Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,745)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-10916 1Siemens 4Simatic Pcs 7 Simatic WinccSimatic Wincc (tia Portal)+1 more Jun 17, 2026 May 14, 2019 N/A· v4 8.8 HIGH· v3 9.0 HIGH· v2 A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11...Show more A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 (All versions < V8.1 with WinCC V7.3 Upd 19), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1 with WinCC V7.4 SP1 Upd11), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP2 with WinCC V7.4 SP1 Upd11), SIMATIC WinCC (TIA Portal) V13 (All versions), SIMATIC WinCC (TIA Portal) V14 (All versions < V14 SP1 Upd 9), SIMATIC WinCC (TIA Portal) V15 (All versions < V15.1 Upd 3), SIMATIC WinCC Runtime Professional V13 (All versions), SIMATIC WinCC Runtime Professional V14 (All versions < V14.1 Upd 8), SIMATIC WinCC Runtime Professional V15 (All versions < V15.1 Upd 3), SIMATIC WinCC V7.2 and earlier (All versions), SIMATIC WinCC V7.3 (All versions < V7.3 Upd 19), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 11), SIMATIC WinCC V7.5 (All versions < V7.5 Upd 3). An attacker with access to the project file could run arbitrary system commands with the privileges of the local database server. The vulnerability could be exploited by an attacker with access to the project file. The vulnerability does impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication no public exploitation of this security vulnerability was known.Show less
CVE-2019-8923 1Apachefriends 1Xampp Jun 17, 2026 May 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 XAMPP through 5.6.8 and previous allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discontinued.
CVE-2018-18800 1Tubigan 1Welcome To Our Resort Nov 21, 2024 May 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php.
CVE-2018-16137 1Ipbrick 1Ipbrick Os Nov 21, 2024 May 13, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections.
CVE-2019-11600 1Openproject 1Openproject Jun 17, 2026 May 13, 2019 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject...Show more A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.Show less
CVE-2018-12295 1Seagate 1Nas Os Nov 21, 2024 May 13, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter.
CVE-2017-12761 1Webfile Explorer Project 1Webfile Explorer Nov 21, 2024 May 9, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download (remote). The component is: $file = $_GET['id'] in download.php. The attack vector is: http://...Show more http://codecanyon.net/user/Endober WebFile Explorer 1.0 is affected by: SQL Injection. The impact is: Arbitrary File Download (remote). The component is: $file = $_GET['id'] in download.php. The attack vector is: http://speicher.example.com/envato/codecanyon/demo/web-file-explorer/download.php?id=WebExplorer/../config.php.Show less
CVE-2017-12760 1Ynetinteractive 1Mobiketa Nov 21, 2024 May 9, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Ynet Interactive - http://demo.ynetinteractive.com/mobiketa/ Mobiketa 4.0 is affected by: SQL Injection. The impact is: Code execution (remote).
CVE-2017-12759 1Ynetinteractive 1Soa School Management Nov 21, 2024 May 9, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Ynet Interactive - http://demo.ynetinteractive.com/soa/ SOA School Management 3.0 is affected by: SQL Injection. The impact is: Code execution (remote).
CVE-2017-12758 1Joomlaextensions 1Component Appointment Nov 21, 2024 May 9, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 https://www.joomlaextensions.co.in/ Joomla! Component Appointment 1.1 is affected by: SQL Injection. The impact is: Code execution (remote). The component is: com_appointment component.
CVE-2017-12757 1Ambittechnologies 12Itech B2b Script Itech Business Networking ScriptItech Caregiver Script+9 more Nov 21, 2024 May 9, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Certain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business Networking Script 8.26i and Tech Caregiver Script 2.71i and Tech Classifieds Script 7.41i...Show more Certain Ambit Technologies Pvt. Ltd products are affected by: SQL Injection. This affects iTech B2B Script 4.42i and Tech Business Networking Script 8.26i and Tech Caregiver Script 2.71i and Tech Classifieds Script 7.41i and Tech Dating Script 3.40i and Tech Freelancer Script 5.27i and Tech Image Sharing Script 4.13i and Tech Job Script 9.27i and Tech Movie Script 7.51i and Tech Multi Vendor Script 6.63i and Tech Social Networking Script 3.08i and Tech Travel Script 9.49. The impact is: Code execution (remote).Show less
CVE-2019-3797 1Pivotal Software 1Spring Data Java Persistence Api Jun 17, 2026 May 6, 2019 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated...Show more This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.Show less
CVE-2019-11678 1Zohocorp 1Manageengine Firewall Analyzer Jun 17, 2026 May 2, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The "default reports" feature in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123218 is vulnerable to SQL Injection.
CVE-2019-11625 1Doorgets 1Doorgets Cms Jun 17, 2026 Apr 30, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php. A remote background administrator privilege user (or a user with permission to manage emailing) could exploit the vulnera...Show more doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/emailingRequest.php. A remote background administrator privilege user (or a user with permission to manage emailing) could exploit the vulnerability to obtain database sensitive information.Show less
CVE-2019-11623 1Doorgets 1Doorgets Cms Jun 17, 2026 Apr 30, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user (or a user with permission to manage configurat...Show more doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=siteweb. A remote background administrator privilege user (or a user with permission to manage configuration siteweb) could exploit the vulnerability to obtain database sensitive information.Show less
CVE-2019-11622 1Doorgets 1Doorgets Cms Jun 17, 2026 Apr 30, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit...Show more doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_edit_titre.Show less
CVE-2019-11621 1Doorgets 1Doorgets Cms Jun 17, 2026 Apr 30, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user (or a user with permission to manage network co...Show more doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=network. A remote background administrator privilege user (or a user with permission to manage network configuration) could exploit the vulnerability to obtain database sensitive information.Show less
CVE-2019-11620 1Doorgets 1Doorgets Cms Jun 17, 2026 Apr 30, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit...Show more doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/modulecategoryRequest.php. A remote background administrator privilege user (or a user with permission to manage modulecategory) could exploit the vulnerability to obtain database sensitive information via modulecategory_add_titre.Show less
CVE-2019-11619 1Doorgets 1Doorgets Cms Jun 17, 2026 Apr 30, 2019 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics. A remote background administrator privilege user (or a user with permission to manage configur...Show more doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/requests/user/configurationRequest.php when action=analytics. A remote background administrator privilege user (or a user with permission to manage configuration analytics) could exploit the vulnerability to obtain database sensitive information.Show less
CVE-2019-11614 1Doorgets 1Doorgets Cms Jun 17, 2026 Apr 30, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 doorGets 7.0 has a SQL injection vulnerability in /doorgets/app/views/ajax/commentView.php. A remote unauthorized attacker could exploit the vulnerability to obtain database sensitive information.

Previous 1...767768769...1038 Next