Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (19,371)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-36368 1Ibm 2Sterling B2b Integrator Sterling File Gateway Mar 20, 2026 Mar 13, 2026 N/A· v4 7.2 HIGH· v3 N/A· v2 IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially c...Show more IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.Show less
CVE-2026-32137 1Dataease 1Dataease Mar 13, 2026 Mar 12, 2026 9.3 CRITICAL· v4 8.8 HIGH· v3 N/A· v2 Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterizat...Show more Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.Show less
CVE-2026-26794 1Gl Inet 1Ar300m16 Firmware Mar 16, 2026 Mar 12, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP reques...Show more GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request.Show less
CVE-2026-21708 1Veeam 1Veeam Backup & Replication Jun 5, 2026 Mar 12, 2026 N/A· v4 9.9 CRITICAL· v3 N/A· v2 A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.
CVE-2019-25543 1Netartmedia 1Real Estate Portal Mar 17, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia Real Estate Portal 5.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the page parameter. Attackers can submit POST...Show more Netartmedia Real Estate Portal 5.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the page parameter. Attackers can submit POST requests to index.php with malicious SQL payloads in the page field to bypass authentication, extract sensitive data, or modify database contents.Show less
CVE-2019-25542 1Netartmedia 1Real Estate Portal Mar 17, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia Real Estate Portal 5.0 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user_email parameter. Attackers can send PO...Show more Netartmedia Real Estate Portal 5.0 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user_email parameter. Attackers can send POST requests to index.php with malicious payloads in the user_email field to bypass authentication, extract sensitive data, or modify database contents.Show less
CVE-2019-25541 1Netartmedia 1Php Mall Mar 23, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through unvalidated parameters. Attackers can inject time-based blind SQL paylo...Show more Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through unvalidated parameters. Attackers can inject time-based blind SQL payloads via the 'id' parameter in index.php or the 'Email' parameter in loginaction.php to extract sensitive database information.Show less
CVE-2019-25540 1Netartmedia 1Php Mall Mar 23, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various parameters. Attackers can craft malicious...Show more Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various parameters. Attackers can craft malicious requests with SQL payloads to extract sensitive database information including user credentials and system data.Show less
CVE-2019-25539 1Konradpl99 1202cms Mar 16, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 202CMS v10 beta contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send POST requests to...Show more 202CMS v10 beta contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send POST requests to index.php with crafted SQL payloads using time-based blind injection techniques to extract sensitive database information.Show less
CVE-2019-25538 1Konradpl99 1202cms Mar 16, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 202CMS v10 beta contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send crafted requests with...Show more 202CMS v10 beta contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the log_user parameter. Attackers can send crafted requests with malicious SQL statements in the log_user field to extract sensitive database information or modify database contents.Show less
CVE-2019-25537 - - Apr 15, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can s...Show more Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with malicious SQL payloads in the Email field to extract sensitive database information.Show less
CVE-2019-25536 1Netartmedia 1Real Estate Portal Apr 7, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attacker...Show more Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can send POST requests to index.php with crafted SQL payloads in the features[] parameter to extract sensitive database information or manipulate database queries.Show less
CVE-2019-25535 - - Apr 15, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia PHP Dating Site contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests...Show more Netartmedia PHP Dating Site contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with time-based SQL injection payloads in the Email field to extract sensitive database information.Show less
CVE-2019-25534 - - Apr 15, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia PHP Car Dealer contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can submit...Show more Netartmedia PHP Car Dealer contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the features[] parameter. Attackers can submit POST requests to index.php with crafted SQL payloads in the features[] parameter to extract sensitive database information or manipulate database queries.Show less
CVE-2019-25533 - - Apr 15, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia PHP Business Directory 4.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send PO...Show more Netartmedia PHP Business Directory 4.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to the loginaction.php endpoint with crafted SQL payloads in the Email field to extract sensitive database information or bypass authentication.Show less
CVE-2019-25532 - - Apr 15, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia Jobs Portal 6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests...Show more Netartmedia Jobs Portal 6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the Email parameter. Attackers can send POST requests to loginaction.php with crafted SQL payloads in the Email field to extract sensitive database information or bypass authentication.Show less
CVE-2019-25531 - - Apr 15, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 Netartmedia Deals Portal contains an SQL injection vulnerability in the Email parameter of loginaction.php that allows unauthenticated attackers to manipulate database queries. Attackers can submit crafted SQL payloads t...Show more Netartmedia Deals Portal contains an SQL injection vulnerability in the Email parameter of loginaction.php that allows unauthenticated attackers to manipulate database queries. Attackers can submit crafted SQL payloads through POST requests to extract sensitive information or bypass authentication mechanisms.Show less
CVE-2019-25530 - - Apr 15, 2026 Mar 12, 2026 8.8 HIGH· v4 8.2 HIGH· v3 N/A· v2 uHotelBooking System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the system_page GET parameter. Attackers can send crafted re...Show more uHotelBooking System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the system_page GET parameter. Attackers can send crafted requests to index.php with malicious system_page values using time-based blind SQL injection techniques to extract sensitive database information.Show less
CVE-2019-25529 - - Apr 15, 2026 Mar 12, 2026 7.1 HIGH· v4 7.1 HIGH· v3 N/A· v2 Placeto CMS Alpha rv.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'page' parameter. Attackers can send GET requests to the...Show more Placeto CMS Alpha rv.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'page' parameter. Attackers can send GET requests to the admin/edit.php endpoint with malicious 'page' values using boolean-based blind, time-based blind, or union-based techniques to extract sensitive database information.Show less
CVE-2019-25528 1Inoutscripts 1Inout Homestay Mar 19, 2026 Mar 12, 2026 8.8 HIGH· v4 9.1 CRITICAL· v3 N/A· v2 Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the property1 parameter. Attackers can send...Show more Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the property1 parameter. Attackers can send POST requests to the search/searchdetailed endpoint with malicious SQL payloads to extract sensitive data or modify database contents.Show less

Previous 1...585960...969 Next