Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,793)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-40645 1Jfinaloa Project 1Jfinaloa Jun 17, 2026 Mar 30, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An SQL Injection vulnerability exists in glorylion JFinalOA as of 9/7/2021 in the defkey parameter getHaveDoneTaskDataList method of the FlowTaskController.
CVE-2021-40644 1Oasys Project 1Oasys Jun 17, 2026 Mar 30, 2022 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 An SQL Injection vulnerability exists in oasys oa_system as of 9/7/2021 in resources/mappers/notice-mapper.xml.
CVE-2022-23797 1Joomla 1Joomla Jun 17, 2026 Mar 30, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection.
CVE-2020-24770 1Nexusphp 1Nexusphp Jun 17, 2026 Mar 30, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2020-24769 1Nexusphp 1Nexusphp Jun 17, 2026 Mar 30, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter.
CVE-2021-43109 1Puneethreddyhc Online Shopping System Project 1Puneethreddyhc Online Shopping System Jun 17, 2026 Mar 29, 2022 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php.
CVE-2022-27175 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26887 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify dat...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26836 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows an attacker to inject arbitrary SQL queries, retrieve and mo...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26667 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify d...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26666 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database con...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26514 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_tagHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify da...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_tagHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26349 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26338 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify databa...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26069 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify da...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26065 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26059 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database c...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-26013 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-25980 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify data...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less
CVE-2022-25880 1Deltaww 1Diaenergie Jun 17, 2026 Mar 29, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database...Show more Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.Show less

Previous 1...674675676...1040 Next