← Back
CWE-89

20,864 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,864)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-38278
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Sep 9, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.
CVE-2022-38277
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Sep 9, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
CVE-2022-38276
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Sep 9, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.
CVE-2022-38275
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Sep 9, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.
CVE-2022-38274
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Sep 9, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.
CVE-2022-38273
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Sep 9, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.
CVE-2022-38272
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Sep 9, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.
CVE-2022-38269
1School Activity Updates With Sms Notification Project
1School Activity Updates With Sms Notification
Jun 17, 2026
Sep 8, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstudent/index.php?view=edit&id=.
CVE-2022-38268
1School Activity Updates With Sms Notification Project
1School Activity Updates With Sms Notification
Jun 17, 2026
Sep 8, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonumber/index.php?view=edit&id=.
CVE-2022-38267
1School Activity Updates With Sms Notification Project
1School Activity Updates With Sms Notification
Jun 17, 2026
Sep 8, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/user/index.php?view=edit&id=.
CVE-2022-38265
1Apartment Visitor Management System Project
1Apartment Visitor Management System
Jun 17, 2026
Sep 8, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Apartment Visitor Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /avms/edit-apartment.php.
CVE-2022-38260
1Janobe
1Interview Management System
Jun 17, 2026
Sep 8, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=questiondelete&id=.
CVE-2022-38255
1Janobe
1Interview Management System
Jun 17, 2026
Sep 8, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /interview/editQuestion.php.
CVE-2022-38250
1Nagios
1Nagios Xi
Jun 17, 2026
Sep 7, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page.
CVE-2022-3130
1Online Driving School Project Project
1Online Driving School Project
Jun 17, 2026
Sep 7, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability classified as critical has been found in codeprojects Online Driving School. This affects an unknown part of the file /login.php. The manipulation of the argument username leads to sql injection. It is po...Show more
A vulnerability classified as critical has been found in codeprojects Online Driving School. This affects an unknown part of the file /login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207873 was assigned to this vulnerability.Show less
CVE-2022-1807
1Sophos
1Firewall
Jun 17, 2026
Sep 7, 2022
N/A· v4
7.2 HIGH· v3
N/A· v2
Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1.
CVE-2022-37185
1Ems Project
1Ems
Jun 17, 2026
Sep 6, 2022
N/A· v4
7.5 HIGH· v3
N/A· v2
SQL injection vulnerability exists in the school information query interface (repschoolproj.php) of the EMS 6.2 system of the Office of the Thai Basic Education Commission, which can lead to data leakage.
CVE-2022-2718
1Beardev
1Joomsport
Jun 17, 2026
Sep 6, 2022
N/A· v4
4.9 MEDIUM· v3
N/A· v2
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including,...Show more
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-page-extrafields page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrative privileges, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.Show less
CVE-2022-2717
1Beardev
1Joomsport
Jun 17, 2026
Sep 6, 2022
N/A· v4
4.9 MEDIUM· v3
N/A· v2
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-events-form page in versions up to, and including, 5.2.5...Show more
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the joomsport-events-form page in versions up to, and including, 5.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrative privileges, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.Show less
CVE-2022-29058
1Fortinet
4Fortiap
Fortiap SFortiap U+1 more
Jun 17, 2026
Sep 6, 2022
N/A· v4
7.8 HIGH· v3
N/A· v2
An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0, FortiAP-S 6.0.0 through 6.4...Show more
An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0, FortiAP-S 6.0.0 through 6.4.7, FortiAP-W2 6.0.0 through 6.4.7, 7.0.0 through 7.0.3, 7.2.0 and FortiAP-U 5.4.0 through 6.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.Show less