Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,756)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-18663 1Isl 1Arp Guard Jun 17, 2026 Nov 4, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter.
CVE-2019-18662 1Youphptube 1Youphptube Jun 17, 2026 Nov 2, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in YouPHPTube through 7.7. User input passed through the live_stream_code POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized (in getFromChat in plugin/LiveChat/Objects/L...Show more An issue was discovered in YouPHPTube through 7.7. User input passed through the live_stream_code POST parameter to /plugin/LiveChat/getChat.json.php is not properly sanitized (in getFromChat in plugin/LiveChat/Objects/LiveChatObj.php) before being used to construct a SQL query. This can be exploited by malicious users to, e.g., read sensitive data from the database through in-band SQL Injection attacks. Successful exploitation of this vulnerability requires the Live Chat plugin to be enabled.Show less
CVE-2019-6658 1F5 1Big Ip Advanced Firewall Manager Jun 17, 2026 Nov 1, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a vulnerability in the AFM configuration utility may allow any authenticated BIG-IP user to run an SQL injection attack.
CVE-2013-2738 1Readymedia Project 1Readymedia Nov 21, 2024 Nov 1, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 minidlna has SQL Injection that may allow retrieval of arbitrary files
CVE-2019-18229 1Advantech 1Wise Paas/rmm Jun 17, 2026 Oct 31, 2019 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitization of user-supplied input cause SQL injection vulnerabilities. An attacker can leverage these vulnerabilities to disclose information.
CVE-2019-5151 1Youphptube 1Youphptube Jun 17, 2026 Oct 31, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and loca...Show more An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability.Show less
CVE-2019-5150 1Youphptube 1Youphptube Jun 17, 2026 Oct 31, 2019 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the "VideoTags" plugin is enabled, a specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of servic...Show more An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. When the "VideoTags" plugin is enabled, a specially crafted unauthenticated HTTP request can cause a SQL injection, possibly leading to denial of service, exfiltration of the database and local file inclusion, which could potentially further lead to code execution. An attacker can send an HTTP request to trigger this vulnerability.Show less
CVE-2019-18464 1Ipswitch 1Moveit Transfer Jun 17, 2026 Oct 31, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauth...Show more In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3), multiple SQL Injection vulnerabilities have been found in the REST API that could allow an unauthenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database or may be able to alter the database.Show less
CVE-2019-10762 1Medoo 1Medoo Jun 17, 2026 Oct 30, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.
CVE-2019-10749 1Sequelizejs 1Sequelize Jun 17, 2026 Oct 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect.
CVE-2019-10748 1Sequelizejs 1Sequelize Jun 17, 2026 Oct 29, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects.
CVE-2019-10208 1Postgresql 1Postgresql Jun 17, 2026 Oct 29, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY...Show more A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.Show less
CVE-2009-4899 1Pixelpost 1Pixelpost Nov 21, 2024 Oct 28, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 pixelpost 1.7.1 has SQL injection
CVE-2019-5123 1Youphptube 1Youphptube Jun 17, 2026 Oct 25, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Specially crafted web requests can cause SQL injections in YouPHPTube 7.6. An attacker can send a web request with Parameter dir in /objects/pluginSwitch.json.php.
CVE-2019-5122 1Youphptube 1Youphptube Jun 17, 2026 Oct 25, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.j...Show more SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter name in /objects/pluginSwitch.json.php.Show less
CVE-2019-5121 1Youphptube 1Youphptube Jun 17, 2026 Oct 25, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.j...Show more SQL injection vulnerabilities exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with Parameter uuid in /objects/pluginSwitch.json.phpShow less
CVE-2019-5120 1Youphptube 1Youphptube Jun 17, 2026 Oct 25, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL in...Show more An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configurations, access the underlying operating system.Show less
CVE-2019-5119 1Youphptube 1Youphptube Jun 17, 2026 Oct 25, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL inj...Show more An exploitable SQL injection vulnerability exist in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configurations, access the underlying operating system.Show less
CVE-2019-5117 1Youphptube 1Youphptube Jun 17, 2026 Oct 25, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL...Show more Exploitable SQL injection vulnerabilities exists in the authenticated portion of YouPHPTube 7.6. Specially crafted web requests can cause SQL injections. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configuration, access the underlying operating system.Show less
CVE-2019-5116 1Youphptube 1Youphptube Jun 17, 2026 Oct 25, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL i...Show more An exploitable SQL injection vulnerability exists in the authenticated part of YouPHPTube 7.6. Specially crafted web requests can cause a SQL injection. An attacker can send a web request with parameters containing SQL injection attacks to trigger this vulnerability, potentially allowing exfiltration of the database, user credentials and in certain configuration, access the underlying operating system.Show less

Previous 1...750751752...1038 Next