← Back
CWE-89

20,687 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,687)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-9283
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 11, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue.
CVE-2016-9282
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 11, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the search_string parameter.
CVE-2016-9272
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 11, 2016
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
CVE-2016-9242
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 7, 2016
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the (...Show more
Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) content_type or (2) subtype parameter.Show less
CVE-2016-9184
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 4, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a...Show more
In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure.Show less
CVE-2016-6453
1Cisco
1Identity Services Engine
May 6, 2026
Nov 3, 2016
N/A· v4
7.3 HIGH· v3
4.9 MEDIUM· v2
A vulnerability in the web framework code of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary SQL commands on the database. More Information: CSCva46542. Known Affec...Show more
A vulnerability in the web framework code of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary SQL commands on the database. More Information: CSCva46542. Known Affected Releases: 1.3(0.876).Show less
CVE-2016-9135
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 3, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure.
CVE-2016-9134
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 3, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure.
CVE-2016-7453
1Exponentcms
1Exponent Cms
May 6, 2026
Nov 3, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection.
CVE-2016-8582
1Alienvault
2Open Source Security Information And Event Management
Unified Security Management
May 6, 2026
Oct 28, 2016
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
CVE-2016-7919
1Moodle
1Moodle
May 6, 2026
Oct 28, 2016
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: t...Show more
Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields.Show less
CVE-2016-6443
1Cisco
2Evolved Programmable Network Manager
Prime Infrastructure
May 6, 2026
Oct 27, 2016
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of ar...Show more
A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability. More Information: CSCva27038, CSCva28335. Known Affected Releases: 3.1(0.128), 1.2(400), 2.0(1.0.34A).Show less
CVE-2016-1000122
1Huge It
1Slider
May 6, 2026
Oct 27, 2016
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
CVE-2016-1000120
1Huge It
1Catalog
May 6, 2026
Oct 27, 2016
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
CVE-2016-1000119
1Huge It
1Catalog
May 6, 2026
Oct 21, 2016
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
SQLi and XSS in Huge IT catalog extension v1.0.4 for Joomla
CVE-2016-1000118
1Huge It
1Slideshow
May 6, 2026
Oct 21, 2016
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
XSS & SQLi in HugeIT slideshow v1.0.4
CVE-2016-1000117
1Huge It
1Slideshow
May 6, 2026
Oct 21, 2016
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
XSS & SQLi in HugeIT slideshow v1.0.4
CVE-2016-1000116
1Huge It
1Portfolio Gallery Manager
May 6, 2026
Oct 21, 2016
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
CVE-2016-1000115
1Huge It
1Portfolio Gallery Manager
May 6, 2026
Oct 21, 2016
N/A· v4
7.2 HIGH· v3
6.5 MEDIUM· v2
Huge-IT Portfolio Gallery manager v1.1.0 SQL Injection and XSS
CVE-2016-0249
1Ibm
1Security Guardium
May 6, 2026
Oct 16, 2016
N/A· v4
8.6 HIGH· v3
7.5 HIGH· v2
SQL injection vulnerability in IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to execute arbitrary SQL commands via...Show more
SQL injection vulnerability in IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.Show less