Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2017-11161

Summary
Assigner-synology
Assigner Org ID-db201096-a0cc-46c7-9a55-61d9e221bf01
Published At-08 Sep, 2017 | 14:00
Updated At-16 Sep, 2024 | 16:49
Rejected At-
Credits

Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:synology
Assigner Org ID:db201096-a0cc-46c7-9a55-61d9e221bf01
Published At:08 Sep, 2017 | 14:00
Updated At:16 Sep, 2024 | 16:49
Rejected At:
▼CVE Numbering Authority (CNA)

Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

Affected Products
Vendor
Synology, Inc.Synology
Product
Synology Photo Station
Versions
Affected
  • before 6.7.4-3433 and 6.3-2968
Problem Types
TypeCWE IDDescription
CWECWE-89Improper Neutralization of Special Elements used in an SQL Command (CWE-89)
Type: CWE
CWE ID: CWE-89
Description: Improper Neutralization of Special Elements used in an SQL Command (CWE-89)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
x_refsource_CONFIRM
Hyperlink: https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
Resource:
x_refsource_CONFIRM
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
x_refsource_CONFIRM
x_transferred
Hyperlink: https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
Resource:
x_refsource_CONFIRM
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@synology.com
Published At:08 Sep, 2017 | 14:29
Updated At:20 Apr, 2025 | 01:37

Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.09.8CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary2.07.5HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
Type: Primary
Version: 3.0
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 2.0
Base score: 7.5
Base severity: HIGH
Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
CPE Matches
Synology, Inc.
synology
>>photo_station>>Versions up to 6.3-2967(inclusive)
cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*
Synology, Inc.
synology
>>photo_station>>Versions up to 6.7.3-3432(inclusive)
cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-89Secondarysecurity@synology.com
CWE-89Primarynvd@nist.gov
CWE ID: CWE-89
Type: Secondary
Source: security@synology.com
CWE ID: CWE-89
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStationsecurity@synology.com
Vendor Advisory
https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStationaf854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Hyperlink: https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
Source: security@synology.com
Resource:
Vendor Advisory
Hyperlink: https://www.synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

7333Records found
CVE-2021-43926
Matching Score-10
Assigner-Synology Inc.
ShareView Details
Matching Score-10
Assigner-Synology Inc.
CVSS Score-4.7||MEDIUM
EPSS-0.41% / 60.61%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-43927
Matching Score-10
Assigner-Synology Inc.
ShareView Details
Matching Score-10
Assigner-Synology Inc.
CVSS Score-4.7||MEDIUM
EPSS-0.41% / 61.17%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-33180
Matching Score-10
Assigner-Synology Inc.
ShareView Details
Matching Score-10
Assigner-Synology Inc.
CVSS Score-7.3||HIGH
EPSS-0.34% / 56.39%
||
7 Day CHG~0.00%
Published-01 Jun, 2021 | 09:45
Updated-17 Sep, 2024 | 03:34
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server before 1.8.1-2876 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-media_serverSynology Media Server
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-43925
Matching Score-10
Assigner-Synology Inc.
ShareView Details
Matching Score-10
Assigner-Synology Inc.
CVSS Score-4.7||MEDIUM
EPSS-0.41% / 60.61%
||
7 Day CHG~0.00%
Published-07 Feb, 2022 | 02:15
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2015-6910
Matching Score-10
Assigner-MITRE Corporation
ShareView Details
Matching Score-10
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.63% / 69.81%
||
7 Day CHG~0.00%
Published-11 Sep, 2015 | 16:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SQL injection vulnerability in Synology Video Station before 1.5-0757 allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi.

Action-Not Available
Vendor-n/aSynology, Inc.
Product-video_stationn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-11821
Matching Score-10
Assigner-Synology Inc.
ShareView Details
Matching Score-10
Assigner-Synology Inc.
CVSS Score-7.3||HIGH
EPSS-0.58% / 68.47%
||
7 Day CHG~0.00%
Published-30 Jun, 2019 | 15:00
Updated-17 Sep, 2024 | 01:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationPhoto Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2018-8914
Matching Score-10
Assigner-Synology Inc.
ShareView Details
Matching Score-10
Assigner-Synology Inc.
CVSS Score-7.3||HIGH
EPSS-0.32% / 54.96%
||
7 Day CHG~0.00%
Published-10 May, 2018 | 13:00
Updated-16 Sep, 2024 | 17:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter.

Action-Not Available
Vendor-Synology, Inc.
Product-media_serverMedia Server
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2015-6911
Matching Score-10
Assigner-MITRE Corporation
ShareView Details
Matching Score-10
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-1.58% / 81.32%
||
7 Day CHG~0.00%
Published-11 Sep, 2015 | 16:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi.

Action-Not Available
Vendor-n/aSynology, Inc.
Product-video_stationn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2017-14491
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-60.19% / 98.23%
||
7 Day CHG~0.00%
Published-02 Oct, 2017 | 21:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

Action-Not Available
Vendor-thekelleysn/aHuawei Technologies Co., Ltd.Debian GNU/LinuxSUSERed Hat, Inc.Aruba NetworksSynology, Inc.NVIDIA CorporationArista Networks, Inc.Canonical Ltd.openSUSEMicrosoft CorporationSiemens AG
Product-enterprise_linux_desktopruggedcom_rm1224_firmwarescalance_w1750d_firmwarescalance_s615enterprise_linux_workstationlinux_for_tegradnsmasqlinux_enterprise_serverleaprouter_managerlinux_enterprise_point_of_salearubaosenterprise_linux_serverdebian_linuxjetson_tk1scalance_s615_firmwaregeforce_experiencelinux_enterprise_debuginfoeosscalance_m-800diskstation_managerhonor_v9_play_firmwarejetson_tx1scalance_w1750druggedcom_rm1224ubuntu_linuxhonor_v9_playscalance_m-800_firmwarewindowsn/a
CWE ID-CWE-787
Out-of-bounds Write
CVE-2021-27649
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-1.46% / 80.57%
||
7 Day CHG~0.00%
Published-23 Jun, 2021 | 09:50
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerdiskstation_manager_unified_controllerDiskStation Manager (DSM)
CWE ID-CWE-416
Use After Free
CVE-2021-27646
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-2.20% / 84.16%
||
7 Day CHG~0.00%
Published-12 Mar, 2021 | 06:45
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Use After Free vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerSynology DiskStation Manager (DSM)
CWE ID-CWE-416
Use After Free
CVE-2020-27654
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-3.05% / 86.42%
||
7 Day CHG~0.00%
Published-29 Oct, 2020 | 08:55
Updated-17 Sep, 2024 | 04:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.

Action-Not Available
Vendor-Synology, Inc.
Product-router_managerSynology Router Manager (SRM)
CWE ID-CWE-269
Improper Privilege Management
CVE-2017-11153
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-15.08% / 94.43%
||
7 Day CHG~0.00%
Published-08 Aug, 2017 | 15:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-502
Deserialization of Untrusted Data
CVE-2019-11829
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-7.3||HIGH
EPSS-2.19% / 84.09%
||
7 Day CHG~0.00%
Published-30 Jun, 2019 | 15:05
Updated-16 Sep, 2024 | 18:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header.

Action-Not Available
Vendor-Synology, Inc.
Product-calendarCalendar
CWE ID-CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2016-6554
Matching Score-8
Assigner-CERT/CC
ShareView Details
Matching Score-8
Assigner-CERT/CC
CVSS Score-9.8||CRITICAL
EPSS-1.46% / 80.61%
||
7 Day CHG~0.00%
Published-13 Jul, 2018 | 20:00
Updated-06 Aug, 2024 | 01:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Synology NAS servers DS107, DS116, and DS213, use default credentials

Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of: guest:(blank) and admin:(blank) . A remote network attacker can gain privileged access to a vulnerable device.

Action-Not Available
Vendor-Synology, Inc.
Product-ds213ds213_firmwareds116ds107_firmwareds116_firmwareds107NAS server DS213NAS server DS116NAS server DS107
CWE ID-CWE-255
Not Available
CVE-2016-10329
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-14.28% / 94.25%
||
7 Day CHG~0.00%
Published-12 May, 2017 | 20:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2021-27647
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-1.67% / 81.87%
||
7 Day CHG~0.00%
Published-12 Mar, 2021 | 06:35
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Out-of-bounds Read vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerSynology DiskStation Manager (DSM)
CWE ID-CWE-125
Out-of-bounds Read
CVE-2020-27655
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-6.5||MEDIUM
EPSS-1.22% / 78.84%
||
7 Day CHG~0.00%
Published-29 Oct, 2020 | 08:55
Updated-17 Sep, 2024 | 00:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.

Action-Not Available
Vendor-Synology, Inc.
Product-router_managerSynology Router Manager (SRM)
CWE ID-CWE-269
Improper Privilege Management
CVE-2018-8919
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-8.3||HIGH
EPSS-0.26% / 49.33%
||
7 Day CHG~0.00%
Published-24 Dec, 2018 | 15:00
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Information exposure vulnerability in SYNO.Core.Desktop.SessionData in Synology DiskStation Manager (DSM) before 6.1.6-15266 allows remote attackers to steal credentials via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerDiskStation Manager (DSM)
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2018-1160
Matching Score-8
Assigner-Tenable Network Security, Inc.
ShareView Details
Matching Score-8
Assigner-Tenable Network Security, Inc.
CVSS Score-9.8||CRITICAL
EPSS-89.73% / 99.55%
||
7 Day CHG~0.00%
Published-20 Dec, 2018 | 21:00
Updated-13 Feb, 2026 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.

Action-Not Available
Vendor-netatalkNetatalkSynology, Inc.Debian GNU/Linux
Product-netatalkskynasrouter_managerdebian_linuxvs960hddiskstation_managervs960hd_firmwareNetatalk
CWE ID-CWE-787
Out-of-bounds Write
CVE-2017-15887
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.42% / 61.42%
||
7 Day CHG~0.00%
Published-07 Nov, 2017 | 15:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An improper restriction of excessive authentication attempts vulnerability in /principals in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack.

Action-Not Available
Vendor-Synology, Inc.
Product-carddav_serverSynology CardDAV Server
CWE ID-CWE-307
Improper Restriction of Excessive Authentication Attempts
CVE-2017-11151
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-14.78% / 94.35%
||
7 Day CHG~0.00%
Published-08 Aug, 2017 | 15:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability in synotheme_upload.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to upload arbitrary files without authentication via the logo_upload action.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-287
Improper Authentication
CVE-2022-22687
Matching Score-8
Assigner-Synology Inc.
ShareView Details
Matching Score-8
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-5.34% / 89.87%
||
7 Day CHG~0.00%
Published-25 Mar, 2022 | 06:55
Updated-14 Jan, 2025 | 19:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-diskstation_managerdiskstation_manager_unified_controllerDiskStation Manager (DSM)
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2013-6987
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-27.73% / 96.34%
||
7 Day CHG~0.00%
Published-31 Dec, 2013 | 15:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager (DSM) before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the (1) path parameter to file_delete.cgi or (2) folder_path parameter to file_share.cgi in webapi/FileStation/; (3) dlink parameter to fbdownload/; or unspecified parameters to (4) html5_upload.cgi, (5) file_download.cgi, (6) file_sharing.cgi, (7) file_MVCP.cgi, or (8) file_rename.cgi in webapi/FileStation/.

Action-Not Available
Vendor-n/aSynology, Inc.
Product-diskstation_managern/a
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-29090
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-7.2||HIGH
EPSS-1.04% / 77.13%
||
7 Day CHG~0.00%
Published-02 Jun, 2021 | 02:00
Updated-17 Sep, 2024 | 03:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary SQL command via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-29089
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.82% / 74.03%
||
7 Day CHG~0.00%
Published-02 Jun, 2021 | 02:15
Updated-16 Sep, 2024 | 21:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-photo_stationSynology Photo Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-50631
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-7.5||HIGH
EPSS-0.47% / 64.01%
||
7 Day CHG~0.00%
Published-19 Mar, 2025 | 05:50
Updated-19 Mar, 2025 | 14:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-Synology Drive Server
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29239
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 48.34%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:28
Updated-04 Aug, 2025 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29235
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 47.91%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:26
Updated-04 Aug, 2025 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29232
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 47.91%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:24
Updated-04 Aug, 2025 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29236
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 48.34%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:27
Updated-04 Aug, 2025 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29234
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 47.91%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:26
Updated-04 Aug, 2025 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29233
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 47.91%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:25
Updated-04 Aug, 2025 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29230
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 48.34%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:22
Updated-04 Aug, 2025 | 19:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29238
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 47.91%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:28
Updated-04 Aug, 2025 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29227
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 47.91%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:08
Updated-04 Aug, 2025 | 19:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Stationsurveillance_station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-27660
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-9.6||CRITICAL
EPSS-2.20% / 84.12%
||
7 Day CHG~0.00%
Published-30 Nov, 2020 | 09:30
Updated-17 Sep, 2024 | 04:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain parameter.

Action-Not Available
Vendor-Synology, Inc.
Product-safeaccessSafe Access
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-27613
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-8.3||HIGH
EPSS-0.57% / 68.32%
||
7 Day CHG~0.00%
Published-28 Jul, 2022 | 06:35
Updated-17 Sep, 2024 | 01:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component in Synology CardDAV Server before 6.0.10-0153 allows remote authenticated users to inject SQL commands via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-carddav_serverCardDAV Server
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-29237
Matching Score-6
Assigner-Synology Inc.
ShareView Details
Matching Score-6
Assigner-Synology Inc.
CVSS Score-5.4||MEDIUM
EPSS-0.25% / 47.91%
||
7 Day CHG~0.00%
Published-28 Mar, 2024 | 06:27
Updated-04 Aug, 2025 | 19:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to read database containing non-sensitive information and conduct limited denial-of-service attacks via unspecified vectors.

Action-Not Available
Vendor-Synology, Inc.
Product-surveillance_stationdiskstation_managerSurveillance Station
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-24220
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.26% / 49.59%
||
7 Day CHG~0.00%
Published-01 Feb, 2022 | 18:36
Updated-03 Aug, 2024 | 04:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php.

Action-Not Available
Vendor-elitecmsn/a
Product-elite_cmsn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-45814
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.43% / 61.99%
||
7 Day CHG~0.00%
Published-28 Dec, 2021 | 15:11
Updated-04 Aug, 2024 | 04:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel with an administrative account.

Action-Not Available
Vendor-nettempn/a
Product-nntn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-45252
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.26% / 49.59%
||
7 Day CHG~0.00%
Published-21 Dec, 2021 | 11:04
Updated-04 Aug, 2024 | 04:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_topic.php, manage_user.php, and ajax.php. The attacker can be retrieving all information from the database of this system by using this vulnerability.

Action-Not Available
Vendor-n/aoretnom23
Product-simple_forum\/discussion_systemn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-45253
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.26% / 49.59%
||
7 Day CHG~0.00%
Published-21 Dec, 2021 | 11:23
Updated-04 Aug, 2024 | 04:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL sub-query that calls MySQL's load_file function with a UNC file path that references a URL on an external domain. The application interacted with that domain, indicating that the injected SQL query was executed.

Action-Not Available
Vendor-n/aoretnom23
Product-simple_cold_storage_managment_systemn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-45435
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.31% / 53.56%
||
7 Day CHG~0.00%
Published-28 Jan, 2022 | 14:05
Updated-04 Aug, 2024 | 04:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in login.php.

Action-Not Available
Vendor-n/aoretnom23
Product-simple_cold_storage_management_systemn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2022-24222
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.26% / 49.59%
||
7 Day CHG~0.00%
Published-01 Feb, 2022 | 18:36
Updated-03 Aug, 2024 | 04:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php.

Action-Not Available
Vendor-elitecmsn/a
Product-elite_cmsn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2006-0959
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-4.58% / 89.00%
||
7 Day CHG~0.00%
Published-02 Mar, 2006 | 23:00
Updated-03 Apr, 2025 | 01:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be affected.

Action-Not Available
Vendor-n/aMyBB
Product-mybulletinboardn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-7500
Matching Score-4
Assigner-Schneider Electric
ShareView Details
Matching Score-4
Assigner-Schneider Electric
CVSS Score-9.8||CRITICAL
EPSS-0.80% / 73.69%
||
7 Day CHG~0.00%
Published-16 Jun, 2020 | 19:21
Updated-04 Aug, 2024 | 09:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause arbitrary code to be executed when a malicious command is entered.

Action-Not Available
Vendor-n/a
Product-mtn6501-0001_firmwaremtn6260-0310_firmwaremtn6260-0315mtn6260-0415_firmwaremtn6260-0310mtn6501-0002mtn6260-0415mtn6501-0002_firmwaremtn6501-0001mtn6260-0315_firmwaremtn6260-0410mtn6260-0410_firmwareU.motion Servers and Touch Panels (affected versions listed in the security notification)
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-45334
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-9.8||CRITICAL
EPSS-0.24% / 47.25%
||
7 Day CHG~0.00%
Published-09 Jan, 2022 | 18:57
Updated-04 Aug, 2024 | 04:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Sourcecodester Online Thesis Archiving System 1.0 is vulnerable to SQL Injection. An attacker can bypass admin authentication and gain access to admin panel using SQL Injection

Action-Not Available
Vendor-online_thesis_archiving_system_projectn/a
Product-online_thesis_archiving_systemn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2006-1018
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-0.37% / 58.24%
||
7 Day CHG~0.00%
Published-07 Mar, 2006 | 00:00
Updated-03 Apr, 2025 | 01:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a diwan view action.

Action-Not Available
Vendor-dci-designsn/a
Product-dawaweenn/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2006-0961
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-7.5||HIGH
EPSS-2.55% / 85.20%
||
7 Day CHG~0.00%
Published-02 Mar, 2006 | 23:00
Updated-03 Apr, 2025 | 01:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

SQL injection vulnerability in yazdir.asp in Cilem Hiber 1.1 allows remote attackers to execute arbitrary SQL commands via the haber_id parameter. NOTE: this product has also been referred to as "Cilem News," although that does not appear to be the proper name.

Action-Not Available
Vendor-cilemn/a
Product-cilem_habern/a
CWE ID-CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • Previous
  • 1
  • 2
  • 3
  • ...
  • 146
  • 147
  • Next
Details not found