Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,640)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2011-1562 1Ecava 1Integraxor Apr 29, 2026 Apr 5, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Ecava IntegraXor HMI before n 3.60 (Build 4032) allows remote attackers to bypass authentication and execute arbitrary SQL statements via unspecified vectors related to a crafted POST request. NOTE: some sources have rep...Show more Ecava IntegraXor HMI before n 3.60 (Build 4032) allows remote attackers to bypass authentication and execute arbitrary SQL statements via unspecified vectors related to a crafted POST request. NOTE: some sources have reported this issue as SQL injection, but this might not be accurate.Show less
CVE-2011-1557 1Icloudcenter 1Icjobsite Apr 29, 2026 Apr 4, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in ICloudCenter ICJobSite 1.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter to an unspecified component, a different vulnerability than CVE-2011-1546. NOTE:...Show more SQL injection vulnerability in ICloudCenter ICJobSite 1.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter to an unspecified component, a different vulnerability than CVE-2011-1546. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2011-1556 1Aphpkb 1Aphpkb Apr 29, 2026 Apr 4, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in plugins/pdfClasses/pdfgen.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.4 allows remote attackers to execute arbitrary SQL commands via the pdfa parameter.
CVE-2011-1555 1Aphpkb 1Aphpkb Apr 29, 2026 Apr 4, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in saa.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.3 and earlier allows remote attackers to execute arbitrary SQL commands via the aid parameter, a different vulnerability than CVE-2011-1546...Show more SQL injection vulnerability in saa.php in Andy's PHP Knowledgebase (Aphpkb) 0.95.3 and earlier allows remote attackers to execute arbitrary SQL commands via the aid parameter, a different vulnerability than CVE-2011-1546. NOTE: some of these details are obtained from third party information.Show less
CVE-2011-1546 1Aphpkb 1Aphpkb Apr 29, 2026 Apr 4, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.3 allow remote attackers to execute arbitrary SQL commands via the s parameter to (1) a_viewusers.php or (2) keysearch.php; and allo...Show more Multiple SQL injection vulnerabilities in Andy's PHP Knowledgebase (Aphpkb) before 0.95.3 allow remote attackers to execute arbitrary SQL commands via the s parameter to (1) a_viewusers.php or (2) keysearch.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the (3) id or (4) start parameter to pending.php, or the (5) aid parameter to a_authordetails.php. NOTE: some of these details are obtained from third party information.Show less
CVE-2010-4776 1Preprojects 1Pre Online Tests Generator Apr 29, 2026 Mar 23, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in takefreestart.php in PreProjects Pre Online Tests Generator Pro allows remote attackers to execute arbitrary SQL commands via the tid2 parameter.
CVE-2010-4774 1Auracms 1Auracms Apr 29, 2026 Mar 23, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in pdf.php in AuraCMS 1.62 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-4804 and CVE-2007-4171.
CVE-2010-4771 1.matteoiammarrone 1S Cms Apr 29, 2026 Mar 23, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability to viewforum.php in S-CMS 2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2010-4770 1Commodityrentals 1Dvd Rentals Script Apr 29, 2026 Mar 23, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in index.php in CommodityRentals DVD Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action.
CVE-2011-0432 1Simon Pamies 1Pywebdav Apr 29, 2026 Mar 14, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) us...Show more Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument. NOTE: some of these details are obtained from third party information.Show less
CVE-2011-1343 1Ibm 1Tivoli Netcool/omnibus Apr 29, 2026 Mar 9, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the Web GUI in IBM Tivoli Netcool/OMNIbus before 7.3.0.4 allows remote attackers to execute arbitrary SQL commands via "dynamic SQL parameters."
CVE-2011-0434 1Gplhost 1Domain Technologie Control Apr 29, 2026 Mar 7, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in Domain Technologie Control (DTC) before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to (1) admin/bw_per_month.php or (2) client/bw_per_m...Show more Multiple SQL injection vulnerabilities in Domain Technologie Control (DTC) before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to (1) admin/bw_per_month.php or (2) client/bw_per_month.php.Show less
CVE-2010-4752 1Lightneasy 1Lightneasy Apr 29, 2026 Mar 1, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter, a different vector than CVE-2008-659...Show more SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the page parameter, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2010-4751 1Lightneasy 1Lightneasy Apr 29, 2026 Mar 1, 2011 N/A· v4 N/A· v3 6.0 MEDIUM· v2 SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the id parameter in an edituser action, a diff...Show more SQL injection vulnerability in LightNEasy.php in LightNEasy 3.2.1, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the id parameter in an edituser action, a different vector than CVE-2008-6593, CVE-2010-3484, and CVE-2010-3485.Show less
CVE-2011-1100 1Pixelpost 1Pixelpost Apr 29, 2026 Feb 25, 2011 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) findfid, (2) id, (3) selectfcat, (4) selectfmon, or (5) selectft...Show more Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) findfid, (2) id, (3) selectfcat, (4) selectfmon, or (5) selectftag parameter in an images action.Show less
CVE-2011-1064 1Qibosoft 1Qi Bo Cms Apr 29, 2026 Feb 23, 2011 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in member/list.php in qibosoft Qi Bo CMS 7 allows remote attackers to execute arbitrary SQL commands via the aidDB[] parameter.
CVE-2011-1061 1Webmastersite 1Wsn Guest Apr 29, 2026 Feb 23, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in memberlist.php in WSN Guest 1.24 allows remote attackers to execute arbitrary SQL commands via the time parameter.
CVE-2011-1060 1Webmastersite 1Wsn Guest Apr 29, 2026 Feb 23, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the member function in classes/member.php in WSN Guest 1.24 allows remote attackers to execute arbitrary SQL commands via the wsnuser cookie to index.php.
CVE-2011-1055 1Lingxia273 1Lingxia I.c.e Cms Apr 29, 2026 Feb 21, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in api/ice_media.cfc in Lingxia I.C.E CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the session.user_id parameter to media.cfm.
CVE-2011-1048 1Mihantools 1Mihantools Apr 29, 2026 Feb 21, 2011 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in product.php in MihanTools 1.33 allows remote attackers to execute arbitrary SQL commands via the id parameter.

Previous 1...880881882...1032 Next