Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,874)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-4375 1Mingsoft 1Mcms Jun 17, 2026 Dec 9, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection...Show more A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.Show less
CVE-2022-44393 1Sanitization Management System Project 1Sanitization Management System Jun 17, 2026 Dec 7, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=.
CVE-2022-4322 1Maku 1Maku Boot Jun 17, 2026 Dec 7, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 A vulnerability, which was classified as critical, was found in maku-boot up to 2.2.0. This affects the function doExecute of the file AbstractScheduleJob.java of the component Scheduled Task Handler. The manipulation le...Show more A vulnerability, which was classified as critical, was found in maku-boot up to 2.2.0. This affects the function doExecute of the file AbstractScheduleJob.java of the component Scheduled Task Handler. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 446eb7294332efca2bfd791bc37281cedac0d0ff. It is recommended to apply a patch to fix this issue. The identifier VDB-215013 was assigned to this vulnerability.Show less
CVE-2022-45010 1Simple Phone Book/directory Web App Project 1Simple Phone Book/directory Web App Jun 17, 2026 Dec 7, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit.php.
CVE-2022-33875 1Fortinet 1Fortiadc Jun 17, 2026 Dec 6, 2022 N/A· v4 8.8 HIGH· v3 N/A· v2 An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated at...Show more An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.Show less
CVE-2022-45019 1Slims 1Senayan Library Management System Jun 17, 2026 Dec 5, 2022 N/A· v4 7.5 HIGH· v3 N/A· v2 SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.
CVE-2022-45822 1Elbtide 1Advanced Booking Calendar Jun 17, 2026 Dec 5, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress.
CVE-2022-4278 1Oretnom23 1Human Resource Management System Jun 17, 2026 Dec 3, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /hrm/employeeadd.php. The manipulation of the argume...Show more A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /hrm/employeeadd.php. The manipulation of the argument empid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214775.Show less
CVE-2022-4277 1Xsjczx 1Background Management System Jun 17, 2026 Dec 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in Shaoxing Background Management System. It has been declared as critical. This vulnerability affects unknown code of the file /Default/Bd. The manipulation of the argument id leads to sql inje...Show more A vulnerability was found in Shaoxing Background Management System. It has been declared as critical. This vulnerability affects unknown code of the file /Default/Bd. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-214774 is the identifier assigned to this vulnerability.Show less
CVE-2022-4275 1House Rental System Project 1House Rental System Jun 17, 2026 Dec 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionality of the file search-property.php of the component POST Request Handler. The mani...Show more A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionality of the file search-property.php of the component POST Request Handler. The manipulation of the argument search_property leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-214771.Show less
CVE-2022-4274 1House Rental System Project 1House Rental System Jun 17, 2026 Dec 3, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-property.php. The manipulation of the argument property_id leads to sql injection. It...Show more A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-property.php. The manipulation of the argument property_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-214770 is the identifier assigned to this vulnerability.Show less
CVE-2022-44945 1Rukovoditel 1Rukovoditel Jul 9, 2026 Dec 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.
CVE-2022-44291 1Webtareas Project 1Webtareas Jul 9, 2026 Dec 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
CVE-2022-44290 1Webtareas Project 1Webtareas Jul 9, 2026 Dec 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
CVE-2022-44348 1Sanitization Management System Project 1Sanitization Management System Jun 17, 2026 Dec 2, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.
CVE-2022-44347 1Sanitization Management System Project 1Sanitization Management System Jun 17, 2026 Dec 2, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=.
CVE-2022-44345 1Sanitization Management System Project 1Sanitization Management System Jun 17, 2026 Dec 2, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=.
CVE-2022-44277 1Sanitization Management System Project 1Sanitization Management System Jun 17, 2026 Dec 2, 2022 N/A· v4 7.2 HIGH· v3 N/A· v2 Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.
CVE-2022-2807 1Algan 1Prens Student Information System Jun 17, 2026 Dec 2, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection. This issue affects Prens Student Information System: before 2.1.11.
CVE-2022-3711 1Sophos 1Xg Firewall Firmware Jun 17, 2026 Dec 1, 2022 N/A· v4 4.3 MEDIUM· v3 N/A· v2 A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall releases older than version 19.5 GA.

Previous 1...609610611...1044 Next