← Back
CWE-89

20,613 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,613)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2009-1258
1Rd Media
1Com Rdautos
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the RD-Autos (com_rdautos) component 1.5.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php. NOTE: the provenance of this informa...Show more
SQL injection vulnerability in the RD-Autos (com_rdautos) component 1.5.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the makeid parameter in index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2009-1256
1Flexcms
1Flexcms
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in FlexCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the ItemId parameter. NOTE: some of these details are obtained from third party information.
CVE-2008-6656
1Openautoclassifieds
1Open Auto Classifieds
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Open Auto Classifieds 1.4.3b allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to listings.php and (2) the username field to login.php.
CVE-2008-6653
1Wh Com
1Com Webhosting
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to...Show more
SQL injection vulnerability in webhosting.php in the Webhosting Component (com_webhosting) module before 1.1 RC7 for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.Show less
CVE-2008-6652
1Insanevisions
1Onecms
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in asd.php in OneCMS 2.5 allows remote attackers to execute arbitrary SQL commands via the sitename parameter.
CVE-2008-6649
1Ktools
1Photostore
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in manager/image_details_editor.php in Ktools PhotoStore 2.5, 2.9.8, 3.1.0, and other versions through 3.5.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-6648
1Ktools
1Photostore
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in crumbs.php in Ktools PhotoStore 3.4.3 and 3.5.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter to about_us.php. NOTE: this might be the same issue as CVE-2...Show more
SQL injection vulnerability in crumbs.php in Ktools PhotoStore 3.4.3 and 3.5.2 allows remote attackers to execute arbitrary SQL commands via the gid parameter to about_us.php. NOTE: this might be the same issue as CVE-2008-6647.Show less
CVE-2008-6647
1Ktools
1Photostore
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in gallery.php in Ktools PhotoStore 3.4.3 allows remote attackers to execute arbitrary SQL commands via the gid parameter.
CVE-2008-6642
1Dotcontent
1Fluentcms
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in view.php in DotContent FluentCMS 4.x allows remote attackers to execute arbitrary SQL commands via the sid parameter. NOTE: some of these details are obtained from third party information.
CVE-2008-6641
1Aspindir
1Shader Tv
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to (1) kanal.asp, (2) google.asp, and (3) hakk.asp in yonet/; a...Show more
Multiple SQL injection vulnerabilities in Shader TV (Beta) allow remote authenticated administrators to execute arbitrary SQL commands via the sid parameter to (1) kanal.asp, (2) google.asp, and (3) hakk.asp in yonet/; and allow remote attackers to execute arbitrary SQL commands via the (4) username or (5) password fields to yonet/default.asp.Show less
CVE-2008-6640
1Aspindir
1Batmanportal
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in BatmanPorTaL allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) uyeadmin.asp and (2) profil.asp. NOTE: the provenance of this information is un...Show more
Multiple SQL injection vulnerabilities in BatmanPorTaL allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) uyeadmin.asp and (2) profil.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2008-6634
1Beaussier
1Roomphplanning
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idroom parameter to weekview.php.
CVE-2008-6633
1Beaussier
1Roomphplanning
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in RoomPHPlanning 1.5 allows remote attackers to execute arbitrary SQL commands via the idresa parameter to resaopen.php.
CVE-2008-6632
1Mercuryboard
1Mercuryboard
Apr 23, 2026
Apr 7, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in func/login.php in MercuryBoard 1.1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header ($_SERVER['HTTP_USER_AGENT']).
CVE-2008-6627
1Webbdomain
1Webshop
Apr 23, 2026
Apr 6, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in getin.php in WEBBDOMAIN WebShop 1.2, 1.1, 1.02, and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2008-6626
1Webbdomain
1Quiz
Apr 23, 2026
Apr 6, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in getin.php in WEBBDOMAIN Quiz 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2008-6625
1Webbdomain
1Polls
Apr 23, 2026
Apr 6, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in getin.php in WEBBDOMAIN Polls (aka Poll) 1.0 and 1.01 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2008-6624
1Webbdomain
1Petition
Apr 23, 2026
Apr 6, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in getin.php in WEBBDOMAIN Petition 1.02, 2.0, and 3.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2008-6623
1Webbdomain
1Post Card
Apr 23, 2026
Apr 6, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in getin.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2008-6622
1Webbdomian
1Post Card
Apr 23, 2026
Apr 6, 2009
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in choosecard.php in WEBBDOMAIN Post Card (aka Web Postcards) 1.02, 1.01, and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.