Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,889)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2023-1293 1Online Graduate Tracer System Project 1Online Graduate Tracer System Jun 17, 2026 Mar 9, 2023 N/A· v4 8.1 HIGH· v3 4.6 MEDIUM· v2 A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects the function mysqli_query of the file admin_cs.php. The manipulation leads to sql injection. Th...Show more A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects the function mysqli_query of the file admin_cs.php. The manipulation leads to sql injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222647.Show less
CVE-2023-1292 1Sales Tracker Management System Project 1Sales Tracker Management System Jun 17, 2026 Mar 9, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability has been found in SourceCodester Sales Tracker Management System 1.0 and classified as critical. This vulnerability affects the function delete_client of the file classes/Master.php. The manipulation of t...Show more A vulnerability has been found in SourceCodester Sales Tracker Management System 1.0 and classified as critical. This vulnerability affects the function delete_client of the file classes/Master.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222646 is the identifier assigned to this vulnerability.Show less
CVE-2023-1291 1Sales Tracker Management System Project 1Sales Tracker Management System Jun 17, 2026 Mar 9, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/clients/manage_client.php. The manipulation of the argume...Show more A vulnerability, which was classified as critical, was found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/clients/manage_client.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222645 was assigned to this vulnerability.Show less
CVE-2023-1290 1Sales Tracker Management System Project 1Sales Tracker Management System Jun 17, 2026 Mar 9, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in SourceCodester Sales Tracker Management System 1.0. Affected by this issue is some unknown functionality of the file admin/clients/view_client.php. The...Show more A vulnerability, which was classified as critical, has been found in SourceCodester Sales Tracker Management System 1.0. Affected by this issue is some unknown functionality of the file admin/clients/view_client.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222644.Show less
CVE-2023-1251 1Akinsoft 1Wolvox Jun 17, 2026 Mar 9, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Akinsoft Wolvox. This issue affects Wolvox: before 8.02.03.
CVE-2023-24777 1Funadmin 1Funadmin Jun 17, 2026 Mar 8, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.
CVE-2023-24782 1Funadmin 1Funadmin Jun 17, 2026 Mar 8, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.
CVE-2023-1276 1Sul1ss Shop Project 1Sul1ss Shop Jun 17, 2026 Mar 8, 2023 N/A· v4 7.2 HIGH· v3 5.8 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword le...Show more A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file application\merch\controller\Order.php. The manipulation of the argument keyword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-222599.Show less
CVE-2023-26922 1Variscite 1Matrix Gui Jun 17, 2026 Mar 8, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell_exect parameter to the \www\pages\matrix-gui-2.0 endpoint.
CVE-2023-24773 1Funadmin 1Funadmin Jun 17, 2026 Mar 8, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.
CVE-2023-1267 1Pttemkart 1Pttem Kart Jun 17, 2026 Mar 8, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart. This issue affects PtteM Kart: before 2.1.
CVE-2023-24780 1Funadmin 1Funadmin Jun 17, 2026 Mar 8, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.
CVE-2023-24775 1Funadmin 1Funadmin Jun 17, 2026 Mar 7, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.
CVE-2023-25223 1Crmeb 1Crmeb Java Jun 17, 2026 Mar 7, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.
CVE-2023-24781 1Funadmin 1Funadmin Jun 17, 2026 Mar 7, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.
CVE-2023-1253 1Health Center Patient Record Management System Project 1Health Center Patient Record Management System Jun 17, 2026 Mar 7, 2023 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability, which was classified as critical, was found in SourceCodester Health Center Patient Record Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument user...Show more A vulnerability, which was classified as critical, was found in SourceCodester Health Center Patient Record Management System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222483.Show less
CVE-2022-3760 1Miateknoloji 1Mia Med Jun 17, 2026 Mar 7, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mia Technology Mia-Med. This issue affects Mia-Med: before 1.0.0.58.
CVE-2023-1211 1Phpipam 1Phpipam Jun 17, 2026 Mar 7, 2023 N/A· v4 7.2 HIGH· v3 N/A· v2 SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
CVE-2008-10004 1Email Registration Project 1Email Registration Nov 21, 2024 Mar 6, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in Email Registration 5.x-2.1 on Drupal. It has been declared as critical. This vulnerability affects the function email_registration_user of the file email_registration.module. The manipulation...Show more A vulnerability was found in Email Registration 5.x-2.1 on Drupal. It has been declared as critical. This vulnerability affects the function email_registration_user of the file email_registration.module. The manipulation of the argument namenew leads to sql injection. The attack can be initiated remotely. Upgrading to version 6.x-1.0 is able to address this issue. The patch is identified as 126c141b7db038c778a2dc931d38766aad8d1112. It is recommended to upgrade the affected component. VDB-222334 is the identifier assigned to this vulnerability.Show less
CVE-2021-36393 1Moodle 1Moodle Jun 17, 2026 Mar 6, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

Previous 1...586587588...1045 Next