Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,600)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2009-0462 1Clicktech 1Clickcart Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in customer_login_check.asp in ClickTech ClickCart 6.0 allow remote attackers to execute arbitrary SQL commands via (1) the txtEmail parameter (aka E-MAIL field) or (2) the txtPassw...Show more Multiple SQL injection vulnerabilities in customer_login_check.asp in ClickTech ClickCart 6.0 allow remote attackers to execute arbitrary SQL commands via (1) the txtEmail parameter (aka E-MAIL field) or (2) the txtPassword parameter (aka password field) to customer_login.asp. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-0459 1Wholehogsoftware 1Password Protect Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2)...Show more Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Password Protect: Enhanced 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field). NOTE: some of these details are obtained from third party information.Show less
CVE-2009-0458 1Wholehogsoftware 1Ware Support Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parame...Show more Multiple SQL injection vulnerabilities in admin/login_submit.php in Whole Hog Ware Support 1.x allow remote attackers to execute arbitrary SQL commands via (1) the uid parameter (aka Username field) or (2) the pwd parameter (aka Password field). NOTE: some of these details are obtained from third party information.Show less
CVE-2009-0454 1Dmxready 1Online Notebook Manager Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in DMXReady Online Notebook Manager 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field. NOTE: some third parties report inabili...Show more Multiple SQL injection vulnerabilities in DMXReady Online Notebook Manager 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field. NOTE: some third parties report inability to verify this issue.Show less
CVE-2009-0452 1Onlinegrades 1Online Grades Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple SQL injection vulnerabilities in parents/login.php in Online Grades 3.2.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pass parameter.
CVE-2009-0451 1Skalinks 1Skalinks Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in Skalfa SkaLinks 1.5 allows remote attackers to execute arbitrary SQL commands via the Admin name field to the default URI under admin/.
CVE-2009-0447 1Aspindir 1Mydesign Sayac Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in default.asp in MyDesign Sayac 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the user parameter (aka UserName field) or (2) the pass parameter (aka Pass fie...Show more Multiple SQL injection vulnerabilities in default.asp in MyDesign Sayac 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the user parameter (aka UserName field) or (2) the pass parameter (aka Pass field) to (a) admin/admin.asp or (b) the default URI under admin/. NOTE: some of these details are obtained from third party information.Show less
CVE-2009-0446 1Web Album 1Webalbum Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in photo.php in WEBalbum 2.4b allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2009-0445 1Dreampics 1Gallery Builder Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in index.php in Dreampics Gallery Builder allows remote attackers to execute arbitrary SQL commands via the exhibition_id parameter in a gallery.viewPhotos action.
CVE-2008-6069 1123flashchat 1Echat Plugin Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in e107chat.php in the eChat plugin 4.2 for e107, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter.
CVE-2008-6068 1Web Design Hero 1Joomladate Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the JoomlaDate (com_joomladate) component 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the user parameter in a viewProfile action to index.php.
CVE-2009-0494 1Mivaco 1Com Portfol Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the Portfol (com_portfol) 1.2 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the vcatid parameter in a viewcategory action to index.php.
CVE-2009-0493 1Martin Unzner 1It!cms Apr 23, 2026 Feb 10, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in login.php in IT!CMS 2.1a and earlier allows remote attackers to execute arbitrary SQL commands via the Username.
CVE-2008-6093 1Noname Cms 1Noname Cms Apr 23, 2026 Feb 9, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in index.php in Noname CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) file_id parameter in a detailansicht action and the (2)...Show more SQL injection vulnerability in index.php in Noname CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the (1) file_id parameter in a detailansicht action and the (2) kategorie parameter in a kategorien action.Show less
CVE-2008-6091 1Bmforum 1Bmforum Apr 23, 2026 Feb 9, 2009 N/A· v4 N/A· v3 6.8 MEDIUM· v2 SQL injection vulnerability in plugins.php in BMForum 5.6, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the tagname parameter.
CVE-2009-0479 1Onlinegrades 1Online Grades Apr 23, 2026 Feb 9, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple SQL injection vulnerabilities in admin/admin_login.php in Online Grades 3.2.4 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pword parameter. NOTE: the provenance of this info...Show more Multiple SQL injection vulnerabilities in admin/admin_login.php in Online Grades 3.2.4 allow remote attackers to execute arbitrary SQL commands via the (1) uname or (2) pword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2008-6088 1Joomtracker 1Com Joomtracker Apr 23, 2026 Feb 6, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in the Joomtracker (com_joomtracker) 1.01 module for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a tordetails action to index.php.
CVE-2008-6086 1Camera Life 1Camera Life Apr 23, 2026 Feb 6, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in album.php in Camera Life 2.6.2b4 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2008-3355.
CVE-2008-6081 1Simplecustomer 1Simple Customer Apr 23, 2026 Feb 6, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in contact.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2008-6078 1Limbo Cms 1Com Privmsg Apr 23, 2026 Feb 6, 2009 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in open.php in the Private Messaging (com_privmsg) component for Limbo CMS allows remote attackers to execute arbitrary SQL commands via the id parameter in a pms action to index.php.

Previous 1...946947948...1030 Next