Export limit exceeded: 45239 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (45239 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-25753 | 1 Wdmtech | 1 Vmap | 2026-10-01 | 8.2 High |
| Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the latlngbound parameter. Attackers can send GET requests to index.php with the option=com_vmap&task=loadmarker parameters containing SQL injection payloads to manipulate database queries and extract sensitive information. | ||||
| CVE-2019-25750 | 1 Cmsjunkie | 1 Multiplehotelreservation | 2026-10-01 | 8.2 High |
| Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column data. | ||||
| CVE-2019-25749 | 1 Cmsjunkie | 2 Cruiseportal, J-cruiseportal | 2026-10-01 | 7.1 High |
| Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the guest_adult parameter. Attackers can send POST requests to the cruises endpoint with crafted SQL payloads in the guest_adult parameter to extract sensitive database information or manipulate database records. | ||||
| CVE-2019-25748 | 1 Cmsjunkie | 1 Jhotelreservation | 2026-10-01 | 8.2 High |
| Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rooms parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL payloads in the rooms parameter to extract sensitive database information including version details. | ||||
| CVE-2017-20281 | 1 Joomlaboat | 1 Extra Search | 2026-10-01 | 8.2 High |
| Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the establename parameter. Attackers can send GET requests to index.php with the option=com_extrasearch parameter and malicious SQL in the establename field to extract sensitive database information. | ||||
| CVE-2017-20279 | 1 Extensions | 1 Joomla Payage | 2026-10-01 | 8.2 High |
| Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the aid parameter. Attackers can send GET requests to index.php with malicious aid values in the make_payment task to extract sensitive database information using boolean-based blind or time-based blind techniques. | ||||
| CVE-2017-20272 | 1 Faboba | 1 Ultimate Property Listing | 2026-10-01 | 8.2 High |
| Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the sf_selectuser_id parameter. Attackers can send GET requests to index.php with the option=com_upl and view=propertylisting parameters to extract sensitive database information including table names and column structures. | ||||
| CVE-2017-20266 | 1 Joomshaper | 2 Sp Movie Database, Standard Pro Movie Database | 2026-10-01 | 8.2 High |
| Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the searchword parameter. Attackers can send GET requests to the searchresults view with crafted SQL payloads in the searchword parameter to extract sensitive database information. | ||||
| CVE-2017-20263 | 1 Focalpointx | 2 Focalpoint, Focalpoint Pro / Free | 2026-10-01 | 8.2 High |
| Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_focalpoint, view=location, and a crafted id parameter containing SQL commands to extract sensitive database information. | ||||
| CVE-2017-20259 | 1 Joomlashack | 1 Osdownloads | 2026-10-01 | 8.2 High |
| Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_osdownloads&view=item&id=[SQL] to extract sensitive database information including credentials and configuration data. | ||||
| CVE-2017-20257 | 1 Joomplace | 1 Quiz Deluxe | 2026-10-01 | 8.2 High |
| Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the ajaxaction.flag_question task. Attackers can inject malicious SQL code via the stu_quiz_id or flag_quest parameters to manipulate database queries and extract sensitive information. | ||||
| CVE-2017-20256 | 1 Joomplace | 1 Survey Force Deluxe | 2026-10-01 | 8.2 High |
| Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the invite parameter. Attackers can send GET requests to the component with crafted SQL payloads in the invite parameter to extract sensitive database information. | ||||
| CVE-2017-20254 | 1 Gegabyte | 1 User Bench | 2026-10-01 | 8.2 High |
| Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the userid parameter. Attackers can send GET requests to index.php with the option=com_userbench&view=detail&userid parameter containing SQL injection payloads to extract sensitive database information including credentials and configuration data. | ||||
| CVE-2017-20253 | 1 Gegabyte | 1 My Projects | 2026-10-01 | 8.2 High |
| Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the VerAyari parameter. Attackers can craft requests to the component endpoint with SQL injection payloads to extract sensitive database information including credentials and system data. | ||||
| CVE-2026-103758 | 1 Obot-platform | 1 Obot | 2026-10-01 | 8.1 High |
| Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the checkUI deny list omits the /mcp-connect-composite/ route. Basic-role users with a composite MCP ID can proxy requests through mcpGateway.Proxy to invoke tools on MCP servers restricted by Access Control Rules. | ||||
| CVE-2026-103274 | 1 Ghost | 1 Ghost | 2026-10-01 | 5.3 Medium |
| Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings. | ||||
| CVE-2026-103269 | 1 Ghost | 1 Ghost | 2026-10-01 | 5.3 Medium |
| Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content). | ||||
| CVE-2026-103265 | 1 Fleetdm | 1 Fleet | 2026-10-01 | 4.3 Medium |
| Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses. | ||||
| CVE-2026-101079 | 1 Agentverus | 1 Agentverus-scanner | 2026-10-01 | 2.8 Low |
| A vulnerability was found in agentverus agentverus-scanner up to 0.8.1. Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js. Performing a manipulation results in reliance on untrusted inputs in a security decision. The attack must be initiated from a local position. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-101018 | 2 Dayrui, Xunruicms | 2 Xunruicms, Xunruicms | 2026-10-01 | 4.7 Medium |
| A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||