← Back
CWE-89

20,633 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,633)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2010-1364
1Uiga
1Personal Portal
Apr 29, 2026
Apr 13, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Uiga Personal Portal, as downloaded on 20100301, allows remote attackers to execute arbitrary SQL commands via the id parameter in a photos action. NOTE: some of these details...Show more
SQL injection vulnerability in index.php in Uiga Personal Portal, as downloaded on 20100301, allows remote attackers to execute arbitrary SQL commands via the id parameter in a photos action. NOTE: some of these details are obtained from third party information.Show less
CVE-2010-1363
1Extremejoomla
1Com J Projects
Apr 29, 2026
Apr 13, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the JProjects (com_j-projects) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the project parameter in a projects action to index.php.
CVE-2010-1359
2Bluegate
Xt Commerce
2Direct Url
Xt Commerce
Apr 29, 2026
Apr 13, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in bluegate_seo.inc.php in the Direct URL module for xt:Commerce, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the coID parameter. NOTE: th...Show more
SQL injection vulnerability in bluegate_seo.inc.php in the Direct URL module for xt:Commerce, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the coID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2010-1350
1Joomlaprojects
1Com Jp Jobs
Apr 29, 2026
Apr 12, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the JP Jobs (com_jp_jobs) component 1.4.1 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action to index.php.
CVE-2010-1346
1Ribafs
1Mini Cms Ribafs
Apr 29, 2026
Apr 9, 2010
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: some of these details ar...Show more
SQL injection vulnerability in admin/login.php in Mini CMS RibaFS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2010-1344
1Cookex
1Com Ckforms
Apr 29, 2026
Apr 9, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the Cookex Agency CKForms (com_ckforms) component 1.3.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the fid parameter in a detail action to index.php.
CVE-2010-1343
1Bjsintay
1Sitex
Apr 29, 2026
Apr 9, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in photo.php in SiteX 0.7.4 beta allows remote attackers to execute arbitrary SQL commands via the albumid parameter.
CVE-2010-1341
1Systemsoftware
1Community Black Forum
Apr 29, 2026
Apr 9, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Systemsoftware Community Black Forum allows remote attackers to execute arbitrary SQL commands via the s_flaeche parameter.
CVE-2010-1338
1Robertotto
1Teamsite Hack Plugin
Apr 29, 2026
Apr 9, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in ts_other.php in the Teamsite Hack plugin 3.0 and earlier for WoltLab Burning Board allows remote attackers to execute arbitrary SQL commands via the userid parameter in a modboard action.
CVE-2010-1336
1Invohost
1Invohost
Apr 29, 2026
Apr 9, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in INVOhost 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) newlanguage parameters to site.php, (3) search parameter to manuals.php, and (4) unsp...Show more
Multiple SQL injection vulnerabilities in INVOhost 3.4 allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) newlanguage parameters to site.php, (3) search parameter to manuals.php, and (4) unspecified vectors to faq.php. NOTE: some of these details are obtained from third party information.Show less
CVE-2010-1331
1Heartlogic
1Hl Sitemanager
Apr 29, 2026
Apr 9, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Heartlogic HL-SiteManager allows remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2010-1301
1Merethis
1Centreon
Apr 29, 2026
Apr 7, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_id parameter.
CVE-2010-1300
1Yamamah
1Yamamah
Apr 29, 2026
Apr 7, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Yamamah (aka Dove Photo Album) 1.00 allows remote attackers to execute arbitrary SQL commands via the calbums parameter.
CVE-2010-0400
1Mahara
1Mahara
Apr 29, 2026
Apr 7, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in lib/user.php in mahara 1.0.4 allows remote attackers to execute arbitrary SQL commands via a username.
CVE-2010-1277
1Zabbix
1Zabbix
Apr 29, 2026
Apr 6, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the user.authenticate method in the API in Zabbix 1.8 before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the user parameter in JSON data to api_jsonrpc.php.
CVE-2010-1271
1Smart Plugs
1Smartplugs
Apr 29, 2026
Apr 6, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in showplugs.php in smartplugs 1.3 allows remote attackers to execute arbitrary SQL commands via the domain parameter.
CVE-2010-1270
1Phpscripte24
1Multi Suktions Komplett System
Apr 29, 2026
Apr 6, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in auktion.php in Multi Auktions Komplett System 2 allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.
CVE-2010-1269
1Phpscripte24
1Niedrig Gebote Pro Auktions System Ii
Apr 29, 2026
Apr 6, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in auktion.php in phpscripte24 Niedrig Gebote Pro Auktions System II allows remote attackers to execute arbitrary SQL commands via the id_auk parameter.
CVE-2010-1265
1Ekith
1Com Dcs Flashgames
Apr 29, 2026
Apr 6, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Adam Corley dcsFlashGames (com_dcs_flashgames) allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
CVE-2010-1134
1Tiki
1Tikiwiki Cms/groupware
Apr 29, 2026
Mar 27, 2010
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the _find function in searchlib.php in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to execute arbitrary SQL commands via the $searchDate variable.