← Back
CWE-89

20,873 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,873)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-43447
1Deltaww
1Diaenergie
Jun 17, 2026
Nov 17, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
CVE-2022-41775
1Deltaww
1Diaenergie
Jun 17, 2026
Nov 17, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network
CVE-2022-39180
1College Management System Project
1College Management System
Jun 17, 2026
Nov 17, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
College Management System v1.0 - SQL Injection (SQLi). By inserting SQL commands to the username and password fields in the login.php page
CVE-2022-39179
1College Management System Project
1College Management System
Jun 17, 2026
Nov 17, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload .php file that contains malicious...Show more
College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in my other report) can upload .php file that contains malicious code via student.php file. Show less
CVE-2022-36787
1Webvendome Project
1Webvendome
Jun 17, 2026
Nov 17, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
webvendome - webvendome SQL Injection. SQL Injection in the Parameter " DocNumber" Request : Get Request : /webvendome/showfiles.aspx?jobnumber=nullDoc Number=HERE.
CVE-2022-43179
1Online Leave Management System Project
1Online Leave Management System
Jun 17, 2026
Nov 17, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&id=.
CVE-2022-43163
1Online Diagnostic Lab Management System Project
1Online Diagnostic Lab Management System
Jun 17, 2026
Nov 17, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view_client.php.
CVE-2022-43162
1Online Diagnostic Lab Management System Project
1Online Diagnostic Lab Management System
Jun 17, 2026
Nov 17, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_test.php.
CVE-2022-44403
1Automotive Shop Management System Project
1Automotive Shop Management System
Jun 17, 2026
Nov 17, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=.
CVE-2022-44402
1Automotive Shop Management System Project
1Automotive Shop Management System
Jun 17, 2026
Nov 17, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction.
CVE-2022-4052
1Student Attendance Management System Project
1Student Attendance Management System
Jun 17, 2026
Nov 17, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/createClass.php. The manipulation of the argument Id leads to sq...Show more
A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/createClass.php. The manipulation of the argument Id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213845 was assigned to this vulnerability.Show less
CVE-2022-4051
1Hostel Searching Project
1Hostel Searching Project
Jun 17, 2026
Nov 17, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. The manipulation of the argument property_id leads to sql inje...Show more
A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. The manipulation of the argument property_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213844.Show less
CVE-2022-42245
1Dreamer Cms Project
1Dreamer Cms
Jun 17, 2026
Nov 17, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Dreamer CMS 4.0.01 is vulnerable to SQL Injection.
CVE-2021-38819
1Simple Image Gallery Web App Project
1Simple Image Gallery Web App
Jun 17, 2026
Nov 17, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
A SQL injection vulnerability exits on the Simple Image Gallery System 1.0 application through "id" parameter on the album page.
CVE-2022-44003
1Backclick
1Backclick
Jun 17, 2026
Nov 16, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient escaping of user-supplied input, the application is vulnerable to SQL injection at various locations.
CVE-2022-43135
1Online Diagnostic Lab Management System Project
1Online Diagnostic Lab Management System
Jun 17, 2026
Nov 16, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostic/login.php.
CVE-2022-43262
1Oretnom23
1Human Resource Management System
Jun 17, 2026
Nov 16, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /hrm/controller/login.php.
CVE-2022-43256
1Seacms
1Seacms
Jun 17, 2026
Nov 16, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php.
CVE-2022-4015
1Sports Club Management System Project
1Sports Club Management System
Jun 17, 2026
Nov 16, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments.php. The manipulation of the argument m_id/plan leads to sql...Show more
A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments.php. The manipulation of the argument m_id/plan leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213789 was assigned to this vulnerability.Show less
CVE-2022-4012
1Hospital Management Center Project
1Hospital Management Center
Jun 17, 2026
Nov 16, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability classified as critical has been found in Hospital Management Center. Affected is an unknown function of the file patient-info.php. The manipulation of the argument pt_id leads to sql injection. It is poss...Show more
A vulnerability classified as critical has been found in Hospital Management Center. Affected is an unknown function of the file patient-info.php. The manipulation of the argument pt_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213786 is the identifier assigned to this vulnerability.Show less