Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,756)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-19113 1Newbee Mall Project 1Newbee Mall Jun 17, 2026 Nov 18, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 main/resources/mapper/NewBeeMallGoodsMapper.xml in newbee-mall (aka New Bee) before 2019-10-23 allows search?goodsCategoryId=&keyword= SQL Injection.
CVE-2019-18646 1Untangle 1Ng Firewall Jun 17, 2026 Nov 14, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 The Untangle NG firewall 14.2.0 is vulnerable to authenticated inline-query SQL injection within the timeDataDynamicColumn parameter when logged in as an admin user.
CVE-2019-3661 1Mcafee 1Advanced Threat Defense Jun 17, 2026 Nov 14, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to execute database commands via carefully co...Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to execute database commands via carefully constructed time based payloads.Show less
CVE-2019-0393 1Sap 1Quality Management Jun 17, 2026 Nov 13, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields of historical inspec...Show more An SQL Injection vulnerability in SAP Quality Management (corrected in S4CORE versions 1.0, 1.01, 1.02, 1.03) allows an attacker to carry out targeted database queries that can read individual fields of historical inspection results.Show less
CVE-2019-2211 1Google 1Android Jun 17, 2026 Nov 13, 2019 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 In createProjectionMapForQuery of TvProvider.java, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for explo...Show more In createProjectionMapForQuery of TvProvider.java, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269669Show less
CVE-2019-2198 1Google 1Android Jun 17, 2026 Nov 13, 2019 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 In Download Provider, there is a possible SQL injection vulnerability. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produ...Show more In Download Provider, there is a possible SQL injection vulnerability. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135270103Show less
CVE-2019-2196 1Google 1Android Jun 17, 2026 Nov 13, 2019 N/A· v4 5.5 MEDIUM· v3 4.9 MEDIUM· v2 In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersi...Show more In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-135269143Show less
CVE-2019-2195 1Google 1Android Jun 17, 2026 Nov 13, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 In tokenize of sqlite3_android.cpp, there is a possible attacker controlled INSERT statement due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges need...Show more In tokenize of sqlite3_android.cpp, there is a possible attacker controlled INSERT statement due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139186193Show less
CVE-2019-12720 1Auo 1Sunveillance Monitoring System & Data Recorder Jun 17, 2026 Nov 12, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the attacker to read privileg...Show more AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection. An Attacker can carry a SQL Injection payload to the server, allowing the attacker to read privileged data. This also affects the picture_manage_mvc.aspx plant_no parameter, the swapdl_mvc.aspx plant_no parameter, and the account_management.aspx Text_Postal_Code and Text_Dis_Code parameters.Show less
CVE-2011-2936 1Elgg 1Elgg Nov 21, 2024 Nov 12, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Elgg through 1.7.10 has a SQL injection vulnerability
CVE-2019-13079 1Quest 1Kace Systems Management Appliance Jun 17, 2026 Nov 6, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/h...Show more Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /adminui/history_log.php. The affected parameter is TYPE_NAME.Show less
CVE-2019-13078 1Quest 1Kace Systems Management Appliance Jun 17, 2026 Nov 6, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /common/us...Show more Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /common/user_profile.php. The affected parameter is sort_column.Show less
CVE-2019-13076 1Quest 1Kace Systems Management Appliance Jun 17, 2026 Nov 6, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ti...Show more Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticket_list.php, and affected parameters are order[0][column] and order[0][dir].Show less
CVE-2019-12918 1Quest 1Kace Systems Management Appliance Jun 17, 2026 Nov 6, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir].
CVE-2019-18784 1Salesagility 1Suitecrm Jun 17, 2026 Nov 6, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection.
CVE-2019-8143 1Magento 1Magento Jun 17, 2026 Nov 6, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templates can send malicious SQL queries and obtain access to sensit...Show more A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templates can send malicious SQL queries and obtain access to sensitive information stored in the database.Show less
CVE-2019-8134 1Magento 1Magento Jun 17, 2026 Nov 6, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with marketing privileges can execute arbitrary SQL queries in the database when accessing email templat...Show more A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with marketing privileges can execute arbitrary SQL queries in the database when accessing email template variables.Show less
CVE-2019-8130 1Magento 1Magento Jun 17, 2026 Nov 6, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database c...Show more A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates.Show less
CVE-2019-8127 1Magento 1Magento Jun 17, 2026 Nov 5, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrat...Show more A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation.Show less
CVE-2010-3662 1Typo3 1Typo3 Nov 21, 2024 Nov 4, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.

Previous 1...749750751...1038 Next