Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,927)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-43909 1Hospital Management System Project 1Hospital Management System Jun 17, 2026 Sep 29, 2023 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsearch.php.
CVE-2023-5261 1Tongda2000 1Tongda Office Anywhere Jun 17, 2026 Sep 29, 2023 N/A· v4 9.8 CRITICAL· v3 5.2 MEDIUM· v2 A vulnerability, which was classified as critical, was found in Tongda OA 2017. Affected is an unknown function of the file general/hr/manage/staff_title_evaluation/delete.php. The manipulation of the argument EVALUATION...Show more A vulnerability, which was classified as critical, was found in Tongda OA 2017. Affected is an unknown function of the file general/hr/manage/staff_title_evaluation/delete.php. The manipulation of the argument EVALUATION_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-240870 is the identifier assigned to this vulnerability.Show less
CVE-2023-5260 1Razormist 1Simple Membership System Jun 17, 2026 Sep 29, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in SourceCodester Simple Membership System 1.0. This issue affects some unknown processing of the file group_validator.php. The manipulation of the argume...Show more A vulnerability, which was classified as critical, has been found in SourceCodester Simple Membership System 1.0. This issue affects some unknown processing of the file group_validator.php. The manipulation of the argument club_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240869 was assigned to this vulnerability.Show less
CVE-2023-5258 1Openrapid 1Rapidcms Jun 17, 2026 Sep 29, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipulation of the argument id leads to sql injection. It is possibl...Show more A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /resource/addgood.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240867.Show less
CVE-2023-44166 1Projectworlds 1Online Movie Ticket Booking System Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The 'age' parameter of the process_registration.php resource does not validate the characters received and they are sent unfiltered to the database.
CVE-2023-44164 1Projectworlds 1Online Movie Ticket Booking System Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The 'Email' parameter of the process_login.php resource does not validate the characters received and they are sent unfiltered to the database.
CVE-2023-44163 1Projectworlds 1Online Movie Ticket Booking System Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The 'search' parameter of the process_search.php resource does not validate the characters received and they are sent unfiltered to the database.
CVE-2023-43739 1Online Book Store Project Project 1Online Book Store Project Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The 'bookisbn' parameter of the cart.php resource does not validate the characters received and they are sent unfiltered to the database.
CVE-2023-43014 1Projectworlds 1Asset Management System Jun 17, 2026 Sep 28, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'first_name' and 'last_name' parameters of user.php page, allowing an authenticated attacker to dump all the contents...Show more Asset Management System v1.0 is vulnerable to an Authenticated SQL Injection vulnerability on the 'first_name' and 'last_name' parameters of user.php page, allowing an authenticated attacker to dump all the contents of the database contents. Show less
CVE-2023-5053 1Projectworlds 1Hospital Management System In Php Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.
CVE-2023-5004 1Projectworlds 1Hospital Management System In Php Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.
CVE-2023-43013 1Projectworlds 1Asset Management System Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents...Show more Asset Management System v1.0 is vulnerable to an unauthenticated SQL Injection vulnerability on the 'email' parameter of index.php page, allowing an external attacker to dump all the contents of the database contents and bypass the login control. Show less
CVE-2023-30415 1Oretnom23 1Packers And Movers Management System Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /inquiries/view_inquiry.php.
CVE-2023-38870 1Economizzer 1Economizzer Jun 17, 2026 Sep 28, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQ...Show more A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1. The cash book has a feature to list accomplishments by category, and the 'category_id' parameter is vulnerable to SQL Injection.Show less
CVE-2023-43192 1Jrecms 1Springbootcms Jun 17, 2026 Sep 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL...Show more SQL injection can exist in a newly created part of the SpringbootCMS 1.0 background, and the parameters submitted by users are not filtered. As a result, special characters in parameters destroy the original logic of SQL statements. Attackers can use this vulnerability to execute any SQL statement.Show less
CVE-2023-44047 1Oretnom23 1Toll Tax Management System Jun 17, 2026 Sep 27, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 Sourcecodester Toll Tax Management System v1 is vulnerable to SQL Injection.
CVE-2023-4737 1Hedeftakip 1Admin Portal Jun 17, 2026 Sep 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2.
CVE-2023-44044 1Superstorefinder 1Super Store Finder Jun 17, 2026 Sep 27, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php.
CVE-2023-43610 1Welcart 1Welcart E Commerce Jun 17, 2026 Sep 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting authority) or higher privilege to perform unintended database operations.
CVE-2023-43493 1Welcart 1Welcart E Commerce Jun 17, 2026 Sep 27, 2023 N/A· v4 4.9 MEDIUM· v3 N/A· v2 SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain sensitive information.

Previous 1...536537538...1047 Next