Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,958)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-6063 1Wpfastestcache 1Wp Fastest Cache Jun 17, 2026 Dec 4, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
CVE-2023-5108 1Alphabpo 1Easy Newsletter Signups Jun 17, 2026 Dec 4, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admi...Show more The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as adminShow less
CVE-2023-48863 1Sem Cms 1Semcms Jun 17, 2026 Dec 4, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engi...Show more SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements to the interpreter. These malicious data can deceive the interpreter, so as to execute unplanned commands or unauthorized access to data.Show less
CVE-2020-36768 1Reiner Lemoine Institut 1Nesp2 Jun 17, 2026 Dec 3, 2023 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability was found in rl-institut NESP2 Initial Release/1.0. It has been classified as critical. Affected is an unknown function of the file app/database.py. The manipulation leads to sql injection. It is possible...Show more A vulnerability was found in rl-institut NESP2 Initial Release/1.0. It has been classified as critical. Affected is an unknown function of the file app/database.py. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 07c0cdf36cf6a4345086d07b54423723a496af5e. It is recommended to apply a patch to fix this issue. VDB-246642 is the identifier assigned to this vulnerability.Show less
CVE-2023-6464 1Remyandrade 1User Registration And Login System Jun 17, 2026 Dec 2, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/add-user.php. The manipulation of...Show more A vulnerability was found in SourceCodester User Registration and Login System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /endpoint/add-user.php. The manipulation of the argument user leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-246614 is the identifier assigned to this vulnerability.Show less
CVE-2023-48893 1Slims 1Senayan Library Management System Bulian Jun 17, 2026 Dec 1, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate.
CVE-2023-48813 1Slims 1Senayan Library Management System Bulian Jun 17, 2026 Dec 1, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php.
CVE-2023-49371 1Ruoyi 1Ruoyi Jun 17, 2026 Dec 1, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.
CVE-2023-5634 1Arslansoft Education Portal Project 1Arslansoft Education Portal Jun 17, 2026 Dec 1, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL Injection. This issue affects Education Portal: before v1.1.
CVE-2023-48016 1Phpgurukul 1Restaurant Table Booking System Jun 17, 2026 Dec 1, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter.
CVE-2023-46956 1Oretnom23 1Packers And Movers Management System Jun 17, 2026 Nov 30, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/admin/?page=user/manage_user&id file.
CVE-2023-6360 1Joedolson 1My Calendar Jun 17, 2026 Nov 30, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.
CVE-2023-6402 1Phpgurukul 1Nipah Virus Testing Management System Jun 17, 2026 Nov 30, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file add-phlebotomist.php. The manipulation of the argument empid...Show more A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file add-phlebotomist.php. The manipulation of the argument empid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-246423.Show less
CVE-2023-6418 1Aatifaneeq 1Voovi Jun 17, 2026 Nov 30, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via videos.php in the id parameter. Exploitation of this vulnerability could allow a remote att...Show more A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via videos.php in the id parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.Show less
CVE-2023-6417 1Aatifaneeq 1Voovi Jun 17, 2026 Nov 30, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via update.php in the id parameter. Exploitation of this vulnerability could allow a remote att...Show more A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via update.php in the id parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.Show less
CVE-2023-6416 1Aatifaneeq 1Voovi Jun 17, 2026 Nov 30, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd parameter. Exploitation of this vulnerability could allow a rem...Show more A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.Show less
CVE-2023-6415 1Aatifaneeq 1Voovi Jun 17, 2026 Nov 30, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signin.php in the user parameter. Exploitation of this vulnerability could allow a remote a...Show more A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signin.php in the user parameter. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.Show less
CVE-2023-6414 1Aatifaneeq 1Voovi Jun 17, 2026 Nov 30, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via perfil.php in the id and user parameters. Exploitation of this vulnerability could allow a...Show more A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via perfil.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.Show less
CVE-2023-6413 1Aatifaneeq 1Voovi Jun 17, 2026 Nov 30, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user parameters. Exploitation of this vulnerability could allow a...Show more A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.Show less
CVE-2023-6412 1Aatifaneeq 1Voovi Jun 17, 2026 Nov 30, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote a...Show more A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the application.Show less

Previous 1...520521522...1048 Next