← Back
CWE-89

20,665 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,665)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2014-4938
1Wp Rss Poster Plugin Project
1Wp Rss Poster
May 6, 2026
Jul 11, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the WP Rss Poster (wp-rss-poster) plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php.
CVE-2014-3992
1Dolibarr
1Dolibarr Erp/crm
May 6, 2026
Jul 11, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) entity parameter in an update action to user/fiche.php or (2) sortorder para...Show more
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) entity parameter in an update action to user/fiche.php or (2) sortorder parameter to user/group/index.php.Show less
CVE-2014-4852
1Thedigitalcraft
1Atomcms
May 6, 2026
Jul 10, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin/uploads.php in The Digital Craft AtomCMS, possibly 2.0, allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2014-4850
1Foecms
1Foecms
May 6, 2026
Jul 10, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in FoeCMS allows remote attackers to execute arbitrary SQL commands via the i parameter.
CVE-2014-4741
1Artifectx
1Xclassified
May 6, 2026
Jul 9, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in demo/ads.php in Artifectx xClassified 1.2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVE-2014-4194
1Aas9
1Zerocms
May 6, 2026
Jul 9, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in zero_transact_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter in a Submit Comment action.
CVE-2014-3483
1Rubyonrails
1Rails
May 6, 2026
Jul 7, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote a...Show more
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.Show less
CVE-2014-3482
1Rubyonrails
2Rails
Ruby On Rails
May 6, 2026
Jul 7, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to ex...Show more
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.Show less
CVE-2014-3857
1Kerio
1Control
May 6, 2026
Jul 3, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) x_16 or (2) x_1...Show more
Multiple SQL injection vulnerabilities in Kerio Control Statistics in Kerio Control (formerly WinRoute Firewall) before 8.3.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) x_16 or (2) x_17 parameter to print.php.Show less
CVE-2014-4649
1Piwigo
1Piwigo
May 6, 2026
Jun 28, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in the photo-edit subsystem in Piwigo 2.6.x and 2.7.x before 2.7.0beta2 allows remote authenticated administrators to execute arbitrary SQL commands via the associate[] field.
CVE-2013-6311
1Ibm
1Marketing Platform
May 6, 2026
Jun 28, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in IBM Marketing Platform 9.1 before FP2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-4644
1Cacti
1Superlinks
May 6, 2026
Jun 25, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in superlinks.php in the superlinks plugin 1.4-2 for Cacti allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2014-3810
1Boonex
1Dolphin
May 6, 2026
Jun 19, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in administration/profiles.php in BoonEx Dolphin 7.1.4 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the members[] parameter. NOTE: this can be...Show more
SQL injection vulnerability in administration/profiles.php in BoonEx Dolphin 7.1.4 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the members[] parameter. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-4333.Show less
CVE-2014-1651
1Symantec
1Web Gateway
May 6, 2026
Jun 18, 2014
N/A· v4
N/A· v3
5.8 MEDIUM· v2
SQL injection vulnerability in clientreport.php in the management console in Symantec Web Gateway (SWG) before 5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-1650
1Symantec
1Web Gateway
May 6, 2026
Jun 18, 2014
N/A· v4
N/A· v3
5.2 MEDIUM· v2
SQL injection vulnerability in user.php in the management console in Symantec Web Gateway (SWG) before 5.2.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-2949
1F5
1Arx Data Manager
May 6, 2026
Jun 18, 2014
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in the web service in F5 ARX Data Manager 3.0.0 through 3.1.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-4307
1Webtitan
1Webtitan
May 6, 2026
Jun 18, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in categories-x.php in WebTitan before 4.04 allows remote attackers to execute arbitrary SQL commands via the sortkey parameter.
CVE-2014-4305
1Nice
1Recording Express
May 6, 2026
Jun 18, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in NICE Recording eXpress (aka Cybertech eXpress) 6.5.7 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2014-2303
1Webedition
1Webedition Cms
May 6, 2026
Jun 13, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1)...Show more
Multiple SQL injection vulnerabilities in the file browser component (we_fs.php) in webEdition CMS before 6.2.7-s1.2 and 6.3.x through 6.3.8 before -s1 allow remote attackers to execute arbitrary SQL commands via the (1) table or (2) order parameter.Show less
CVE-2014-4034
1Aas9
1Zerocms
May 6, 2026
Jun 11, 2014
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in zero_view_article.php in ZeroCMS 1.0 allows remote attackers to execute arbitrary SQL commands via the article_id parameter.