← Back
CWE-89

20,708 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,708)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-10509
1Opencart
1Opencart
May 13, 2026
Aug 31, 2017
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL comman...Show more
SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0 allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php.Show less
CVE-2017-14076
1Nexusphp
1Nexusphp
May 13, 2026
Aug 31, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the id parameter to linksmanage.php in an editlink action.
CVE-2017-14069
1Nexusphp
1Nexusphp
May 13, 2026
Aug 31, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.
CVE-2017-12710
1Advantech
1Webaccess
May 13, 2026
Aug 30, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to...Show more
A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.Show less
CVE-2015-8334
1Huawei
1Vcn500 Firmware
May 13, 2026
Aug 29, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request.
CVE-2015-7517
1Labwebdesigns
1Double Opt In For Download
May 13, 2026
Aug 29, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or...Show more
Multiple SQL injection vulnerabilities in the Double Opt-In for Download plugin before 2.0.9 for WordPress allow remote attackers to execute arbitrary SQL commands via the ver parameter to (1) class-doifd-download.php or (2) class-doifd-landing-page.php in public/includes/.Show less
CVE-2017-10842
1Basercms
1Basercms
May 13, 2026
Aug 29, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2017-10839
1Seopanel
1Seo Panel
May 13, 2026
Aug 29, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
SQL injection vulnerability in the SEO Panel prior to version 3.11.0 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-9558
1Smartcms
1Smartcms
May 13, 2026
Aug 28, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in SmartCMS v.2.
CVE-2015-8355
1Orion Soft
1Bitrix
May 13, 2026
Aug 24, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) order or (2) "by" parameter to admin/orion...Show more
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the (1) order or (2) "by" parameter to admin/orion.extfeedbackform_efbf_forms.php.Show less
CVE-2017-13669
1Nexusphp
1Nexusphp
May 13, 2026
Aug 24, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the setanswered parameter to staffbox.php.
CVE-2017-12679
1Nexusphp
1Nexusphp
May 13, 2026
Aug 24, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delcheater parameter to cheaterbox.php.
CVE-2017-13137
1Formcrafts
1Formcraft
May 13, 2026
Aug 23, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php.
CVE-2017-12981
1Nexusphp
1Nexusphp
May 13, 2026
Aug 21, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
NexusPHP 1.5.beta5.20120707 has SQL Injection in forummanage.php via the sort parameter in an addforum action.
CVE-2017-12977
110web
1Photo Gallery
May 13, 2026
Aug 21, 2017
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGC...Show more
The Web-Dorado "Photo Gallery by WD - Responsive Photo Gallery" plugin before 1.3.51 for WordPress has a SQL injection vulnerability related to bwg_edit_tag() in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. It is exploitable by administrators via the tag_id parameter.Show less
CVE-2017-12949
1Podlove
1Podlove Podcast Publisher
May 13, 2026
Aug 18, 2017
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
lib\modules\contributors\contributor_list_table.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF.
CVE-2017-12947
1Easymodal Project
1Easy Modal
May 13, 2026
Aug 18, 2017
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in an untrash action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
CVE-2017-12946
1Easymodal Project
1Easy Modal
May 13, 2026
Aug 18, 2017
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators.
CVE-2017-12776
1Nexusphp Project
1Nexusphp
May 13, 2026
Aug 18, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in reports.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the delreport parameter.
CVE-2017-12910
1Nexusphp Project
1Nexusphp
May 13, 2026
Aug 17, 2017
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in massmail.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the or parameter.