Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,752)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-4483 1Ibm 2Emptoris Contract Management Emptoris Spend Analysis Jun 17, 2026 Aug 20, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the att...Show more IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164067.Show less
CVE-2019-4481 1Ibm 2Emptoris Contract Management Emptoris Spend Analysis Jun 17, 2026 Aug 20, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the att...Show more IBM Contract Management 10.1.0 through 10.1.3 and IBM Emptoris Spend Analysis 10.1.0 through 10.1.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 164064.Show less
CVE-2015-9330 1Soflyy 1Wp All Import Nov 21, 2024 Aug 20, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
CVE-2019-14430 1Youphptube 1Youphptube Jun 17, 2026 Aug 20, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.
CVE-2019-14937 1Vanderbilt 1Redcap Jun 17, 2026 Aug 17, 2019 N/A· v4 7.5 HIGH· v3 6.0 MEDIUM· v2 REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessioni...Show more REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the cal_id parameter, such as cal_id=55 and sleep(3) to Calendar/calendar_popup_ajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data.Show less
CVE-2015-9324 1Awesomemotive 1Easy Digital Downloads Feb 7, 2025 Aug 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The easy-digital-downloads plugin before 2.3.3 for WordPress has SQL injection.
CVE-2015-9323 1Duckdev 1404 To 301 Nov 21, 2024 Aug 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
CVE-2014-10376 1Themeist 1I Recommend This Nov 21, 2024 Aug 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The i-recommend-this plugin before 3.7.3 for WordPress has SQL injection.
CVE-2017-18548 1Datainterlock 1Note Press Nov 21, 2024 Aug 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The note-press plugin before 0.1.2 for WordPress has SQL injection.
CVE-2016-10904 1Olimometer Project 1Olimometer Nov 21, 2024 Aug 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The olimometer plugin before 2.57 for WordPress has SQL injection.
CVE-2015-9326 1Wpbusinessintelligence 1Wp Business Intelligence Nov 21, 2024 Aug 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
CVE-2015-9325 1Bestwebsoft 1Visitors Online Nov 21, 2024 Aug 16, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The visitors-online plugin before 0.4 for WordPress has SQL injection.
CVE-2019-15105 1Zohocorp 1Manageengine Applications Manager Jun 17, 2026 Aug 16, 2019 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can...Show more An issue was discovered in Zoho ManageEngine Application Manager through 14.2. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.Show less
CVE-2019-15104 1Zohocorp 1Manageengine Applications Manager Jun 17, 2026 Aug 16, 2019 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the...Show more An issue was discovered in Zoho ManageEngine OpManager through 12.4x. There is a SQL Injection vulnerability in jsp/NewThresholdConfiguration.jsp via the resourceid parameter. Therefore, a low-authority user can gain the authority of SYSTEM on the server. One can consequently upload a malicious file using the "Execute Program Action(s)" feature.Show less
CVE-2019-13578 1Givewp 1Givewp Jun 17, 2026 Aug 15, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the aff...Show more A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.Show less
CVE-2016-10888 1Tipsandtricks Hq 1All In One Wp Security & Firewall Nov 21, 2024 Aug 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.
CVE-2016-10887 1Tipsandtricks Hq 1All In One Wp Security & Firewall Nov 21, 2024 Aug 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.
CVE-2015-9310 1Tipsandtricks Hq 1All In One Wp Security & Firewall Nov 21, 2024 Aug 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues.
CVE-2019-15025 1Ninjaforms 1Ninjaforms Jun 17, 2026 Aug 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
CVE-2017-18514 1Simplerealtytheme 1Simple Login Log Nov 21, 2024 Aug 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The simple-login-log plugin before 1.1.2 for WordPress has SQL injection.

Previous 1...759760761...1038 Next