Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,916)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-30849 1Pimcore 1Pimcore Jun 17, 2026 Apr 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch o...Show more Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.Show less
CVE-2023-30848 1Pimcore 1Pimcore Jun 17, 2026 Apr 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as...Show more Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.Show less
CVE-2023-2348 1Oretnom23 1Service Provider Management System Jun 17, 2026 Apr 27, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of t...Show more A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227591.Show less
CVE-2023-2347 1Oretnom23 1Service Provider Management System Jun 17, 2026 Apr 27, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulati...Show more A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-227590 is the identifier assigned to this vulnerability.Show less
CVE-2023-2346 1Oretnom23 1Service Provider Management System Jun 17, 2026 Apr 27, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the...Show more A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227589 was assigned to this vulnerability.Show less
CVE-2023-2344 1Oretnom23 1Service Provider Management System Jun 17, 2026 Apr 27, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_servic...Show more A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Handler. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227587.Show less
CVE-2023-2338 1Pimcore 1Pimcore Jun 17, 2026 Apr 27, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
CVE-2023-30211 1Ourphp 1Ourphp Jun 17, 2026 Apr 26, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 OURPHP <= 7.2.0 is vulnerable to SQL Injection.
CVE-2023-30112 1Medicine Tracker System Project 1Medicine Tracker System Jun 17, 2026 Apr 26, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.
CVE-2023-27843 1Ask For A Quote Project 1Ask For A Quote Jun 17, 2026 Apr 26, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component.
CVE-2012-5872 1Arc2 Project 1Arc2 Feb 3, 2025 Apr 26, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SPARQL WHERE clause.
CVE-2023-30839 1Prestashop 1Prestashop Jun 17, 2026 Apr 25, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific ri...Show more PrestaShop is an Open Source e-commerce web application. Versions prior to 8.0.4 and 1.7.8.9 contain a SQL filtering vulnerability. A BO user can write, update, and delete in the database, even without having specific rights. PrestaShop 8.0.4 and 1.7.8.9 contain a patch for this issue. There are no known workarounds.Show less
CVE-2023-30545 1Prestashop 1Prestashop Jun 17, 2026 Apr 25, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the op...Show more PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function `LOAD_FILE` in a `SELECT` request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9 Show less
CVE-2023-0388 1Random Text Project 1Random Text Jun 17, 2026 Apr 24, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers.
CVE-2023-26865 1Brandsdistribution 1Bdroppy Jun 17, 2026 Apr 24, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCronModuleFrontController::importProducts component.
CVE-2023-29849 1Hockeycomputindo 1Bang Resto Jun 17, 2026 Apr 24, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter.
CVE-2023-23753 1Vi Solutions 1Visforms Jun 17, 2026 Apr 23, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delet...Show more The 'Visforms Base Package for Joomla 3' extension is vulnerable to SQL Injection as concatenation is used to construct an SQL Query. An attacker can interact with the database and could be able to read, modify and delete data on it.Show less
CVE-2023-2244 1Oretnom23 1Online Eyewear Shop Jun 17, 2026 Apr 22, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects an unknown part of the file /admin/orders/update_status.php of the component GET Parameter Handler. Th...Show more A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects an unknown part of the file /admin/orders/update_status.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-227229 was assigned to this vulnerability.Show less
CVE-2023-2243 1Complaint Management System Project 1Complaint Management System Jun 17, 2026 Apr 22, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file users/registration.php of the component POST Parame...Show more A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file users/registration.php of the component POST Parameter Handler. The manipulation of the argument fullname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-227228.Show less
CVE-2023-2242 1Oretnom23 1Online Computer And Laptop Store Jun 17, 2026 Apr 22, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component GET Parameter Handler. The man...Show more A vulnerability has been found in SourceCodester Online Computer and Laptop Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component GET Parameter Handler. The manipulation of the argument c/s leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-227227.Show less

Previous 1...571572573...1046 Next