← Back
CWE-89

20,643 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,643)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-1067
1Mg12
1Wp Recentcomments
Apr 29, 2026
Feb 14, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance o...Show more
SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2012-1063
1Manageengine
1Applications Manager
Apr 29, 2026
Feb 14, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter...Show more
Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do.Show less
CVE-2012-1061
1Gforgegroup
1Gforge
Apr 29, 2026
Feb 14, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in GForge Advanced Server 6.0.0 and other versions before 6.0.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-1029
1Tubeace
1Tube Ace
Apr 29, 2026
Feb 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in mobile/search/index.php in Tube Ace (Adult PHP Tube Script) 1.6 allows remote attackers to execute arbitrary SQL commands via the q parameter. NOTE: some of these details are obtained from...Show more
SQL injection vulnerability in mobile/search/index.php in Tube Ace (Adult PHP Tube Script) 1.6 allows remote attackers to execute arbitrary SQL commands via the q parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2012-1026
1Johannes Ekberg
1Xray Cms
Apr 29, 2026
Feb 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
CVE-2012-1022
14homepages
14images
Apr 29, 2026
Feb 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands via the cat_parent_id parameter in an addcat action.
CVE-2012-1017
1Secureideas
1Base
Apr 29, 2026
Feb 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary SQL commands via the (1) ip_addr[0][1], (2) ip_addr[0][2], or (3)...Show more
Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary SQL commands via the (1) ip_addr[0][1], (2) ip_addr[0][2], or (3) ip_addr[0][9] parameters.Show less
CVE-2011-5076
1Hudong
1Hdwiki
Apr 29, 2026
Feb 8, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php. NOTE: some of these detail...Show more
SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php. NOTE: some of these details are obtained from third party information.Show less
CVE-2012-0983
1Scriptsez
1Ez Album
Apr 29, 2026
Feb 2, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Scriptsez.net Ez Album allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php.
CVE-2012-0982
1Vastal
1Agent Zone
Apr 29, 2026
Feb 2, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the price_from parameter.
CVE-2012-0980
1Phux
1Download Manager
Apr 29, 2026
Feb 2, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter.
CVE-2011-5072
1Sitracker
1Support Incident Tracker
Apr 29, 2026
Jan 29, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to...Show more
Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to edit_escalation_path.php; (4) unlock, (5) lock, or (6) selected parameter to holding_queue.php; inc parameter in a report action to (7) report_customers.php or (8) report_incidents_by_site.php; (9) start parameter to search.php; or (10) sites parameter to transactions.php.Show less
CVE-2012-0935
1Aryadad
1Aryadad Cms
Apr 29, 2026
Jan 29, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Default.aspx in Aryadad CMS allows remote attackers to execute arbitrary SQL commands via the PageID parameter.
CVE-2011-5071
1Sitracker
1Support Incident Tracker
Apr 29, 2026
Jan 29, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.64 allow remote attackers to execute arbitrary SQL commands via the (1) exc[] parameter to report_marketing.php, (2) selected[] param...Show more
Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.64 allow remote attackers to execute arbitrary SQL commands via the (1) exc[] parameter to report_marketing.php, (2) selected[] parameter to tasks.php, (3) sites[] parameter to billable_incidents.php, or (4) search_string parameter to search.php. NOTE: some of these details are obtained from third party information.Show less
CVE-2011-3831
1Sitracker
1Support Incident Tracker
Apr 29, 2026
Jan 29, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name.
CVE-2012-0913
1Icloudcenter
1Ictimeattendance
Apr 29, 2026
Jan 24, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in checklogin.aspx in ICloudCenter ICTimeAttendance 1.0 allows remote attackers to execute arbitrary SQL commands via the passw parameter. NOTE: Some of these details are obtained from third...Show more
SQL injection vulnerability in checklogin.aspx in ICloudCenter ICTimeAttendance 1.0 allows remote attackers to execute arbitrary SQL commands via the passw parameter. NOTE: Some of these details are obtained from third party information.Show less
CVE-2012-0069
1Batavi
1Batavi
Apr 29, 2026
Jan 24, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in ajax.php in Batavi before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the boxToReload parameter.
CVE-2012-0912
1Stone Ware
1Webnetwork
Apr 29, 2026
Jan 24, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2012-0906
1Mystarmedia
1Moviebase Addon
Apr 29, 2026
Jan 20, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the Moviebase addon for deV!L'z Clanportal (DZCP) 1.5.5 allows remote attackers to execute arbitrary SQL commands via the id parameter in a showkat action to index.php.
CVE-2012-0905
1Dev!l's
1Dev!l'z Clanportal Gamebase Addon
Apr 29, 2026
Jan 20, 2012
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in deV!L'z Clanportal (DZCP) Gamebase addon allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a detail action to index.php.