← Back
CWE-89

20,924 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,924)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-32308
1Anuko
1Time Tracker
Jun 17, 2026
May 15, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding err...Show more
anuko timetracker is an open source time tracking system. Boolean-based blind SQL injection vulnerability existed in Time Tracker invoices.php in versions prior to 1.22.11.5781. This was happening because of a coding error after validating parameters in POST requests. There was no check for errors before adjusting invoice sorting order. Because of this, it was possible to craft a POST request with malicious SQL for Time Tracker database. This issue has been fixed in version 1.22.11.5781. Users are advised to upgrade. Users unable to upgrade may insert an additional check for errors in a condition before calling `ttGroupHelper::getActiveInvoices()` in invoices.php.Show less
CVE-2023-30245
1Judging Management System Project
1Judging Management System
Jun 17, 2026
May 15, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the crit_id parameter of the edit_criteria.php file.
CVE-2023-31631
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the sqlo_preds_contradiction component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31630
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the sqlo_query_spec component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31629
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the sqlo_union_scope component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31628
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the stricmp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31627
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the strhash component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31626
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the gpf_notice component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31625
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the psiginfo component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31624
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the sinv_check_exp component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31623
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the mp_box_copy component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31622
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the sqlc_make_policy_trig component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31621
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the kc_var_col component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31620
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the dv_compare component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31619
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the sch_name_to_object component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31618
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the sqlc_union_dt_wrap component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31617
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the dk_set_delete component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31616
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the bif_mod component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31615
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the chash_array component of openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2023-31614
1Openlinksw
1Virtuoso
Jun 17, 2026
May 15, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in the mp_box_deserialize_string function in openlink virtuoso-opensource v7.2.9 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.