← Back
CWE-89

20,600 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,600)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-5633
1Activewebsoftwares
1Activevotes
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in register.asp in ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of thes...Show more
SQL injection vulnerability in register.asp in ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5632
1Activewebsoftwares
1Active Time Billing
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some...Show more
SQL injection vulnerability in Account.asp in Active Time Billing 3.2 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters, possibly related to start.asp. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5631
1Activewebsoftwares
1Active Ewebquiz
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in start.asp in Active eWebquiz 8.0 allows remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka username field) or the (2) password parameter. NOTE: some of...Show more
SQL injection vulnerability in start.asp in Active eWebquiz 8.0 allows remote attackers to execute arbitrary SQL commands via the (1) useremail parameter (aka username field) or the (2) password parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5630
1Qualityunit
1Post Affiliate Pro
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in merchants/index.php in Post Affiliate Pro 3 and 3.1.4 allows remote attackers to execute arbitrary SQL commands via the umprof_status parameter.
CVE-2008-5629
1Turnkeyarcade
1Turnkey Arcade Script
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Turnkey Arcade Script allows remote attackers to execute arbitrary SQL commands via the id parameter in a play action.
CVE-2008-5628
1Little Cms
1Little Cms
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter.
CVE-2008-5627
1Activewebsoftwares
1Active Trade
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter (aka Email field) or the (2) password parameter. NOTE: some of these d...Show more
SQL injection vulnerability in account.asp in Active Trade 2 allows remote attackers to execute arbitrary SQL commands via the (1) username parameter (aka Email field) or the (2) password parameter. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5609
1Typo3
1Commerce Extension
Apr 23, 2026
Dec 17, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the Commerce extension 0.9.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVE-2008-5607
1Joomitaly
1Jmovies
Apr 23, 2026
Dec 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the JMovies (aka JM or com_jmovies) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVE-2008-5605
1Aspapps
1Aspportal
Apr 23, 2026
Dec 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in ASP Portal allow remote attackers to execute arbitrary SQL commands via the (1) ItemID parameter to classifieds.asp and the (2) ID parameter to Events.asp.
CVE-2008-5599
1Merlix
1Teamworx Server
Apr 23, 2026
Dec 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL commands via the password parameter (aka passwd field) in a login action. NOTE: some of these details...Show more
SQL injection vulnerability in default.asp in Merlix Teamworx Server allows remote attackers to execute arbitrary SQL commands via the password parameter (aka passwd field) in a login action. NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5595
1Aspapps
1Asp Autodealer
Apr 23, 2026
Dec 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in detail.asp in ASP AutoDealer allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVE-2008-5590
1Kalptaru Infotech
1Product Sale Framework
Apr 23, 2026
Dec 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in customer.forumtopic.php in Kalptaru Infotech Product Sale Framework 0.1 beta allows remote attackers to execute arbitrary SQL commands via the forum_topic_id parameter.
CVE-2008-5589
1Katywhitton
1Rankem
Apr 23, 2026
Dec 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the (1) txtusername parameter (aka username field) or the (2) txtpassword parameter (ak...Show more
SQL injection vulnerability in processlogin.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the (1) txtusername parameter (aka username field) or the (2) txtpassword parameter (aka password field). NOTE: some of these details are obtained from third party information.Show less
CVE-2008-5588
1Katywhitton
1Rankem
Apr 23, 2026
Dec 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in rankup.asp in Katy Whitton RankEm allows remote attackers to execute arbitrary SQL commands via the siteID parameter.
CVE-2008-5586
1Check Up
1Check New
Apr 23, 2026
Dec 16, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in findoffice.php in Check Up New Generation (aka Check New) 4.52, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the search parameter.
CVE-2008-5582
1Nukedit
1Nukedit
Apr 23, 2026
Dec 15, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in utilities/login.asp in Nukedit 4.9.x, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the email parameter.
CVE-2008-5578
1Scssboard
1Scssboard
Apr 23, 2026
Dec 15, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to execute arbitrary SQL commands via (1) the f parameter in a showforum action, (2) the u parameter in a p...Show more
Multiple SQL injection vulnerabilities in index.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allow remote attackers to execute arbitrary SQL commands via (1) the f parameter in a showforum action, (2) the u parameter in a profile action, (3) the viewcat parameter, or (4) a combination of scb_uid and scb_ident cookie values.Show less
CVE-2008-5574
1Unscripts
1Webmaster Marketplace
Apr 23, 2026
Dec 15, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in member.php in Webmaster Marketplace allows remote attackers to execute arbitrary SQL commands via the u parameter.
CVE-2008-5573
1Adcomplete
1Poll Pro
Apr 23, 2026
Dec 15, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the login feature in Poll Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) Password and (2) username parameters.