Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,600)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-40845 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result i...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40844 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total lo...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40843 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total los...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40842 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40841 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40840 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements in a SQL SELECT command. This can resul...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40839 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a SQL SELECT command. This can resul...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40838 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result i...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40837 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40836 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 7.1 HIGH· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whol...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.Show less
CVE-2026-40835 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40834 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 7.1 HIGH· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT co...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.Show less
CVE-2026-40833 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 7.1 HIGH· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command a...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.Show less
CVE-2026-40832 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a SQL SELECT command. This can result in...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40831 - - Jun 17, 2026 May 27, 2026 7.1 HIGH· v4 6.5 MEDIUM· v3 N/A· v2 An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of...Show more An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.Show less
CVE-2026-40830 - - Jun 17, 2026 May 27, 2026 7.0 HIGH· v4 5.5 MEDIUM· v3 N/A· v2 A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command a...Show more A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.Show less
CVE-2026-40829 - - Jun 17, 2026 May 27, 2026 7.0 HIGH· v4 5.5 MEDIUM· v3 N/A· v2 A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allo...Show more A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.Show less
CVE-2026-40828 - - Jun 17, 2026 May 27, 2026 7.0 HIGH· v4 5.5 MEDIUM· v3 N/A· v2 A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization of special elements in a SQL DELETE command allowing for readi...Show more A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.Show less
CVE-2026-40827 - - Jun 17, 2026 May 27, 2026 7.0 HIGH· v4 5.5 MEDIUM· v3 N/A· v2 A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading...Show more A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.Show less
CVE-2025-30028 1Synology 1Active Backup For Business Jun 17, 2026 May 27, 2026 N/A· v4 8.6 HIGH· v3 N/A· v2 A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files.

Previous 1...727374...1030 Next