Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,958)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-50862 1Kashipara 1Travel Website Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not validate the characters received and they are sent unfiltere...Show more Travel Website v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'hotelIDHidden' parameter of the booking.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-50753 1Kashipara 1Online Notice Board System Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the user/update_profile.php resource does not validate the characters received and they are s...Show more Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the user/update_profile.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-50752 1Kashipara 1Online Notice Board System Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'e' parameter of the login.php resource does not validate the characters received and they are sent unfiltered...Show more Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'e' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-50743 1Kashipara 1Online Notice Board System Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the registration.php resource does not validate the characters received and they are sent unf...Show more Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the registration.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49666 1Kashipara 1Billing Software Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submit_material_list.php resource does not validate the characters received and they a...Show more Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'custmer_details' parameter of the submit_material_list.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49665 1Kashipara 1Billing Software Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'quantity[]' parameter of the submit_delivery_list.php resource does not validate the characters received and they are se...Show more Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'quantity[]' parameter of the submit_delivery_list.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49658 1Kashipara 1Billing Software Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bank_details' parameter of the party_submit.php resource does not validate the characters received and they are sent unf...Show more Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bank_details' parameter of the party_submit.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49639 1Kashipara 1Billing Software Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customer_details' parameter of the buyer_invoice_submit.php resource does not validate the characters received and they...Show more Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'customer_details' parameter of the buyer_invoice_submit.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49633 1Kashipara 1Billing Software Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyer_address' parameter of the buyer_detail_submit.php resource does not validate the characters received and they are...Show more Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'buyer_address' parameter of the buyer_detail_submit.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49625 1Kashipara 1Billing Software Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partylist_edit_submit.php resource does not validate the characters received and they are sent unfi...Show more Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partylist_edit_submit.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49624 1Kashipara 1Billing Software Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cancelid' parameter of the material_bill.php resource does not validate the characters received and they are sent unfilt...Show more Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cancelid' parameter of the material_bill.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49622 1Kashipara 1Billing Software Jun 17, 2026 Jan 4, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the material_bill.php?action=itemRelation resource does not validate the characters received an...Show more Billing Software v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'itemnameid' parameter of the material_bill.php?action=itemRelation resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-6981 1Veronalabs 1Wp Sms Jun 17, 2026 Jan 3, 2024 N/A· v4 4.9 MEDIUM· v3 N/A· v2 The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id' parameter in all versions up to, and including, 6.5 due to in...Show more The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to SQL Injection via the 'group_id' parameter in all versions up to, and including, 6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can leveraged to achieve Reflected Cross-site Scripting.Show less
CVE-2020-26625 1Gilacms 1Gila Cms Jul 9, 2026 Jan 2, 2024 N/A· v4 3.8 LOW· v3 N/A· v2 A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the 'user_id' parameter after the login portal.
CVE-2020-26624 1Gilacms 1Gila Cms Jul 9, 2026 Jan 2, 2024 N/A· v4 3.8 LOW· v3 N/A· v2 A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts via the ID parameter after the login portal.
CVE-2020-26623 1Gilacms 1Gila Cms Jul 9, 2026 Jan 2, 2024 N/A· v4 3.8 LOW· v3 N/A· v2 SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Area parameter under the Administration>Widget tab after the login portal.
CVE-2023-6436 1Ekolbilisim 1Web Sablonu Yazilimi Jun 17, 2026 Jan 2, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ekol Informatics Website Template allows SQL Injection. This issue affects Website Template: through 20231215.
CVE-2024-0182 1Janobe 1Engineers Online Portal Jun 17, 2026 Jan 1, 2024 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ of the component Admin Login. The manipulation...Show more A vulnerability was found in SourceCodester Engineers Online Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-249440.Show less
CVE-2023-52133 1Whiletrue 1Most And Least Read Posts Widget Jun 17, 2026 Dec 31, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.1...Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WhileTrue Most And Least Read Posts Widget.This issue affects Most And Least Read Posts Widget: from n/a through 2.5.16.Show less
CVE-2023-52132 1Wpadminify 1Wp Adminify Jun 17, 2026 Dec 31, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jewel Theme WP Adminify.This issue affects WP Adminify: from n/a through 3.1.6.

Previous 1...508509510...1048 Next