Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,927)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-43381 1Tianchoy 1Blog Jun 17, 2026 Sep 27, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 SQL Injection vulnerability in Tianchoy Blog v.1.8.8 allows a remote attacker to obtain sensitive information via the id parameter in the login.php
CVE-2023-42461 1Glpi Project 1Glpi Jun 17, 2026 Sep 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field f...Show more GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.Show less
CVE-2023-41320 1Glpi Project 1Glpi Jun 17, 2026 Sep 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences managem...Show more GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL injection. This injection can be use to takeover an administrator account. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability.Show less
CVE-2023-40046 1Progress 1Ws Ftp Server Jun 17, 2026 Sep 27, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the d...Show more In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements. Show less
CVE-2023-39378 1Siberiancms 1Siberiancms Jun 17, 2026 Sep 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user
CVE-2023-35071 1Mrv 1Logging Administration Panel Jun 17, 2026 Sep 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection. This issue affects Logging Administration Panel: before 2...Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection. This issue affects Logging Administration Panel: before 20230915 .Show less
CVE-2023-43132 1Szvone 1Vmqphp Jun 17, 2026 Sep 25, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 szvone vmqphp <=1.13 is vulnerable to SQL Injection. Unauthorized remote users can use sql injection attacks to obtain the hash of the administrator password.
CVE-2023-39640 1Uplight 1Cookie Law Jun 17, 2026 Sep 25, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList().
CVE-2023-5153 1Dlink 1Dar 7000 Firmware Jun 17, 2026 Sep 25, 2023 N/A· v4 6.5 MEDIUM· v3 6.5 MEDIUM· v2 UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of the file /Tool/querysql.php. The manipulation leads to sql i...Show more UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, was found in D-Link DAR-8000 up to 20151231. This affects an unknown part of the file /Tool/querysql.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.Show less
CVE-2023-5152 1Dlink 1Dar 8000 Firmware Jun 17, 2026 Sep 25, 2023 N/A· v4 6.5 MEDIUM· v3 6.5 MEDIUM· v2 UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by this issue is some unknown functionality of the file /importex...Show more UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 and DAR-8000 up to 20151231. Affected by this issue is some unknown functionality of the file /importexport.php. The manipulation of the argument sql leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240248. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.Show less
CVE-2023-5151 1Dlink 1Dar 8000 Firmware Jun 17, 2026 Sep 25, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulatio...Show more UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. Affected by this vulnerability is an unknown functionality of the file /autheditpwd.php. The manipulation of the argument hid_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-240247. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.Show less
CVE-2023-43470 1Janobe 1Online Voting System Jun 17, 2026 Sep 23, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php component.
CVE-2023-43469 1Online Job Portal Project 1Online Job Portal Jun 17, 2026 Sep 23, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php component.
CVE-2023-43468 1Online Job Portal Project 1Online Job Portal Jun 17, 2026 Sep 23, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php component.
CVE-2023-40989 1Jeecg 1Jeecg Boot Jun 17, 2026 Sep 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
CVE-2023-43640 1Speciesfilegroup 1Taxonworks Jun 17, 2026 Sep 22, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbi...Show more TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database (including the users table). This issue may lead to information disclosure. Version 0.34.0 contains a fix for the issue. Show less
CVE-2023-43144 1Projectworlds 1Asset Management System Project In Php Jun 17, 2026 Sep 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php.
CVE-2023-31719 1Frangoteam 1Fuxa Jun 17, 2026 Sep 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
CVE-2023-31717 1Frangoteam 1Fuxa Jun 17, 2026 Sep 22, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.
CVE-2023-34576 2Opartfaq Project Store Opart 2Op'art Product Faq Opartfaq Jun 17, 2026 Sep 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via unspedified vector.

Previous 1...537538539...1047 Next