Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,750)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-13375 1Dlink 1Central Wifimanager Jun 17, 2026 Jul 6, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does not need any authentica...Show more A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay/passcodeAuth parameter passcode. The vulnerability does not need any authentication.Show less
CVE-2019-13373 1Dlink 1Central Wifimanager Jun 17, 2026 Jul 6, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php paramete...Show more An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL statements can be executed in the database via the /web/Public/Conn.php parameter dbSQL.Show less
CVE-2019-13292 1Weberp 1Weberp Jun 17, 2026 Jul 4, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no san...Show more A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is decoded, it is deserialized. Then, this deserialized data goes directly into a SQL query, with no sanitizing checks.Show less
CVE-2019-13275 1Veronalabs 1Wp Statistics Jun 17, 2026 Jul 4, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated bli...Show more An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL Injection.Show less
CVE-2019-12850 1Jetbrains 1Youtrack Jun 17, 2026 Jul 3, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.
CVE-2019-12570 1Xpertsol 1Server Status By Hostname/ip Jun 17, 2026 Jul 3, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters.
CVE-2018-12250 1Elitecms 1Elite Cms Nov 21, 2024 Jul 3, 2019 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in Elite CMS Pro 2.01. In /admin/add_sidebar.php, the ?page= parameter is vulnerable to SQL injection.
CVE-2017-18346 1Web Gooroo 1Cms Web Gooroo Nov 21, 2024 Jul 3, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows remote attackers to execute arbitrary SQL commands via the wbg_login parameter.
CVE-2019-13086 1Cszcms 1Csz Cms Jun 17, 2026 Jun 30, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter.
CVE-2019-11821 1Synology 1Photo Station Jun 17, 2026 Jun 30, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in synophoto_csPhotoDB.php in Synology Photo Station before 6.8.11-3489 and before 6.3-2977 allows remote attackers to execute arbitrary SQL command via the type parameter.
CVE-2019-9846 1Rockoa 1Rockoa Jun 17, 2026 Jun 28, 2019 N/A· v4 8.8 HIGH· v3 4.0 MEDIUM· v2 RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka...Show more RockOA 1.8.7 allows remote attackers to obtain sensitive information because the webmain/webmainAction.php publictreestore method constructs a SQL WHERE clause unsafely by using the pidfields and idfields parameters, aka background SQL injection.Show less
CVE-2019-9039 1Couchbase 1Sync Gateway Jun 17, 2026 Jun 26, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the paramete...Show more In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additional N1QL statements and extract sensitive data or call arbitrary N1QL functions through the parameters "startkey" and "endkey" on the "_all_docs" endpoint. By issuing nested queries with CPU-intensive operations they may have been able to cause increased resource usage and denial of service conditions. The _all_docs endpoint is not required for Couchbase Mobile replication and external access to this REST endpoint has been blocked to mitigate this issue. This issue has been fixed in versions 2.5.0 and 2.1.3.Show less
CVE-2019-4224 1Ibm 1Pureapplication System Jun 17, 2026 Jun 26, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information...Show more IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 159240.Show less
CVE-2019-12960 1Livezilla 1Livezilla Jun 17, 2026 Jun 25, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_dt_s_d.
CVE-2019-12939 1Livezilla 1Livezilla Jun 17, 2026 Jun 24, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.
CVE-2018-15868 1Chronoscan 1Chronoscan Nov 21, 2024 Jun 21, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arbitrary SQL commands via the wcr_machineid cookie.
CVE-2018-16116 1Sophos 1Sfos Nov 21, 2024 Jun 20, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQL commands via the "username" GET parameter.
CVE-2018-15892 1Freepbx 1Disa Nov 21, 2024 Jun 20, 2019 N/A· v4 4.3 MEDIUM· v3 6.0 MEDIUM· v2 FreePBX 13 and 14 has SQL Injection in the DISA module via the hangup variable on the /admin/config.php?display=disa&view=form page.
CVE-2018-16251 1Creatiwity 1Witycms Nov 21, 2024 Jun 20, 2019 N/A· v4 4.3 MEDIUM· v3 4.0 MEDIUM· v2 A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe...Show more A "search for user discovery" injection issue exists in Creatiwity wityCMS 0.6.2 via the "Utilisateur" menu. No input parameters are filtered, e.g., the /admin/user/users Nickname, email, firstname, lastname, and groupe parameters.Show less
CVE-2018-17388 1Ranksol 1Twilio Web To Fax Machine System Nov 21, 2024 Jun 19, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL Injection exists in Twilio WEB To Fax Machine System 1.0 via the email or password parameter to login_check.php, or the id parameter to add_email.php or edit_content.php.

Previous 1...763764765...1038 Next