476 vulnerabilidades · Database · ⚡ Nuclei Orden: CVSS EPSS Año ID
CVE-2024-1071
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Web Database Windows ⚡ nuclei
9.8
CRITICAL
EPSS
92.9%
2024 10 PoCs

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Scanner Automatizado
nuclei -t CVE-2024-1071.yaml ⎘
CVE-2019-2729
WebLogic Server Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
94.4%
2019 10 PoCs

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scanner Automatizado
nuclei -t CVE-2019-2729.yaml ⎘
CVE-2019-12989
🔥 KEV Software Genérico Networking Database ⚡ nuclei
9.8
CRITICAL
EPSS
91.5%
2019 2 PoCs

Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

Scanner Automatizado
nuclei -t CVE-2019-12989.yaml ⎘
CVE-2021-2135
WebLogic Server DevOps Database ⚡ nuclei
9.8
CRITICAL
EPSS
77.6%
2021 1 PoC

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scanner Automatizado
nuclei -t CVE-2021-2135.yaml ⎘
CVE-2021-35587
🔥 KEV Access Manager Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
94.3%
2021 3 PoCs

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scanner Automatizado
nuclei -t CVE-2021-35587.yaml ⎘
CVE-2021-41691
Software Genérico Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
3.0%
2021 0 PoCs

A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php.

Scanner Automatizado
nuclei -t CVE-2021-41691.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2021-44427
Software Genérico Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
83.9%
2021 1 PoC

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.

Scanner Automatizado
nuclei -t CVE-2021-44427.yaml ⎘
CVE-2021-42258
🔥 KEV Software Genérico Database ⚡ nuclei
9.8
CRITICAL
EPSS
94.1%
2021 1 PoC

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in the wild in October 2021 for ransomware installation. SQL injection can, for example, use the txtID (aka username) parameter. Successful exploitation can include the ability to execute arbitrary code as MSSQLSERVER$ via xp_cmdshell.

Scanner Automatizado
nuclei -t CVE-2021-42258.yaml ⎘
CVE-2017-18362
🔥 KEV Software Genérico Database ⚡ nuclei
9.8
CRITICAL
EPSS
80.3%
2017 1 PoC

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

Scanner Automatizado
nuclei -t CVE-2017-18362.yaml ⎘
CVE-2025-8868
Chef Automate Database ⚡ nuclei
9.8
CRITICAL
EPSS
17.3%
2025 CWE-200 0 PoCs

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.

Scanner Automatizado
nuclei -t CVE-2025-8868.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2025-61882
🔥 KEV Oracle Concurrent Processing Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
89.4%
2025 11 PoCs

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scanner Automatizado
nuclei -t CVE-2025-61882.yaml ⎘
CVE-2025-32814
Software Genérico Database ⚡ nuclei
9.8
CRITICAL
EPSS
32.1%
2025 0 PoCs

An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur.

Scanner Automatizado
nuclei -t CVE-2025-32814.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2025-61757
🔥 KEV Identity Manager Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
87.8%
2025 1 PoC

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scanner Automatizado
nuclei -t CVE-2025-61757.yaml ⎘
CVE-2025-29085
Software Genérico Database ⚡ nuclei
9.8
CRITICAL
EPSS
22.6%
2025 0 PoCs

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.

Scanner Automatizado
nuclei -t CVE-2025-29085.yaml ⎘
Exploits & PoCs
🔍 GCVE ⚔ EDB
CVE-2020-17463
🔥 KEV Software Genérico Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
17.5%
2020 2 PoCs

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

Scanner Automatizado
nuclei -t CVE-2020-17463.yaml ⎘
CVE-2020-2551
🔥 KEV WebLogic Server Database ⚡ nuclei
9.8
CRITICAL
EPSS
94.4%
2020 9 PoCs

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scanner Automatizado
nuclei -t CVE-2020-2551.yaml ⎘
CVE-2020-14750
🔥 KEV WebLogic Server Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
94.4%
2020 3 PoCs

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scanner Automatizado
nuclei -t CVE-2020-14750.yaml ⎘
CVE-2020-14882
🔥 KEV WebLogic Server Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
94.5%
2020 38 PoCs

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Scanner Automatizado
nuclei -t CVE-2020-14882.yaml ⎘
CVE-2020-0618
🔥 KEV Microsoft SQL Server Database ⚡ nuclei
9.8
CRITICAL
EPSS
94.3%
2020 6 PoCs

A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.

Scanner Automatizado
nuclei -t CVE-2020-0618.yaml ⎘
CVE-2020-5722
🔥 KEV Grandstream UCM6200 Series Web Database ⚡ nuclei
9.8
CRITICAL
EPSS
92.7%
2020 3 PoCs

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.

Scanner Automatizado
nuclei -t CVE-2020-5722.yaml ⎘