Microsoft SQL Server vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
107 matching records
- Medium6.0Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects corteza: 2024.9.8.Check if you run itEPSS 0.28%May 11, 2026
- High8.8Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.71%Apr 14, 2026
- High7.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.25%Apr 14, 2026
- High7.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.30%Apr 14, 2026
- Medium6.9SQL Server Password Changer 1.90 contains a buffer overflow vulnerability that allows local attackers to crash the application by supplying an oversized payload.Check if you run itEPSS 0.13%Mar 11, 2026
- High8.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 1.24%Mar 10, 2026
- High8.8Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 1.14%Mar 10, 2026
- High8.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.Patch nowKEVEPSS 2.13%Mar 10, 2026
- High8.7NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database.Check if you run itEPSS 0.45%Dec 2, 2025
- High8.7NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database.Check if you run itEPSS 0.34%Dec 2, 2025
- High8.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 1.18%Nov 11, 2025
- High8.8Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 1.42%Sep 9, 2025
- Medium6.5Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.Check if you run itEPSS 0.87%Sep 9, 2025
- High8.8Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 1.59%Aug 12, 2025
- High8.8Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 1.76%Aug 12, 2025
- High7.5Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 3.90%Jul 8, 2025
- High7.8CVE-2023-36785 is listed by Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability.Check if you run itEPSS 0.89%Oct 10, 2023
- High7.8CVE-2023-36730 is listed by Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability.Check if you run itEPSS 0.87%Oct 10, 2023
- Medium5.5Microsoft SQL Server Denial of Service VulnerabilityCheck if you run itEPSS 0.72%Oct 10, 2023
- High7.8CVE-2023-36420 is listed by Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability.Check if you run itEPSS 0.83%Oct 10, 2023
- High7.8CVE-2023-36417 is listed by Microsoft SQL OLE DB Remote Code Execution Vulnerability.Check if you run itEPSS 0.83%Oct 10, 2023
- High8.8CVE-2023-38169 is listed by Microsoft SQL OLE DB Remote Code Execution Vulnerability.Check if you run itEPSS 1.32%Aug 8, 2023
- High7.8CVE-2023-32028 is listed by Microsoft SQL OLE DB Remote Code Execution Vulnerability.Check if you run itEPSS 0.72%Jun 16, 2023
- High7.8CVE-2023-32027 is listed by Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability.Check if you run itEPSS 0.60%Jun 16, 2023
- High7.8CVE-2023-32026 is listed by Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability.Check if you run itEPSS 0.72%Jun 16, 2023