Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,960)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-5674 1Wpvibes 1Wp Mail Log Jun 17, 2026 Dec 26, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
CVE-2023-5645 1Wpvibes 1Wp Mail Log Jun 17, 2026 Dec 26, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
CVE-2023-5203 1Swit 1Wp Sessions Time Monitoring Full Automatic Jun 17, 2026 Dec 26, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitiv...Show more The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.Show less
CVE-2023-7111 1Fabian 1Library Management System Jun 17, 2026 Dec 26, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index.php. The manipulation of the argument category leads to sql i...Show more A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249006 is the identifier assigned to this vulnerability.Show less
CVE-2023-49954 13cx 13cx Jun 17, 2026 Dec 25, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.
CVE-2022-39822 1Nokia 1Network Functions Manager For Transport Jun 17, 2026 Dec 25, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation.
CVE-2023-7100 1Phpgurukul 1Restaurant Table Booking System Jun 17, 2026 Dec 25, 2023 5.3 MEDIUM· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argum...Show more A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate/tdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2023-7099 1Phpgurukul 1Nipah Virus Testing Management System Jun 17, 2026 Dec 25, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulatio...Show more A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248951.Show less
CVE-2023-7097 1Fabian 1Water Billing System Jun 17, 2026 Dec 25, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. I...Show more A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability.Show less
CVE-2023-7096 1Carmelogarcia 1Faculty Management System Jun 17, 2026 Dec 25, 2023 2.0 LOW· v4 9.8 CRITICAL· v3 5.8 MEDIUM· v2 A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injectio...Show more A flaw has been found in code-projects Faculty Management System 1.0. The affected element is an unknown function of the file /admin/php/crud.php. This manipulation of the argument fieldname/tablename causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.Show less
CVE-2023-51448 1Cacti 1Cacti Jun 17, 2026 Dec 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authe...Show more Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `‘managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `‘/cacti/managers.php’` with an SQLi payload in the `‘selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.Show less
CVE-2023-49085 1Cacti 1Cacti Jun 17, 2026 Dec 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to exec...Show more Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability - arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.Show less
CVE-2022-47532 1Filerun 1Filerun Jun 17, 2026 Dec 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.
CVE-2023-49689 1Kashipara 1Job Portal Jun 17, 2026 Dec 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered...Show more Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'JobId' parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49688 1Kashipara 1Job Portal Jun 17, 2026 Dec 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the dat...Show more Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txtUser' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49681 1Kashipara 1Job Portal Jun 17, 2026 Dec 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertWalkin.php resource does not validate the characters received and they are sent unfil...Show more Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertWalkin.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-49677 1Kashipara 1Job Portal Jun 17, 2026 Dec 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertJob.php resource does not validate the characters received and they are sent unfilter...Show more Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'cmbQual' parameter of the Employer/InsertJob.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-48722 1Phpgurukul 1Student Result Management System Jun 17, 2026 Dec 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_results.php resource does not validate the characters received and they...Show more Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_results.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-48720 1Phpgurukul 1Student Result Management System Jun 17, 2026 Dec 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the login.php resource does not validate the characters received and they are sen...Show more Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database. Show less
CVE-2023-48718 1Phpgurukul 1Student Result Management System Jun 17, 2026 Dec 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_students.php resource does not validate the characters received and the...Show more Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_students.php resource does not validate the characters received and they are sent unfiltered to the database. Show less

Previous 1...513514515...1048 Next