← Back
CWE-89

20,645 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,645)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2006-7247
1Joomla
1Com Weblinks
Apr 29, 2026
Sep 6, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the Weblinks (com_weblinks) component for Joomla! and Mambo 1.0.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.
CVE-2012-4868
1Kunena
1Kunena
Apr 29, 2026
Sep 6, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in news.php in the Kunena component 1.7.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2012-2740
1Phplist
1Phplist
Apr 29, 2026
Sep 6, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.
CVE-2011-4448
1Wikkawiki
1Wikkawiki
Apr 29, 2026
Sep 5, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the default_comment_display parameter in an update action.
CVE-2012-2109
1Buddypress
1Buddypress
Apr 29, 2026
Sep 4, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activity_widget_filter action.
CVE-2012-4743
1Eos.pe
1Siche Search Module
Apr 29, 2026
Aug 31, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in ssearch.php in Siche search module 0.5 for Zeroboard allow remote attackers to execute arbitrary SQL commands via the (1) ss, (2) sm, (3) align, or (4) category parameters.
CVE-2011-4949
1Egroupware
2Egroupware
Egroupware Enterprise Line
Apr 29, 2026
Aug 31, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote atta...Show more
SQL injection vulnerability in phpgwapi/js/dhtmlxtree/samples/with_db/loaddetails.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to execute arbitrary SQL commands via the id parameter.Show less
CVE-2011-4946
1E107
1E107
Apr 29, 2026
Aug 31, 2012
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to execute arbitrary SQL commands via the user_field parameter.
CVE-2011-5145
1Obm
1Open Business Management
Apr 29, 2026
Aug 31, 2012
N/A· v4
N/A· v3
5.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sel_domain_id or (2) action paramete...Show more
Multiple SQL injection vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sel_domain_id or (2) action parameter to obm.php; (3) tf_user parameter in a search action to group/group_index.php; (4) tf_delegation, (5) tf_ip, (6) tf_name to host/host_index.php; or (7) lang, (8) theme, (9) cal_alert, (10) cal_first_hour, (11) cal_interval, (12) cal_last_hour, (13) commentorder, (14) csv_sep, (15) date, (16) date_upd, (17) debug_exe, (18) debug_id, (19) debug_param, (20) debug_sess, (21) debug_solr, (22) debug_sql, (23) dsrc, (24) menu, (25) rows, (26) sel_display_days, (27) timeformat, (28) timezone, or (29) todo parameter to settings/settings_index.php.Show less
CVE-2011-5140
1Diy Cms
1Blog
Apr 29, 2026
Aug 31, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to (a) tags.php, (b) list.php, (c) index.php, (d) main_index....Show more
Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to (a) tags.php, (b) list.php, (c) index.php, (d) main_index.php, (e) viewpost.php, (f) archive.php, (g) control/approve_comments.php, (h) control/approve_posts.php, and (i) control/viewcat.php; and the (2) month and (3) year parameters to archive.php.Show less
CVE-2011-5139
1Preprojects
1Business Cards Designer
Apr 29, 2026
Aug 31, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in page.php in Pre Studio Business Cards Designer allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2011-5137
1Tforum
1Tforum
Apr 29, 2026
Aug 31, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in tForum b0.915 allow remote attackers to execute arbitrary SQL commands via the (1) TopicID parameter to viewtopic.php, the (2) BoardID parameter to viewboard.php, or (3) CatID pa...Show more
Multiple SQL injection vulnerabilities in tForum b0.915 allow remote attackers to execute arbitrary SQL commands via the (1) TopicID parameter to viewtopic.php, the (2) BoardID parameter to viewboard.php, or (3) CatID parameter to viewcat.php.Show less
CVE-2011-5135
1Docebo
1Docebolms
Apr 29, 2026
Aug 30, 2012
N/A· v4
N/A· v3
6.0 MEDIUM· v2
Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow remote authenticated users with admin or teacher privileges to execut...Show more
Multiple SQL injection vulnerabilities in the save_connection function in lib/lib.iotask.php in the iotask module in DoceboLMS 4.0.4 and earlier allow remote authenticated users with admin or teacher privileges to execute arbitrary SQL commands via the (1) coursereportuiconfig[name] or (2) coursereportuiconfig[description] parameters to index.php.Show less
CVE-2012-4686
1Vbulletin
1Vbulletin
Apr 29, 2026
Aug 28, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in announcement.php in vBulletin 4.1.10 allows remote attackers to execute arbitrary SQL commands via the announcementid parameter.
CVE-2012-1934
1Sourcefabric
1Newscoop
Apr 29, 2026
Aug 27, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL commands via the f_country_code parameter.
CVE-2012-4673
1Thomas Hunter
1Neoinvoice
Apr 29, 2026
Aug 26, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sort_col variable in the list_items function, a di...Show more
SQL injection vulnerability in application/controllers/invoice.php in NeoInvoice might allow remote attackers to execute arbitrary SQL commands via vectors involving the sort_col variable in the list_items function, a different vulnerability than CVE-2012-3477.Show less
CVE-2012-3477
1Thomas Hunter
1Neoinvoice
Apr 29, 2026
Aug 26, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in signup_check.php in NeoInvoice allows remote attackers to execute arbitrary SQL commands via the value parameter in a username action.
CVE-2011-5116
1Setseed
1Setseed Cms
Apr 29, 2026
Aug 23, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in setseed-hub in SetSeed CMS 5.8.20, 5.11.2, and earlier allows remote attackers to execute arbitrary SQL commands via the loggedInUser cookie.
CVE-2011-5113
1Techdeluge
1Com Techfolio
Apr 29, 2026
Aug 23, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in frontend/models/techfoliodetail.php in Techfolio (com_techfolio) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVE-2011-5112
1Blueflyingfish
1Com Alameda
Apr 29, 2026
Aug 23, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Alameda (com_alameda) component before 1.0.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the storeid parameter to index.php.