Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (21,539)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-16765 - - Oct 24, 2026 Jul 23, 2026 5.5 MEDIUM· v4 7.3 HIGH· v3 7.5 HIGH· v2 A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lea...Show more A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.Show less
CVE-2026-63359 1Equifax 1Victim Information Notification Exchange Oct 24, 2026 Jul 23, 2026 9.3 CRITICAL· v4 9.8 CRITICAL· v3 N/A· v2 The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials,...Show more The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information from the database.Show less
CVE-2026-65761 - - Oct 24, 2026 Jul 23, 2026 9.3 CRITICAL· v4 N/A· v3 N/A· v2 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read...Show more Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.Show less
CVE-2026-65532 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 7.6 HIGH· v3 N/A· v2 Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.
CVE-2026-65526 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.
CVE-2026-65494 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.
CVE-2026-65462 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 7.6 HIGH· v3 N/A· v2 Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.
CVE-2026-65454 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.
CVE-2026-65451 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Contributor SQL Injection in MapSVG <= 8.14.0 versions.
CVE-2026-65450 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Contributor SQL Injection in MapSVG <= 8.14.0 versions.
CVE-2026-61950 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
CVE-2026-61949 - - Jul 23, 2026 Jul 23, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in Bookly <= 27.7 versions.
CVE-2026-61948 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
CVE-2026-59526 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.
CVE-2026-59525 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.
CVE-2026-59514 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.
CVE-2026-25405 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Contributor SQL Injection in eRoom <= 1.7.1 versions.
CVE-2026-24552 - - Oct 24, 2026 Jul 23, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2...Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3.Show less
CVE-2026-15906 - - Jul 23, 2026 Jul 23, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on th...Show more The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.Show less
CVE-2026-15761 - - Jul 23, 2026 Jul 23, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the...Show more The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied.Show less

Previous 1...818283...1077 Next