← Back
CWE-89

20,759 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,759)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2013-1400
1Cardozatechnologies
1Wordpress Poll
Nov 21, 2024
Feb 13, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs acti...Show more
Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or poll_id parameter in a viewPollResults or userlogs action.Show less
CVE-2020-8804
1Salesagility
1Suitecrm
Jun 17, 2026
Feb 13, 2020
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
CVE-2020-8802
1Salesagility
1Suitecrm
Jun 17, 2026
Feb 13, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.
CVE-2015-5617
1Enorth
1Webpublisher Cms
Nov 21, 2024
Feb 12, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in pub/m_pending_news/delete_pending_news.jsp in Enorth Webpublisher CMS allows remote attackers to execute arbitrary SQL commands via the cbNewsId parameter.
CVE-2012-1124
1Phxeventmanager Project
1Phxeventmanager
Nov 21, 2024
Feb 11, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in search.php in phxEventManager 2.0 beta 5 allows remote attackers to execute arbitrary SQL commands via the search_terms parameter.
CVE-2020-8596
1Xnau
1Participants Database
Jun 17, 2026
Feb 11, 2020
N/A· v4
7.5 HIGH· v3
6.0 MEDIUM· v2
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possi...Show more
participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is possible to exfiltrate data and potentially execute code (if certain conditions are met).Show less
CVE-2020-3934
1Secom
2Dr.id Access Control
Dr.id Attendance System
Jun 17, 2026
Feb 11, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command.
CVE-2013-5945
1Dlink
8Dsr 1000 Firmware
Dsr 1000n FirmwareDsr 150 Firmware+5 more
Nov 21, 2024
Feb 11, 2020
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-10...Show more
Multiple SQL injection vulnerabilities in D-Link DSR-150 with firmware before 1.08B44; DSR-150N with firmware before 1.05B64; DSR-250 and DSR-250N with firmware before 1.08B44; and DSR-500, DSR-500N, DSR-1000, and DSR-1000N with firmware before 1.08B77 allow remote attackers to execute arbitrary SQL commands via the password to (1) the login.authenticate function in share/lua/5.1/teamf1lualib/login.lua or (2) captivePortal.lua.Show less
CVE-2020-8841
1Testlink
1Testlink
Jun 17, 2026
Feb 10, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
An issue was discovered in TestLink 1.9.19. The relation_type parameter of the lib/requirements/reqSearch.php endpoint is vulnerable to authenticated SQL Injection.
CVE-2019-20059
1Mfscripts
1Yetishare
Jun 17, 2026
Feb 10, 2020
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQL string. This allows an attacker to inject their own SQL and...Show more
payment_manage.ajax.php and various *_manage.ajax.php in MFScripts YetiShare 3.5.2 through 4.5.4 directly insert values from the sSortDir_0 parameter into a SQL string. This allows an attacker to inject their own SQL and manipulate the query, typically extracting data from the database, aka SQL Injection. NOTE: this issue exists because of an incomplete fix for CVE-2019-19732.Show less
CVE-2015-3423
1Netcracker
1Resource Management System
Nov 21, 2024
Feb 8, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) ctrl, (2) h____%2427, (3) h____%2439, (4) param0,...Show more
Multiple SQL injection vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) ctrl, (2) h____%2427, (3) h____%2439, (4) param0, (5) param1, (6) param2, (7) param3, (8) param4, (9) filter_INSERT_COUNT, (10) filter_MINOR_FALLOUT, (11) filter_UPDATE_COUNT, (12) sort, or (13) sessid parameter.Show less
CVE-2015-2062
1Huge It
1Huge It Slider
Nov 21, 2024
Feb 8, 2020
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts o...Show more
Multiple SQL injection vulnerabilities in the Huge-IT Slider (slider-image) plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popup_posts or edit_cat action in the sliders_huge_it_slider page to wp-admin/admin.php.Show less
CVE-2020-8656
1Eyesofnetwork
1Eyesofnetwork
Jun 17, 2026
Feb 7, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to g...Show more
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.Show less
CVE-2020-8645
1Simplejobscript
1Simplejobscript
Jun 17, 2026
Feb 7, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search function. The vulnerable parameter is job_id. The function is getJobApplicationsB...Show more
An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search function. The vulnerable parameter is job_id. The function is getJobApplicationsByJobId(). The file is _lib/class.JobApplication.php.Show less
CVE-2013-3638
1Boonex
1Dolphin
Nov 21, 2024
Feb 6, 2020
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
SQL injection vulnerability in Boonex Dolphin before 7.1.3 allows remote authenticated users to execute arbitrary SQL commands via the 'pathes' parameter in 'categories.php'.
CVE-2011-1151
1Joomla
1Joomla
Nov 21, 2024
Feb 5, 2020
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.
CVE-2019-20447
1Jobberbase
1Jobberbase
Jun 17, 2026
Feb 5, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Jobberbase 2.0 has SQL injection via the PATH_INFO to the jobs-in endpoint.
CVE-2019-15622
1Nextcloud
1Nextcloud
Jun 17, 2026
Feb 4, 2020
N/A· v4
2.4 LOW· v3
2.1 LOW· v2
Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables when using custom queries.
CVE-2020-3937
1Sysjust
1Syuan Gu Da Shin
Jun 17, 2026
Feb 4, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary file in the database.
CVE-2020-8592
1Eginnovations
1Eg Manager
Jun 17, 2026
Feb 3, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
eG Manager 7.1.2 allows SQL Injection via the user parameter to com.eg.LoginHelperServlet (aka the Forgot Password feature).