Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,895)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-28663 1Formidablepro2pdf 1Formidable Pro2pdf Jun 17, 2026 Mar 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ parameter in the fpropdf_export_file action.
CVE-2023-28662 1Codemenschen 1Gift Vouchers Jun 17, 2026 Mar 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action.
CVE-2023-28661 1Accesspressthemes 1Wp Popup Banners Jun 17, 2026 Mar 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_data action.
CVE-2023-28660 1E Dynamics 1Events Made Easy Jun 17, 2026 Mar 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' parameter in the eme_recurrences_list action.
CVE-2023-28659 1Plugin 1Waiting Jun 17, 2026 Mar 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc_down[meta][id] parameter of the pbc_save_downs action.
CVE-2023-28438 1Pimcore 1Pimcore Jun 17, 2026 Mar 22, 2023 N/A· v4 8.0 HIGH· v3 N/A· v2 Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using th...Show more Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.Show less
CVE-2023-1578 1Pimcore 1Pimcore Jun 17, 2026 Mar 22, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
CVE-2023-1571 1Datagear 1Datagear Jun 17, 2026 Mar 22, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0. This affects an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the argument queryOrder leads to sql in...Show more A vulnerability, which was classified as critical, was found in DataGear up to 4.5.0. This affects an unknown part of the file /analysisProject/pagingQueryData. The manipulation of the argument queryOrder leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.5.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223563.Show less
CVE-2023-1566 1Medical Certificate Generator App Project 1Medical Certificate Generator App Jun 17, 2026 Mar 22, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument id lea...Show more A vulnerability was found in SourceCodester Medical Certificate Generator App 1.0. It has been declared as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-223558 is the identifier assigned to this vulnerability.Show less
CVE-2023-27638 1Tshirtecommerce 1Custom Product Designer Jun 17, 2026 Mar 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to explo...Show more An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised tshirtecommerce_design_cart_id GET parameter in order to exploit an insecure parameter in the functions hookActionCartSave and updateCustomizationTable, which could lead to a SQL injection. This is exploited in the wild in March 2023.Show less
CVE-2023-27637 1Tshirtecommerce 1Custom Product Designer Jun 17, 2026 Mar 22, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure param...Show more An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. An HTTP request can be forged with a compromised product_id GET parameter in order to exploit an insecure parameter in the front controller file designer.php, which could lead to a SQL injection. This is exploited in the wild in March 2023.Show less
CVE-2023-1564 1Air Cargo Management System Project 1Air Cargo Management System Jun 17, 2026 Mar 22, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/transactions/update_status.php of the compone...Show more A vulnerability was found in SourceCodester Air Cargo Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/transactions/update_status.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223556.Show less
CVE-2023-1563 1Oretnom23 1Student Study Center Desk Management System Jun 17, 2026 Mar 22, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/assign/assign.php...Show more A vulnerability has been found in SourceCodester Student Study Center Desk Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/assign/assign.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223555.Show less
CVE-2023-1556 1Judging Management System Project 1Judging Management System Jun 17, 2026 Mar 22, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file summary_results.php. The manipulation of...Show more A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file summary_results.php. The manipulation of the argument main_event_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223549 was assigned to this vulnerability.Show less
CVE-2023-25684 1Ibm 1Security Key Lifecycle Manager Jun 17, 2026 Mar 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modi...Show more IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 247597.Show less
CVE-2023-27570 1Prestashop 1Eo Tags Jun 17, 2026 Mar 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie.
CVE-2023-27569 1Prestashop 1Eo Tags Jun 17, 2026 Mar 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.
CVE-2023-27871 1Ibm 1Aspera Faspex Jun 17, 2026 Mar 21, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613.
CVE-2023-1153 1Pacsrapor 1Pacsrapor Jun 17, 2026 Mar 21, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pacsrapor allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Pacsrapor: before 1....Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pacsrapor allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Pacsrapor: before 1.22.Show less
CVE-2023-1545 1Teampass 1Teampass Jun 17, 2026 Mar 21, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.

Previous 1...581582583...1045 Next