← Back
CWE-89

20,600 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,600)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-4303
1Php Collab
1Php Collab
Apr 23, 2026
Dec 23, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Multiple SQL injection vulnerabilities in phpCollab 2.5 rc3, 2.4, and earlier allow remote attackers to execute arbitrary SQL commands via the loginForm parameter to general/login.php, and unspecified other vectors.
CVE-2008-2380
1Courier Mta
1Courtier Authlib
Apr 23, 2026
Dec 22, 2008
N/A· v4
N/A· v3
5.1 MEDIUM· v2
SQL injection vulnerability in authpgsqllib.c in Courier-Authlib before 0.62.0, when a non-Latin locale Postgres database is used, allows remote attackers to execute arbitrary SQL commands via query parameters containing...Show more
SQL injection vulnerability in authpgsqllib.c in Courier-Authlib before 0.62.0, when a non-Latin locale Postgres database is used, allows remote attackers to execute arbitrary SQL commands via query parameters containing apostrophes.Show less
CVE-2008-1094
1Barracuda Networks
1Barracuda Spam Firewall
Apr 23, 2026
Dec 19, 2008
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall (BSF) before 3.5.12.007 allows remote authenticated administrators to execute arbitrary SQL commands via a pattern_x parameter...Show more
SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall (BSF) before 3.5.12.007 allows remote authenticated administrators to execute arbitrary SQL commands via a pattern_x parameter in a search_count_equals action, as demonstrated by the pattern_0 parameter.Show less
CVE-2008-5665
1Xoops
1Xoops
Apr 23, 2026
Dec 19, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in the xhresim module in XOOPS allows remote attackers to execute arbitrary SQL commands via the no parameter.
CVE-2008-5655
1Myiosoft
1Easybookmarker
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in MyioSoft EasyBookMarker 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) delete_folder and (2) delete_link parameters to unspecified vectors, possibly to...Show more
Multiple SQL injection vulnerabilities in MyioSoft EasyBookMarker 4.0 allow remote attackers to execute arbitrary SQL commands via the (1) delete_folder and (2) delete_link parameters to unspecified vectors, possibly to (a) plugins/bookmarker/bookmarker_backend.php or (b) ajaxp.php, different vectors than CVE-2008-5654. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2008-5654
1Myiosoft
1Easycalendar
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyCalendar 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username paramet...Show more
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyCalendar 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter, a different vector than CVE-2008-1344. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5653
1Myiosoft.com
1Ajaxportal
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter...Show more
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5652
1Myiosoft
1Easybookmarker
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username param...Show more
SQL injection vulnerability in the loginADP function in ajaxp.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the rsargs parameter, as reachable through the username parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5651
1Myiosoft
1Easybookmarker
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in plugins/bookmarker/bookmarker_backend.php in MyioSoft EasyBookMarker 4.0 allows remote attackers to execute arbitrary SQL commands via the Parent parameter.
CVE-2008-5650
1Alstrasoft
1Webhost Directory
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the login directory in AlstraSoft Web Host Directory allows remote attackers to execute arbitrary SQL commands via the pwd parameter.
CVE-2008-5649
1Alstrasoft
1Article Manager Pro
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
10.0 HIGH· v2
SQL injection vulnerability in admin/admin.php in AlstraSoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2008-5648
1Deltascripts
1Php Shop
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the admin_username parameter. NOTE: some of these details are obtained from third...Show more
SQL injection vulnerability in admin/login.php in DeltaScripts PHP Shop 1.0 allows remote attackers to execute arbitrary SQL commands via the admin_username parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5643
1Joomla
1Com Books
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the Books (com_books) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter in a book_details action to index.php.
CVE-2008-5641
1Activewebsoftwares
1Active Photo Gallery
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in account.asp in Active Photo Gallery 6.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
CVE-2008-5640
1Activewebsoftwares
1Active Bids
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in bidhistory.asp in Active Bids 3.5 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
CVE-2008-5638
1Activewebsoftwares
1Active Price Comparison
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Active Price Comparison 4 allow remote attackers to execute arbitrary SQL commands via the (1) ProductID parameter to reviews.aspx or the (2) linkid parameter to links.asp.
CVE-2008-5637
1Parsblogger
1Parsblogger
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in blog.asp in ParsBlogger (Pb) allows remote attackers to execute arbitrary SQL commands via the wr parameter.
CVE-2008-5636
1Lovedesigner
1Lito Lite Cms
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in cate.php in Lito Lite CMS, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVE-2008-5635
1Activewebsoftwares
1Active Membership
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of...Show more
SQL injection vulnerability in account.asp in Active Membership 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5634
1Activewebsoftwares
1Active Force Matrix
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in account.asp in Active Force Matrix 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some...Show more
SQL injection vulnerability in account.asp in Active Force Matrix 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of these details are obtained from third party information.Show less