← Back
CWE-89

20,860 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,860)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-36703
1Ingredients Stock Management System Project
1Ingredients Stock Management System
Jun 17, 2026
Aug 25, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /stocks/manage_stockin.php.
CVE-2022-36701
1Ingredients Stock Management System Project
1Ingredients Stock Management System
Jun 17, 2026
Aug 25, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/view_item.php.
CVE-2022-36700
1Ingredients Stock Management System Project
1Ingredients Stock Management System
Jun 17, 2026
Aug 25, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /items/manage_item.php.
CVE-2022-36699
1Ingredients Stock Management System Project
1Ingredients Stock Management System
Jun 17, 2026
Aug 25, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/manage_category.php.
CVE-2022-36698
1Ingredients Stock Management System Project
1Ingredients Stock Management System
Jun 17, 2026
Aug 25, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/view_category.php.
CVE-2021-43766
1Odyssey Project
1Odyssey
Jun 17, 2026
Aug 25, 2022
N/A· v4
8.1 HIGH· v3
N/A· v2
Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a...Show more
Odyssey passes to server unencrypted bytes from man-in-the-middle When Odyssey is configured to use certificate Common Name for client authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and encryption. This is similar to CVE-2021-23214 for PostgreSQL.Show less
CVE-2022-2957
1Simple And Nice Shopping Cart Script Project
1Simple And Nice Shopping Cart Script
Jun 17, 2026
Aug 25, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A vulnerability classified as critical was found in SourceCodester Simple and Nice Shopping Cart Script. Affected by this vulnerability is an unknown functionality of the file /mkshop/Men/profile.php. The manipulation of...Show more
A vulnerability classified as critical was found in SourceCodester Simple and Nice Shopping Cart Script. Affected by this vulnerability is an unknown functionality of the file /mkshop/Men/profile.php. The manipulation of the argument mem_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-207001 was assigned to this vulnerability.Show less
CVE-2022-37178
172crm
1Wukong Crm
Jun 17, 2026
Aug 24, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
An issue was discovered in 72crm 9.0. There is a SQL Injection vulnerability in View the task calendar.
CVE-2022-37333
1Exceedone
2Exment
Laravel Admin
Jun 17, 2026
Aug 24, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earl...Show more
SQL injection vulnerability in the Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows remote authenticated attackers to execute arbitrary SQL commands.Show less
CVE-2022-35115
1Icewarp
1Webclient Dc2
Jun 17, 2026
Aug 23, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.
CVE-2022-37113
1Bluecms Project
1Bluecms
Jun 17, 2026
Aug 23, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Bluecms 1.6 has SQL injection in line 132 of admin/area.php
CVE-2022-37112
1Bluecms Project
1Bluecms
Jun 17, 2026
Aug 23, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
BlueCMS 1.6 has SQL injection in line 55 of admin/model.php
CVE-2022-37111
1Bluecms Project
1Bluecms
Jun 17, 2026
Aug 23, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
BlueCMS 1.6 has SQL injection in line 132 of admin/article.php
CVE-2022-36394
1Contest Gallery
1Contest Gallery
Jun 17, 2026
Aug 23, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
Authenticated (author+) SQL Injection (SQLi) vulnerability in Contest Gallery plugin <= 17.0.4 at WordPress.
CVE-2022-37223
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Aug 23, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/role/list.
CVE-2022-37199
1Jflyfox
1Jfinal Cms
Jun 17, 2026
Aug 23, 2022
N/A· v4
9.8 CRITICAL· v3
N/A· v2
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /jfinal_cms/system/user/list.
CVE-2022-34652
1Wwbn
1Avideo
Jun 17, 2026
Aug 22, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request t...Show more
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the description parameter.Show less
CVE-2022-33149
1Wwbn
1Avideo
Jun 17, 2026
Aug 22, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request t...Show more
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the CloneSite plugin, allowing an attacker to inject SQL by manipulating the url parameter.Show less
CVE-2022-33148
1Wwbn
1Avideo
Jun 17, 2026
Aug 22, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request t...Show more
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the title parameter.Show less
CVE-2022-33147
1Wwbn
1Avideo
Jun 17, 2026
Aug 22, 2022
N/A· v4
8.8 HIGH· v3
N/A· v2
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request t...Show more
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the aVideoEncoder functionality which can be used to add new videos, allowing an attacker to inject SQL by manipulating the videoDownloadedLink or duration parameter.Show less