVE-2010-4186 89 1 Exec Code Sql 2010-11-05 2010-11-09
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: some of these details are obtained from third party information.
35 CVE-2010-4185 89 1 Exec Code Sql 2010-11-05 2010-11-09
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in Energine, possibly 2.3.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the NRGNSID cookie.
36 CVE-2010-4152 89 Exec Code Sql 2010-11-03 2010-11-04
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in catalog/index.shtml in 4site CMS 2.6, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the cat parameter. NOTE: the i and th vectors are already covered by CVE-2009-0646.
37 CVE-2010-4151 89 1 Exec Code Sql 2010-11-03 2010-11-04
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in misc.php in DeluxeBB 1.3, and possibly earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the xthedateformat parameter in a register action, a different vector than CVE-2005-2989, CVE-2006-2503, and CVE-2009-1033.
38 CVE-2010-4147 89 Exec Code Sql 2010-11-01 2010-11-04
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to (1) index.php and (2) product-list.php.
39 CVE-2010-4144 89 2 Exec Code Sql 2010-11-01 2010-11-03
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in radyo.asp in Kisisel Radyo Script allows remote attackers to execute arbitrary SQL commands via the Id parameter.
40 CVE-2010-4143 89 1 Exec Code Sql 2010-11-01 2010-11-03
6.8
None Remote Medium Not required Partial Partial Partial
SQL injection vulnerability in chart.php in phpCheckZ 1.1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter.
41 CVE-2010-4006 89 1 Exec Code Sql 2010-11-03 2010-12-07
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in search.php in WSN Links 5.0.x before 5.0.81, 5.1.x before 5.1.51, and 6.0.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via the (1) namecondition or (2) namesearch parameter.
42 CVE-2010-3922 89 Exec Code Sql 2010-12-09 2011-01-12
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
43 CVE-2010-3870 20 Sql XSS Bypass 2010-11-12 2011-03-23
6.8
None Remote Medium Not required Partial Partial Partial
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.
44 CVE-2010-3608 89 2 Exec Code Sql 2010-09-24 2010-09-27
7.5
None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in wpQuiz 2.7 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) password (pw) parameters to (a) admin.php or (b) user.php.
45 CVE-2010-3604 89 Exec Code Sql 2010-09-24 2010-09-27
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
46 CVE-2010-3601 89 2 Exec Code Sql 2010-09-24 2010-09-27
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in index.php in ibPhotohost 1.1.2 allows remote attackers to execute arbitrary SQL commands via the img parameter.
47 CVE-2010-3485 89 Exec Code Sql 2010-09-22 2010-09-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
48 CVE-2010-3484 89 2 Exec Code Sql 2010-09-22 2010-09-23
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593.
49 CVE-2010-3482 89 2 Exec Code Sql 2010-09-22 2010-09-23
6.5
None Remote Low Single system Partial Partial Partial
Multiple SQL injection vulnerabilities in cms_write.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) title and (2) menutitle parameters. NOTE: this can be leveraged with CVE-2010-3483 to conduct attacks without authentication.
50 CVE-2010-3481 89 1 Exec Code Sql 2010-09-22 2010-09-23
6.8
None Remote Medium Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) password variables, possibly related to include/classes/Login.php. NOTE: some of these details are obtained from third party information. NOTE: the password vector might not be vulnerable.
Total number of vulnerabilities : 520   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.