CWE-89
20,877 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVEs (20,877)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. |
The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. |
1Mayurik 1Best Online News Portal Jun 17, 2026 Feb 12, 2023 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability classified as critical has been found in SourceCodester Best Online News Portal 1.0. Affected is an unknown function of the component Login Page. The manipulation of the argument username leads to sql inj...Show more |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before...Show more |
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection.
This issue affects Smartpower Web: before 23.01.01. |
Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection.
This issue affects Smartpower Web: before 23.01.01. |
1Ibm 1Watson Knowledge Catalog On Cloud Pak For Data Jun 17, 2026 Feb 12, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete inform...Show more |
1Canteen Management System Project 1Canteen Management System Jun 17, 2026 Feb 11, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file removeOrder.php. The manipulation of the argument id...Show more |
1Phpgurukul 1Art Gallery Management System Jun 17, 2026 Feb 10, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter. |
1Phpgurukul 1Art Gallery Management System Jun 17, 2026 Feb 10, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php. |
1Webbuildersgroup 1Silverstripe Kapost Bridge Nov 21, 2024 Feb 10, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.ph...Show more |
1Medical Certificate Generator App Project 1Medical Certificate Generator App Jun 17, 2026 Feb 10, 2023 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability has been found in SourceCodester Medical Certificate Generator App 1.0 and classified as critical. This vulnerability affects unknown code of the file action.php. The manipulation of the argument lastname...Show more |
SQL Injection in GitHub repository ampache/ampache prior to 5.5.7,develop. |
1Shaarlier Project 1Shaarlier Nov 21, 2024 Feb 9, 2023 N/A· v4 9.8 CRITICAL· v3 5.2 MEDIUM· v2 A vulnerability was found in dimtion Shaarlier up to 1.2.2. It has been declared as critical. Affected by this vulnerability is the function createTag of the file app/src/main/java/com/dimtion/shaarlier/TagsSource.java o...Show more |
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module. |
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php. |
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or thr...Show more |
A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This issue affects some unknown processing of the file src/main/java/com/pointlion/mvc/common/model/SysOrg.java. The manipulation of the a...Show more |
1Institutional Management Website Project 1Institutional Management Website Jun 17, 2026 Feb 8, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via the ad parameter to /admin_area/login_transfer.php. |
1Xpressengine 1Xpressengine Nov 21, 2024 Feb 7, 2023 N/A· v4 9.8 CRITICAL· v3 5.2 MEDIUM· v2 A vulnerability was found in XpressEngine up to 1.4.4. It has been rated as critical. This issue affects some unknown processing of the component Update Query Handler. The manipulation leads to sql injection. Upgrading t...Show more |