← Back
CWE-89

20,621 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,621)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-3319
1Dimofinf
1Dawaween
Apr 23, 2026
Sep 23, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 allows remote attackers to execute arbitrary SQL commands via the id parameter in a sec list action, a different vector than CVE-2006-1018.
CVE-2009-3316
1Jforjoomla
1Com Jreservation
Apr 23, 2026
Sep 23, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the JReservation (com_jreservation) component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a propertycpanel action to index.php...Show more
SQL injection vulnerability in the JReservation (com_jreservation) component 1.0 and 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the pid parameter in a propertycpanel action to index.php.Show less
CVE-2009-3315
1Nelogic
1Nephp Publisher
Apr 23, 2026
Sep 23, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin/index.php in NeLogic Nephp Publisher Enterprise 3.5.9 and 4.5 allows remote attackers to execute arbitrary SQL commands via the Username field.
CVE-2009-3314
1Eliteladders
1Elite Gaming Ladders
Apr 23, 2026
Sep 23, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in ladders.php in Elite Gaming Ladders 3.2 allows remote attackers to execute arbitrary SQL commands via the platform parameter.
CVE-2009-3313
1Fmyclone
1Fmyclone
Apr 23, 2026
Sep 23, 2009
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the comp parameter to (1) index.php and (2) editComments.php, and (3) allow remote authenticated adminis...Show more
Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote attackers to execute arbitrary SQL commands via the comp parameter to (1) index.php and (2) editComments.php, and (3) allow remote authenticated administrators to execute arbitrary SQL commands via the id parameter in a comment action to edit.php.Show less
CVE-2009-3310
1Shalwan
1Zainu
Apr 23, 2026
Sep 23, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Zainu 1.0 allows remote attackers to execute arbitrary SQL commands via the album_id parameter in an AlbumSongs action.
CVE-2009-3309
1Cfshopkart
1Cf Shopkart
Apr 23, 2026
Sep 23, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.cfm in CF ShopKart 5.4 beta allows remote attackers to execute arbitrary SQL commands via the itemid parameter in a ViewDetails action, a different vector than CVE-2008-6320.
CVE-2009-3308
1Fanupdate
1Fanupdate
Apr 23, 2026
Sep 23, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in show-cat.php in FanUpdate 2.2.1 allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
CVE-2009-3259
1Thomas Cuchta
1Rash
Apr 23, 2026
Sep 18, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in RASH Quote Management System (RQMS) 1.2.2 allow remote attackers to execute arbitrary SQL commands via (1) the search parameter in a search action, (2) the quote parameter in a q...Show more
Multiple SQL injection vulnerabilities in RASH Quote Management System (RQMS) 1.2.2 allow remote attackers to execute arbitrary SQL commands via (1) the search parameter in a search action, (2) the quote parameter in a quote addition, or (3) a User_Name cookie in unspecified administrative actions. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2009-3255
1Thomas Cuchta
1Rash
Apr 23, 2026
Sep 18, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in RASH Quote Management System (RQMS) 1.2.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action...Show more
SQL injection vulnerability in RASH Quote Management System (RQMS) 1.2.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the user parameter in an admin action to the default URI.Show less
CVE-2009-3252
1Dave Robinson
1Rockbandcms
Apr 23, 2026
Sep 18, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in news.php in Rock Band CMS 0.10 allow remote attackers to execute arbitrary SQL commands via the (1) year and (2) id parameters.
CVE-2009-3246
1Mybuxscript
1Pts Bux
Apr 23, 2026
Sep 18, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX allows remote attackers to execute arbitrary SQL commands via the id parameter in an spnews action to the default URI. NOTE: some of these details are obt...Show more
SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX allows remote attackers to execute arbitrary SQL commands via the id parameter in an spnews action to the default URI. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-3226
1Almondsoft
2Affiliate Network Classifieds
Almond Classifieds
Apr 23, 2026
Sep 16, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to execute arbitrary SQL commands via the replid parameter in a ma...Show more
SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-3224
1Classified Software
1Super Mod System
Apr 23, 2026
Sep 16, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Super Mod System, when using the 68 Classifieds 3.1 Core System, allows remote attackers to execute arbitrary SQL commands via the s parameter.
CVE-2009-3223
1Inoutscripts
1Inout Adserver
Apr 23, 2026
Sep 16, 2009
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in ppc-add-keywords.php in Inout Adserver allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
CVE-2009-3218
1The Ghost
1Ar Web Content Manager
Apr 23, 2026
Sep 16, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2009-3217
1Wiccle
1Iwiccle
Apr 23, 2026
Sep 16, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the admin module in iWiccle 1.01 allows remote attackers to execute arbitrary SQL commands via the member_id parameter in an edit_user action to index.php.
CVE-2009-3215
1Php Shop System
1Ixxo Cart
Apr 23, 2026
Sep 16, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.
CVE-2009-3212
1Dimofinf
1Infinity Script
Apr 23, 2026
Sep 16, 2009
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username field.
CVE-2009-3209
1Raizlabs
1Php Email Manager
Apr 23, 2026
Sep 16, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in remove.php in PHP eMail Manager 3.3.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.