Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,620)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-2242 1Aaronoutpost 1Asp Inline Corporate Calendar Apr 23, 2026 Jun 27, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execute arbitrary SQL commands via the order parameter.
CVE-2009-2239 1Joomla 3Com Casiino Blackjack Com Casino VideopokerCom Casinobase Apr 23, 2026 Jun 27, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the (1) casinobase (com_casinobase), (2) casino_blackjack (com_casino_blackjack), and (3) casino_videopoker (com_casino_videopoker) components 0.3.1 for Joomla! allows remote attackers to e...Show more SQL injection vulnerability in the (1) casinobase (com_casinobase), (2) casino_blackjack (com_casino_blackjack), and (3) casino_videopoker (com_casino_videopoker) components 0.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.Show less
CVE-2009-2236 1Yourarticlesdirectory 1Your Articles Directory Apr 23, 2026 Jun 27, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in yad-admin/login.php in Your Article Directory allows remote attackers to execute arbitrary SQL commands via the txtAdminEmail parameter. NOTE: some of these details are obtained from third...Show more SQL injection vulnerability in yad-admin/login.php in Your Article Directory allows remote attackers to execute arbitrary SQL commands via the txtAdminEmail parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-2235 1Yourarticlesdirectory 1Your Articles Directory Apr 23, 2026 Jun 27, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in page.php in Your Articles Directory allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2009-2234 1Vicidial 1Call Center Suite Apr 23, 2026 Jun 27, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite 2.0.5-173 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter ($PHP_AUTH_USER) and (2) Password parame...Show more Multiple SQL injection vulnerabilities in admin.php in VICIDIAL Call Center Suite 2.0.5-173 allow remote attackers to execute arbitrary SQL commands via the (1) Username parameter ($PHP_AUTH_USER) and (2) Password parameter ($PHP_AUTH_PW).Show less
CVE-2008-6837 1Zoph 1Zoph Apr 23, 2026 Jun 27, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than CVE-2008-3258. NOTE: the provenance of this information is unknown; t...Show more SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than CVE-2008-3258. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2009-2232 1Softbizscripts 1Banner Ad Management Script Apr 23, 2026 Jun 26, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in image.php in Softbiz Banner Ad Management Script allows remote attackers to execute arbitrary SQL commands via the size_id parameter. NOTE: the provenance of this information is unknown; t...Show more SQL injection vulnerability in image.php in Softbiz Banner Ad Management Script allows remote attackers to execute arbitrary SQL commands via the size_id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2009-2230 1Mybulletinboard 1Mybulletinboard Apr 23, 2026 Jun 26, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbitrary SQL commands via the birthdayprivacy parameter.
CVE-2009-2209 1Rs Cms 1Rs Cms Apr 23, 2026 Jun 25, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in rscms_mod_newsview.php in RS-CMS 2.1 allows remote attackers to execute arbitrary SQL commands via the key parameter.
CVE-2009-2179 1W2b 1Phpdatingclub Apr 23, 2026 Jun 23, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in search.php in phpDatingClub 3.7 allows remote attackers to execute arbitrary SQL commands via the sform[day] parameter.
CVE-2009-2167 1Egyplus 17ammel Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username o...Show more Multiple SQL injection vulnerabilities in cpanel/login.php in EgyPlus 7ammel (aka 7ml) 1.0.1 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.Show less
CVE-2009-2164 1Kjtechforce 1Mailman Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the code parameter to activate.php or (2) the dest...Show more Multiple SQL injection vulnerabilities in Kjtechforce mailman beta1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the code parameter to activate.php or (2) the dest parameter to index.php.Show less
CVE-2009-2157 1Torrenttrader 1Torrenttrader Classic Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 6.5 MEDIUM· v2 Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (1) the origmsg parameter to account-inbox.php; the categ parameter to (2) delre...Show more Multiple SQL injection vulnerabilities in TorrentTrader Classic 1.09 allow remote authenticated users to execute arbitrary SQL commands via (1) the origmsg parameter to account-inbox.php; the categ parameter to (2) delreq.php and (3) admin-delreq.php; (4) the choice parameter to index.php; (5) the id parameter to modrules.php in an edited (aka edit) action; the (6) user, (7) torrent, (8) forumid, and (9) forumpost parameters to report.php; (10) the delmp parameter to take-deletepm.php; (11) the delreport parameter to takedelreport.php; (12) the delreq parameter to takedelreq.php; (13) the clases parameter to takestaffmess.php; and (14) the warndisable parameter to takewarndisable.php; and allow remote attackers to execute arbitrary SQL commands via (15) the wherecatin parameter to browse.php, (16) the limit parameter to today.php, and (17) the where parameter to torrents-details.php.Show less
CVE-2009-2154 1Sappy.dk 1Impleo Music Collection Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in admin/login.php in Impleo Music Collection 2.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2009-2152 1Isabela Gasparini 1Adaptweb Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in a_index.php in AdaptWeb 0.9.2 allows remote attackers to execute arbitrary SQL commands via the CodigoDisciplina parameter in a TopicosCadastro1 action.
CVE-2009-2148 1Campusvirtualcomputrade 1Campus Virtual Lms Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in news/index.php in Campus Virtual-LMS allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2009-2147 1Phpwebthings 1Phpwebthings Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2009-2144 2Edgewall Firestats 2Firestats Firestats Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2009-2142 1Zipstore 1Zip Store Chat Apr 23, 2026 Jun 22, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in admin/index.asp in Zip Store Chat 4.0 and 5.0 allow remote attackers to execute arbitrary SQL commands via the (1) login and (2) senha parameters.
CVE-2009-2128 1Elvinbts 1Elvinbts Apr 23, 2026 Jun 19, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in close_bug.php in Elvin before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the title (aka subject) field.

Previous 1...925926927...1031 Next