Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,711)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-14600 1Pragyan Cms Project 1Pragyan Cms May 13, 2026 Sep 19, 2017 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injection in cms/admin.lib.php via $_GET['del_black'], resulting in Information Disclosure.
CVE-2017-14512 1Nexusphp Project 1Nexusphp May 13, 2026 Sep 17, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an editforum action, a different vulnerability than CVE-2017-12981.
CVE-2017-14508 1Sugarcrm 1Sugarcrm May 13, 2026 Sep 17, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could al...Show more An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker to modify the SQL database. Proper SQL escaping has been added to prevent such exploits.Show less
CVE-2017-1002028 1Angrybyte 1Gallery Transformation May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin wordpress-gallery-transformation v1.0, SQL injection is in ./wordpress-gallery-transformation/gallery.php via $jpic parameter being unsanitized before being passed into an SQL query.
CVE-2017-1002027 1Rayanehdownload 1Rk Responsive Contact Form May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin rk-responsive-contact-form v1.0, The variable $delid isn't sanitized before being passed into an SQL query in file ./rk-responsive-contact-form/include/rk_user_list.php.
CVE-2017-1002026 1Eventespresso 1Event Espresso May 13, 2026 Sep 14, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Vulnerability in wordpress plugin Event Expresso Free v3.1.37.11.L, The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
CVE-2017-1002025 1Add Edit Delete Listing For Member Module Project 1Add Edit Delete Listing For Member Module May 13, 2026 Sep 14, 2017 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 Vulnerability in wordpress plugin add-edit-delete-listing-for-member-module v1.0, The plugin author does not sanitize user supplied input via $act before passing it into an SQL statement.
CVE-2017-1002023 1Daisythemes 1Easy Team Manager May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin Easy Team Manager v1.3.2, The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php
CVE-2017-1002022 1Surveys Project 1Surveys May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin surveys v1.01.8, The code in questions.php does not sanitize the survey variable before placing it inside of an SQL query.
CVE-2017-1002021 1Surveys Project 1Surveys May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin surveys v1.01.8, The code in individual_responses.php does not sanitize the survey_id variable before placing it inside of an SQL query.
CVE-2017-1002020 1Surveys Project 1Surveys May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin surveys v1.01.8, The code in survey_form.php does not sanitize the action variable before placing it inside of an SQL query.
CVE-2017-1002019 1Eventr Project 1Eventr May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and event_form.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
CVE-2017-1002018 1Eventr Project 1Eventr May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin eventr v1.02.2, The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.
CVE-2017-1002015 1Anblik 1Image Gallery With Slideshow May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selectMulGallery parameter.
CVE-2017-1002014 1Anblik 1Image Gallery With Slideshow May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via gallery_name parameter.
CVE-2017-1002013 1Anblik 1Image Gallery With Slideshow May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_setting.php.
CVE-2017-1002012 1Anblik 1Image Gallery With Slideshow May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into a...Show more Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/admin_setting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement.Show less
CVE-2017-1002010 1Ontraport 1Membership Simplified May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId...Show more Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete_media function.Show less
CVE-2017-1002009 1Ontraport 1Membership Simplified May 13, 2026 Sep 14, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId...Show more Vulnerability in wordpress plugin Membership Simplified v1.58, The code in membership-simplified-for-oap-members-only/updateDB.php is vulnerable to blind SQL injection because it doesn't sanitize user input via recordId in the delete function.Show less
CVE-2017-1002005 1Dtracker Project 1Dtracker May 13, 2026 Sep 14, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contact_id variable before adding it to the end of an SQL query.

Previous 1...809810811...1036 Next