← Back
CWE-89

20,868 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,868)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-38729
1Sem Cms
1Semcms
Jun 17, 2026
Oct 28, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php.
CVE-2021-38217
1Sem Cms
1Semcms
Jun 17, 2026
Oct 28, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.
CVE-2021-38737
1Sem Cms
1Semcms
Jun 17, 2026
Oct 28, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
SEMCMS v 1.1 is vulnerable to SQL Injection via Ant_Pro.php.
CVE-2021-38736
1Sem Cms
1Semcms
Jun 17, 2026
Oct 28, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
SEMCMS Shop V 1.1 is vulnerable to SQL Injection via Ant_Global.php.
CVE-2021-38734
1Sem Cms
1Semcms
Jun 17, 2026
Oct 28, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Menu.php.
CVE-2021-37782
1Phpgurukul
1Employee Record Management System
Jun 17, 2026
Oct 28, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Employee Record Management System v 1.2 is vulnerable to SQL Injection via editempprofile.php.
CVE-2021-35387
1Phpgurukul
1Hospital Management System
Jun 17, 2026
Oct 28, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
Hospital Management System v 4.0 is vulnerable to SQL Injection via file:hospital/hms/admin/view-patient.php.
CVE-2022-43276
1Canteen Management System Project
1Canteen Management System
Jun 17, 2026
Oct 28, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the productId parameter at /php_action/fetchSelectedfood.php.
CVE-2022-3732
1Ehoney Project
1Ehoney
Jun 17, 2026
Oct 28, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection....Show more
A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functionality of the file /api/v1/bait/set. The manipulation of the argument Payload leads to sql injection. The attack may be launched remotely. VDB-212414 is the identifier assigned to this vulnerability.Show less
CVE-2022-3729
1Ehoney Project
1Ehoney
Jun 17, 2026
Oct 28, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection...Show more
A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown processing of the file /api/v1/attack. The manipulation of the argument AttackIP leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-212411.Show less
CVE-2022-41773
1Deltaww
1Diaenergie
Jun 17, 2026
Oct 27, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL quer...Show more
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.Show less
CVE-2022-41133
1Deltaww
1Diaenergie
Jun 17, 2026
Oct 27, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A low-privileged authenticated attacker could exploit this issu...Show more
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.Show less
CVE-2022-40967
1Deltaww
1Diaenergie
Jun 17, 2026
Oct 27, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary...Show more
The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.Show less
CVE-2022-39976
1School Activity Updates With Sms Notification Project
1School Activity Updates With Sms Notification
Jun 17, 2026
Oct 27, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/announcement/index.php?view=edit&id=.
CVE-2022-3714
1Oretnom23
1Online Medicine Ordering System
Jun 17, 2026
Oct 27, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/?page=orders/view_order. The manipulation of the argument id...Show more
A vulnerability classified as critical has been found in SourceCodester Online Medicine Ordering System 1.0. Affected is an unknown function of the file admin/?page=orders/view_order. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. VDB-212346 is the identifier assigned to this vulnerability.Show less
CVE-2022-43775
1Deltaww
1Diaenergie
Jun 17, 2026
Oct 26, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.
CVE-2022-43774
1Deltaww
1Diaenergie
Jun 17, 2026
Oct 26, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.
CVE-2022-37202
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Oct 26, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/advicefeedback/list
CVE-2022-3671
1Elearning System Project
1Elearning System
Jun 17, 2026
Oct 26, 2022
N/A· v4
9.8 CRITICAL· v3
6.5 MEDIUM· v2
A vulnerability classified as critical was found in SourceCodester eLearning System 1.0. This vulnerability affects unknown code of the file /admin/students/manage.php. The manipulation of the argument id leads to sql in...Show more
A vulnerability classified as critical was found in SourceCodester eLearning System 1.0. This vulnerability affects unknown code of the file /admin/students/manage.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212014 is the identifier assigned to this vulnerability.Show less
CVE-2022-2422
1Feathersjs
1Feathers Sequelize
Jun 17, 2026
Oct 26, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used.