← Back
CWE-89

20,648 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,648)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2011-5213
1Browsercrm
1Browsercrm
Apr 29, 2026
Oct 25, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] parameter to index.php, (2) parent_id parameter to modules/Do...Show more
Multiple SQL injection vulnerabilities in BrowserCRM 5.100.01 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) login[username] parameter to index.php, (2) parent_id parameter to modules/Documents/version_list.php, or (3) contact_id parameter to modules/Documents/index.php.Show less
CVE-2012-5453
1Atutor
1Acontent
Apr 29, 2026
Oct 22, 2012
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in user/index_inline_editor_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists be...Show more
SQL injection vulnerability in user/index_inline_editor_submit.php in ATutor AContent 1.2-1 allows remote authenticated users to execute arbitrary SQL commands via the field parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-5167.Show less
CVE-2012-5167
1Atutor
1Acontent
Apr 29, 2026
Oct 22, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the (1) field parameter to course_category/index_inline_editor_submit.php or (2) user/in...Show more
Multiple SQL injection vulnerabilities in ATutor AContent before 1.2-1 allow remote attackers to execute arbitrary SQL commands via the (1) field parameter to course_category/index_inline_editor_submit.php or (2) user/index_inline_editor_submit.php; or (3) id parameter to user/user_password.php.Show less
CVE-2012-4990
1Openx
1Openx
Apr 29, 2026
Oct 22, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin/campaign-zone-link.php in OpenX 2.8.10 before revision 81823 allows remote attackers to execute arbitrary SQL commands via the ids[] parameter in a link action.
CVE-2012-4772
1Intelliants
1Subrion Cms
Apr 29, 2026
Oct 22, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in register/ in Subrion CMS before 2.2.3 allows remote attackers to execute arbitrary SQL commands via the plan_id parameter.
CVE-2012-4232
1Jcore
1Jcore
Apr 29, 2026
Oct 22, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie.
CVE-2011-5212
1Intelliants
1Subrion Cms
Apr 29, 2026
Oct 22, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the (1) user name or (2) password field.
CVE-2012-5350
1Wordpress
1Pay With Tweet
Apr 29, 2026
Oct 9, 2012
N/A· v4
N/A· v3
6.0 MEDIUM· v2
SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortc...Show more
SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortcode.Show less
CVE-2012-5348
1Wilson Steven
1Mangosweb Enhanced
Apr 29, 2026
Oct 9, 2012
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via the login parameter in a login action to index.php.
CVE-2012-5342
1Michau Enterprises Llc
1Commonsense Cms
Apr 29, 2026
Oct 9, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in SenseSites CommonSense CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) special.php, (2) article.php, or (3) cat2.php.
CVE-2012-5334
1Preprojects
1Pre Printing Press
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in product_desc.php in Pre Printing Press allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVE-2012-5333
1Preprojects
1Pre Printing Press
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in page.php in Pre Printing Press allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-5328
1Cartpauj
1Mingle Forum
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the (1) memberid or (...Show more
Multiple SQL injection vulnerabilities in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress might allow remote authenticated users to execute arbitrary SQL commands via the (1) memberid or (2) groupid parameters in a removemember action or (3) id parameter to fs-admin/fs-admin.php, or (4) edit_forum_id parameter in an edit_save_forum action to fs-admin/wpf-edit-forum-group.php.Show less
CVE-2012-5327
1Cartpauj
1Mingle Forum
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via th...Show more
Multiple SQL injection vulnerabilities in fs-admin/fs-admin.php in the Mingle Forum plugin 1.0.32.1 and other versions before 1.0.33 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) delete_usrgrp[] parameter in a delete_usergroups action, (2) usergroup parameter in an add_user_togroup action, or (3) add_forum_group_id parameter in an add_forum_submit action.Show less
CVE-2012-5317
1Bigware
1Bigware Shop
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in main_bigware_43.php in Bigware Shop before 2.1.5 allows remote attackers to execute arbitrary SQL commands via the lastname parameter in a process action.
CVE-2012-5313
1Snitz Communications
1Snitz Forums 2000
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in forum.asp in Snitz Forums 2000 allows remote attackers to execute arbitrary SQL commands via the TOPIC_ID parameter.
CVE-2012-5312
1Tribiq
1Tribiq Cms
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Tribiq CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVE-2012-5310
1Getshopped
1Wp E Commerce
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the WP e-Commerce plugin before 3.8.7.6 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2011-4638
1Spamtitan
1Webtitan
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in SpamTitan WebTitan before 3.60 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to login-x.php, and allow remote authenticated users to exe...Show more
Multiple SQL injection vulnerabilities in SpamTitan WebTitan before 3.60 allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to login-x.php, and allow remote authenticated users to execute arbitrary SQL commands via the (2) bldomain, (3) wldomain, or (4) temid parameter to urls-x.php.Show less
CVE-2010-5063
1Vwar
1Virtual War
Apr 29, 2026
Oct 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands via the ratearticleselect parameter.