Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,621)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-3208 1Prakashatma Mishra 1Phpfreebb Apr 23, 2026 Sep 16, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to permalink.php and (2) year parameter to index.php.
CVE-2009-3205 1Cbauthority 1Cbauthority Apr 23, 2026 Sep 16, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in main.php in CBAuthority allows remote attackers to execute arbitrary SQL commands via the id parameter in a view_product action.
CVE-2009-3203 1Ajsquare 1Aj Auction Pro Oopd Apr 23, 2026 Sep 16, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in store.php in AJ Auction Pro OOPD 2.x allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2009-3165 1Mozilla 1Bugzilla Apr 23, 2026 Sep 15, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified p...Show more SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.Show less
CVE-2009-3125 1Mozilla 1Bugzilla Apr 23, 2026 Sep 15, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitrary SQL commands via unspecified parameters.
CVE-2009-3193 1Uwix 1Com Digifolio Apr 23, 2026 Sep 15, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the DigiFolio (com_digifolio) component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
CVE-2009-3190 1Pad Site Scripts 1Pad Site Scripts Apr 23, 2026 Sep 15, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to list.php and (2) cat parameter to rss.php.
CVE-2009-3185 1Comsenz 1Crazy Star Plugin Apr 23, 2026 Sep 15, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in plugin.php in the Crazy Star plugin 2.0 for Discuz! allows remote authenticated users to execute arbitrary SQL commands via the fmid parameter in a view action.
CVE-2009-3184 1Grapari 1E Gold Game Series Pirates Of The Caribbean Apr 23, 2026 Sep 15, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in index.php in Pirates of The Caribbean in the E-Gold Game Series allow remote attackers to execute arbitrary SQL commands via the (1) x and (2) y parameters.
CVE-2008-7226 1Php Nuke 1Recipe Module Apr 23, 2026 Sep 14, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in index.php in the Recipes module 1.3, 1.4, and possibly other versions for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the recipeid parameter.
CVE-2009-3175 1Boldfx 1Model Agency Manager Pro Apr 23, 2026 Sep 11, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attackers to execute arbitrary SQL commands via the user_id parameter to (1) view.php,...Show more Multiple SQL injection vulnerabilities in Model Agency Manager PRO (formerly Modeling Agency Content Management Script) allow remote attackers to execute arbitrary SQL commands via the user_id parameter to (1) view.php, (2) photos.php, and (3) motm.php; and the (4) id parameter to forum_message.php.Show less
CVE-2008-7210 1Ming Han 1Ajchat Apr 23, 2026 Sep 11, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated...Show more directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $_GET["s"] variable from being unset. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in AJChat.Show less
CVE-2008-7208 1Insane Visions 1Onecms Apr 23, 2026 Sep 11, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username parameter ($usernameb variable) to a_login.php or (2) user paramet...Show more Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) username parameter ($usernameb variable) to a_login.php or (2) user parameter to staff.php.Show less
CVE-2009-3154 1Almondsoft 1Com Aclassf Apr 23, 2026 Sep 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php...Show more SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 7.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action to index.php, a different vector than CVE-2009-2567.Show less
CVE-2009-3150 1Multi Website 1Multi Website Apr 23, 2026 Sep 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in index.php in Multi Website 1.5 allows remote attackers to execute arbitrary SQL commands via the Browse parameter in a vote action.
CVE-2009-3148 1Portalxp 1Portalxp Apr 23, 2026 Sep 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in PortalXP Teacher Edition 1.2 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) calendar.php, (2) news.php, and (3) links.php; and the (4) assig...Show more Multiple SQL injection vulnerabilities in PortalXP Teacher Edition 1.2 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) calendar.php, (2) news.php, and (3) links.php; and the (4) assignment_id parameter to assignments.php.Show less
CVE-2009-3119 1X Iweb.ru 1Download System Msf Apr 23, 2026 Sep 9, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in screen.php in the Download System mSF (dsmsf) module for PHP-Fusion allows remote attackers to execute arbitrary SQL commands via the view_id parameter.
CVE-2009-3118 1Danneo 1Cms Apr 23, 2026 Sep 9, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the comtext parameter, in conjunction with crafted comn...Show more SQL injection vulnerability in mod/poll/comment.php in the vote module in Danneo CMS 0.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the comtext parameter, in conjunction with crafted comname and comtitle parameters, in a poll action to index.php, related to incorrect input sanitization in base/danneo.function.php.Show less
CVE-2009-3117 1Snowhall 1Silurus System Apr 23, 2026 Sep 9, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in category.php in Snow Hall Silurus System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVE-2009-3116 1Uiga 1Church Portal Apr 23, 2026 Sep 9, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in index.php in Uiga Church Portal allows remote attackers to execute arbitrary SQL commands via the year parameter in a calendar action.

Previous 1...916917918...1032 Next