Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,925)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-2832 1Bumsys Project 1Bumsys Jun 17, 2026 May 22, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 SQL Injection in GitHub repository unilogies/bumsys prior to 2.2.0.
CVE-2023-2823 1Class Scheduling System Project 1Class Scheduling System Jun 17, 2026 May 20, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Class Scheduling System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit_subject.php of the component G...Show more A vulnerability was found in SourceCodester Class Scheduling System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit_subject.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229597 was assigned to this vulnerability.Show less
CVE-2023-2815 1Online Jewelry Store Project 1Online Jewelry Store Jun 17, 2026 May 19, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability classified as critical was found in SourceCodester Online Jewelry Store 1.0. Affected by this vulnerability is an unknown functionality of the file supplier.php of the component POST Parameter Handler. Th...Show more A vulnerability classified as critical was found in SourceCodester Online Jewelry Store 1.0. Affected by this vulnerability is an unknown functionality of the file supplier.php of the component POST Parameter Handler. The manipulation of the argument suppid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229429 was assigned to this vulnerability.Show less
CVE-2022-47984 1Ibm 1Infosphere Information Server Jun 17, 2026 May 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-...Show more IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 243163.Show less
CVE-2023-31707 1Sem Cms 1Semcms Jun 17, 2026 May 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php.
CVE-2023-20110 1Cisco 1Smart Software Manager On Prem Jun 17, 2026 May 18, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulne...Show more A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read sensitive data on the underlying database.Show less
CVE-2023-29985 1Oretnom23 1Student Study Center Desk Management System Jun 17, 2026 May 18, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Sourcecodester Student Study Center Desk Management System v1.0 admin\reports\index.php#date_from has a SQL Injection vulnerability.
CVE-2023-30191 1Cdesigner Project 1Cdesigner Jun 17, 2026 May 17, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitementModuleFrontController::initContent().
CVE-2023-2775 1Bus Dispatch And Information System Project 1Bus Dispatch And Information System Jun 17, 2026 May 17, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability was found in code-projects Bus Dispatch and Information System 1.0. It has been classified as critical. This affects an unknown part of the file adminHome.php. The manipulation of the argument reach_city...Show more A vulnerability was found in code-projects Bus Dispatch and Information System 1.0. It has been classified as critical. This affects an unknown part of the file adminHome.php. The manipulation of the argument reach_city leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229281 was assigned to this vulnerability.Show less
CVE-2023-2774 1Bus Dispatch And Information System Project 1Bus Dispatch And Information System Jun 17, 2026 May 17, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file view_branch.php. The manipulation of the arg...Show more A vulnerability was found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file view_branch.php. The manipulation of the argument branchid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229280.Show less
CVE-2023-27233 1Piwigo 1Piwigo Jun 17, 2026 May 17, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Piwigo before 13.6.0 was discovered to contain a SQL injection vulnerability via the order[0][dir] parameter at user_list_backend.php.
CVE-2023-2773 1Bus Dispatch And Information System Project 1Bus Dispatch And Information System Jun 17, 2026 May 17, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability has been found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file view_admin.php. The manipulation...Show more A vulnerability has been found in code-projects Bus Dispatch and Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file view_admin.php. The manipulation of the argument adminid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229279.Show less
CVE-2023-2772 1Oretnom23 1Budget And Expense Tracker System Jun 17, 2026 May 17, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the file /admin/budget/manage_budget.php of the component GET Param...Show more A vulnerability, which was classified as critical, was found in SourceCodester Budget and Expense Tracker System 1.0. Affected is an unknown function of the file /admin/budget/manage_budget.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-229278 is the identifier assigned to this vulnerability.Show less
CVE-2023-2771 1Online Exam System Project 1Online Exam System Jun 17, 2026 May 17, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in SourceCodester Online Exam System 1.0. This issue affects some unknown processing of the file /jurusanmatkul/data. The manipulation of the argument col...Show more A vulnerability, which was classified as critical, has been found in SourceCodester Online Exam System 1.0. This issue affects some unknown processing of the file /jurusanmatkul/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-229277 was assigned to this vulnerability.Show less
CVE-2023-2770 1Online Exam System Project 1Online Exam System Jun 17, 2026 May 17, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability classified as critical was found in SourceCodester Online Exam System 1.0. This vulnerability affects unknown code of the file /kelasdosen/data. The manipulation of the argument columns[1][data] leads to...Show more A vulnerability classified as critical was found in SourceCodester Online Exam System 1.0. This vulnerability affects unknown code of the file /kelasdosen/data. The manipulation of the argument columns[1][data] leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-229276.Show less
CVE-2023-2769 1Oretnom23 1Service Provider Management System Jun 17, 2026 May 17, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /classes/Master.php?f=delete_service. The manipulation of the argum...Show more A vulnerability classified as critical has been found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file /classes/Master.php?f=delete_service. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-229275.Show less
CVE-2023-31702 1Escanav 1Escan Management Console Jun 17, 2026 May 17, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server v...Show more SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.Show less
CVE-2023-2756 1Pimcore 1Customer Management Framework Jun 17, 2026 May 17, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
CVE-2023-30189 1Posthemes 1Posstaticblocks Jun 17, 2026 May 16, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Prestashop posstaticblocks <= 1.0.0 is vulnerable to SQL Injection via posstaticblocks::getPosCurrentHook().
CVE-2023-27742 1Idurarapp 1Idurar Jun 17, 2026 May 16, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 IDURAR ERP/CRM v1 was discovered to contain a SQL injection vulnerability via the component /api/login.

Previous 1...565566567...1047 Next