Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (20373 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-74015 2 Merkulove, Wordpress 2 Readabler, Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
CVE-2026-32552 2 Wordpress, Yith 2 Wordpress, Yith Woocommerce Membership Premium 2026-08-21 8.5 High
Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.
CVE-2026-73183 2 Get Maps Marker Pro, Wordpress 2 Maps Marker Pro, Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.
CVE-2026-68789 1 Microsoft 1 Azure Sql Database 2026-08-21 9.9 Critical
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
CVE-2026-73391 2 Klbtheme, Wordpress 2 Total Donations, Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
CVE-2026-66594 2 Lukeseager, Wordpress 2 Wordpress Persistent Login, Wordpress 2026-08-21 8.5 High
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
CVE-2026-66609 2 Codexthemes, Wordpress 2 Thegem (elementor), Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
CVE-2026-73998 2 Axew3, Wordpress 2 Wp W3all Phpbb, Wordpress 2026-08-21 8.5 High
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
CVE-2026-74013 2 Wordpress, Wordpress.com 2 Wordpress, Eshipper Commerce 2026-08-21 8.5 High
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
CVE-2026-77392 1 Sourcecodester 2 Dynamic Input Field Generator Using Html, Css, And Php, Dynamic Input Field Generator Using Html Css And Php 2026-08-21 6.3 Medium
A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-70819 1 Oracle 1 Hyperion Financial Management 2026-08-21 8.8 High
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-70821 1 Oracle 1 Hyperion Financial Management 2026-08-21 8.8 High
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-70818 1 Oracle 1 Hyperion Financial Management 2026-08-21 8.8 High
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-70729 1 Oracle 1 Teleservice 2026-08-21 8.8 High
Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Request Form). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Teleservice. Successful attacks of this vulnerability can result in takeover of Oracle Teleservice. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2025-14603 1 Vsdesk 1 Vsdesk 2026-08-20 N/A
The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive.  Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
CVE-2026-77025 1 Itsourcecode 1 Hospital Management System 2026-08-20 6.3 Medium
A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-76783 1 Dedecms 1 Dedecms 2026-08-20 7.3 High
A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-63037 1 Apache Software Foundation 1 Apache Inlong 2026-08-20 N/A
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/issues/12079 .
CVE-2026-63038 1 Apache 1 Inlong 2026-08-20 N/A
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters.  This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/issues/12135 .
CVE-2026-63039 1 Apache 1 Inlong 2026-08-20 N/A
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12080 .