Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,877)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-27596 1Qnap 2Qts Quts Hero Jun 17, 2026 Jan 30, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following...Show more A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later Show less
CVE-2023-0570 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 29, 2023 N/A· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\payment_operation.php. The manipulatio...Show more A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file user\operations\payment_operation.php. The manipulation of the argument booking_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219729 was assigned to this vulnerability.Show less
CVE-2023-0562 1Phpgurukul 1Bank Locker Management System Jun 17, 2026 Jan 28, 2023 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulatio...Show more A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716.Show less
CVE-2023-0561 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 28, 2023 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id le...Show more A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability.Show less
CVE-2023-0560 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 28, 2023 N/A· v4 7.2 HIGH· v3 5.8 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipul...Show more A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219701 was assigned to this vulnerability.Show less
CVE-2022-48011 1Opencats 1Opencats Jun 17, 2026 Jan 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
CVE-2022-44298 1Sscms 1Siteserver Cms Jun 17, 2026 Jan 27, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
CVE-2023-0534 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 27, 2023 N/A· v4 4.7 MEDIUM· v3 5.8 MEDIUM· v2 A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argu...Show more A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219603.Show less
CVE-2023-0533 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 27, 2023 N/A· v4 4.7 MEDIUM· v3 5.8 MEDIUM· v2 A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is some unknown functionality of the file admin/expense_report.php....Show more A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is some unknown functionality of the file admin/expense_report.php. The manipulation of the argument from_date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-219602 is the identifier assigned to this vulnerability.Show less
CVE-2023-0532 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 27, 2023 N/A· v4 4.7 MEDIUM· v3 5.8 MEDIUM· v2 A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/disapprove_user.php. The manip...Show more A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/disapprove_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219601 was assigned to this vulnerability.Show less
CVE-2023-0531 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 27, 2023 N/A· v4 4.7 MEDIUM· v3 5.8 MEDIUM· v2 A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/booking_report.php. The manipulation of the argument...Show more A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/booking_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219600.Show less
CVE-2023-0530 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 27, 2023 N/A· v4 9.8 CRITICAL· v3 5.8 MEDIUM· v2 A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/approve_user.php. The manipulation of...Show more A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/approve_user.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219599.Show less
CVE-2023-0529 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 27, 2023 N/A· v4 6.3 MEDIUM· v3 5.8 MEDIUM· v2 A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/add_payment.php. The manipulation of t...Show more A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/add_payment.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219598 is the identifier assigned to this vulnerability.Show less
CVE-2023-0528 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 27, 2023 N/A· v4 6.3 MEDIUM· v3 5.8 MEDIUM· v2 A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/abc.php. The manipulation of the argument id le...Show more A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/abc.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219597 was assigned to this vulnerability.Show less
CVE-2022-46966 1Revenue Collection System Project 1Revenue Collection System Jun 17, 2026 Jan 26, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Revenue Collection System v1.0 was discovered to contain a SQL injection vulnerability at step1.php.
CVE-2023-0516 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 26, 2023 N/A· v4 7.2 HIGH· v3 5.2 MEDIUM· v2 A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file user/forget_password.php of the component Paramete...Show more A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file user/forget_password.php of the component Parameter Handler. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219336.Show less
CVE-2023-0515 1Online Tours & Travels Management System Project 1Online Tours & Travels Management System Jun 17, 2026 Jan 26, 2023 N/A· v4 7.2 HIGH· v3 5.2 MEDIUM· v2 A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/forget_password.php of the component Param...Show more A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/forget_password.php of the component Parameter Handler. The manipulation of the argument email leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219335.Show less
CVE-2022-46999 1Tuzicms 1Tuzicms Jun 17, 2026 Jan 26, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.
CVE-2022-45820 1Thimpress 1Learnpress Jun 17, 2026 Jan 26, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
CVE-2022-45808 1Thimpress 1Learnpress Jun 17, 2026 Jan 26, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.

Previous 1...595596597...1044 Next