Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,856)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-24691 1Dsk 1Dsknet Jun 17, 2026 Jul 18, 2022 N/A· v4 7.1 HIGH· v3 N/A· v2 An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQ...Show more An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based.Show less
CVE-2022-24690 1Dsk 1Dsknet Jun 17, 2026 Jul 18, 2022 N/A· v4 8.2 HIGH· v3 N/A· v2 An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests....Show more An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. (An unauthenticated attacker can discover the endpoint by abusing a Broken Access Control issue with further SQL injection attacks to gather all user's badge numbers and PIN codes.)Show less
CVE-2022-27434 1Unit4 1Teta Jun 17, 2026 Jul 18, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 UNIT4 TETA Mobile Edition (ME) before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page.
CVE-2017-20138 1Itechscripts 1Auction Script Nov 21, 2024 Jul 16, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 A...Show more A vulnerability was found in Itech Auction Script 6.49. It has been classified as critical. This affects an unknown part of the file /mcategory.php. The manipulation of the argument mcid with the input 4' AND 1734=1734 AND 'Ggks'='Ggks leads to sql injection (Blind). It is possible to initiate the attack remotely.Show less
CVE-2017-20137 1Itechscripts 1B2b Script Nov 21, 2024 Jul 16, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability was found in Itech B2B Script 4.28. It has been rated as critical. This issue affects some unknown processing of the file /catcompany.php. The manipulation of the argument token with the input 704667c6a1e...Show more A vulnerability was found in Itech B2B Script 4.28. It has been rated as critical. This issue affects some unknown processing of the file /catcompany.php. The manipulation of the argument token with the input 704667c6a1e7ce56d3d6fa748ab6d9af3fd7' AND 6539=6539 AND 'Fakj'='Fakj leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2017-20136 1Itechscripts 1Classifieds Script Nov 21, 2024 Jul 16, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 A vulnerability classified as critical has been found in Itech Classifieds Script 7.27. Affected is an unknown function of the file /subpage.php. The manipulation of the argument scat with the input =51' AND 4941=4941 AN...Show more A vulnerability classified as critical has been found in Itech Classifieds Script 7.27. Affected is an unknown function of the file /subpage.php. The manipulation of the argument scat with the input =51' AND 4941=4941 AND 'hoCP'='hoCP leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2017-20135 1Itechscripts 1Dating Script Nov 21, 2024 Jul 16, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability classified as critical was found in Itech Dating Script 3.26. Affected by this vulnerability is an unknown functionality of the file /see_more_details.php. The manipulation of the argument id leads to sql...Show more A vulnerability classified as critical was found in Itech Dating Script 3.26. Affected by this vulnerability is an unknown functionality of the file /see_more_details.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2017-20134 1Itechscripts 1Freelancer Script Nov 21, 2024 Jul 16, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability, which was classified as critical, has been found in Itech Freelancer Script 5.13. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument sk leads...Show more A vulnerability, which was classified as critical, has been found in Itech Freelancer Script 5.13. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument sk leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2017-20132 1Itechscripts 1Multi Vendor Script Nov 21, 2024 Jul 16, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in Itech Multi Vendor Script 6.49 and classified as critical. This issue affects some unknown processing of the file /multi-vendor-shopping-script/product-list.php. The manipulation of the argum...Show more A vulnerability was found in Itech Multi Vendor Script 6.49 and classified as critical. This issue affects some unknown processing of the file /multi-vendor-shopping-script/product-list.php. The manipulation of the argument pl leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2017-20131 1Itechscripts 1News Portal Script Nov 21, 2024 Jul 16, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in Itech News Portal 6.28. It has been classified as critical. Affected is an unknown function of the file /news-portal-script/information.php. The manipulation of the argument inf leads to sql...Show more A vulnerability was found in Itech News Portal 6.28. It has been classified as critical. Affected is an unknown function of the file /news-portal-script/information.php. The manipulation of the argument inf leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2017-20130 1Itechscripts 1Real Estate Script Nov 21, 2024 Jul 16, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in Itech Real Estate Script 3.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /real-estate-script/search_property.php. The manipulati...Show more A vulnerability was found in Itech Real Estate Script 3.12. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /real-estate-script/search_property.php. The manipulation of the argument property_for leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2022-32416 1Product Show Room Site Project 1Product Show Room Site Jun 17, 2026 Jul 14, 2022 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=delete_product.
CVE-2022-32415 1Product Show Room Site Project 1Product Show Room Site Jun 17, 2026 Jul 14, 2022 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/?p=products/view_product&id=.
CVE-2022-32297 1Piwigo 1Piwigo Jun 17, 2026 Jul 14, 2022 N/A· v4 7.5 HIGH· v3 5.1 MEDIUM· v2 Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function.
CVE-2022-30113 1Fahou100 1Electronic Mall System Jun 17, 2026 Jul 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Electronic mall system 1.0_build20200203 is affected vulnerable to SQL Injection.
CVE-2017-20129 1Logostore Project 1Logostore Nov 21, 2024 Jul 14, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in LogoStore. It has been classified as critical. Affected is an unknown function of the file /LogoStore/search.php. The manipulation of the argument query with the input test' UNION ALL SELECT...Show more A vulnerability was found in LogoStore. It has been classified as critical. Affected is an unknown function of the file /LogoStore/search.php. The manipulation of the argument query with the input test' UNION ALL SELECT CONCAT(CONCAT('qqkkq','VnPVWVaYxljWqGpLLbEIyPIHBjjjjASQTnaqfKaV'),'qvvpq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- oCrh&search= leads to sql injection. It is possible to launch the attack remotely.Show less
CVE-2017-20128 1Kb Messages Php Script Project 1Kb Messages Php Script Nov 21, 2024 Jul 13, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/password with the input 'or''...Show more A vulnerability has been found in KB Messages PHP Script 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2017-20127 1Kb Login Authentication Script Project 1Kb Login Authentication Script Nov 21, 2024 Jul 13, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in KB Login Authentication Script 1.1 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument username/password with the input 'or''='...Show more A vulnerability was found in KB Login Authentication Script 1.1 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2017-20126 1Kb Affiliate Referral Script Project 1Kb Affiliate Referral Script Nov 21, 2024 Jul 13, 2022 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A vulnerability was found in KB Affiliate Referral Script 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument username/password with the input 'o...Show more A vulnerability was found in KB Affiliate Referral Script 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2022-35628 1In2code 1Living User Experience Jun 17, 2026 Jul 12, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.

Previous 1...641642643...1043 Next