← Back
CWE-89

19,889 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (19,889)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2007-5688
3Invision Power Services
PhpbbSebflipper
3Invision Power Board
Multi Forums ModulePhpbb
Apr 23, 2026
Oct 29, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL c...Show more
Multiple SQL injection vulnerabilities in directory.php in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3, for phpBB and Invision Power Board (IPB or IP.Board), allow remote attackers to execute arbitrary SQL commands via the (1) go and (2) cat parameters.Show less
CVE-2007-5679
1Deeemm
1Dmcms
Apr 23, 2026
Oct 25, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in the media page (build_media_content.php). NOTE: it was later repo...Show more
SQL injection vulnerability in index.php in DeeEmm.com DM CMS 0.7.0.Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in the media page (build_media_content.php). NOTE: it was later reported that 0.7.4 is also affected.Show less
CVE-2007-5678
1Phpbasic
1Phpbasic
Apr 23, 2026
Oct 24, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the Music module in phpBasic allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to the default URI.
CVE-2007-5646
1Simple Machines
1Simple Machines Forum
Apr 23, 2026
Oct 23, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to execute arbitrary SQL commands via the userspec parameter in a search2 action to in...Show more
SQL injection vulnerability in Sources/Search.php in Simple Machines Forum (SMF) 1.1.3, when MySQL 5 is used, allows remote attackers to execute arbitrary SQL commands via the userspec parameter in a search2 action to index.php.Show less
CVE-2007-5643
1Lussumo
1Vanilla
Apr 23, 2026
Oct 23, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the CategoryID parameter to ajax/sortcategories.php or (2) an unspecified vecto...Show more
Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the CategoryID parameter to ajax/sortcategories.php or (2) an unspecified vector to ajax/sortroles.php.Show less
CVE-2007-5630
1Bbsprocess
1Bbportals
Apr 23, 2026
Oct 23, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in tnews.php in BBsProcesS BBPortalS 1.5.10 through 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a tnews action.
CVE-2007-5511
1Oracle
1Database Server
Apr 23, 2026
Oct 17, 2007
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT pack...Show more
SQL injection vulnerability in Workspace Manager for Oracle Database before OWM 10.2.0.4.1, OWM 10.1.0.8.0, and OWM 9.2.0.8.0 allows attackers to execute arbitrary SQL commands via the FINDRICSET procedure in the LT package. NOTE: this is probably covered by CVE-2007-5510, but there are insufficient details to be certain.Show less
CVE-2007-5508
1Oracle
1Database Server
Apr 23, 2026
Oct 17, 2007
N/A· v4
N/A· v3
6.5 MEDIUM· v2
Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX_DOC) in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to execute arbitrary SQL comma...Show more
Multiple SQL injection vulnerabilities in the CTXSYS Intermedia application for the Oracle Text component (CTX_DOC) in Oracle Database 10.1.0.5 and 10.2.0.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) THEMES, (2) GIST, (3) TOKENS, (4) FILTER, (5) HIGHLIGHT, and (6) MARKUP procedures, aka DB03. NOTE: remote unauthenticated attack vectors exist when CTXSYS is used with oracle Application Server.Show less
CVE-2007-5488
1Asterisk
1Asterisk Addons
Apr 23, 2026
Oct 17, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the (1) source and (2) destination numbers,...Show more
Multiple SQL injection vulnerabilities in cdr_addon_mysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the (1) source and (2) destination numbers, and probably (3) SIP URI, when inserting a record.Show less
CVE-2007-5490
1Okulumunsitesi
1Portal
Apr 23, 2026
Oct 17, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in default.asp in Okul Otomasyon Portal 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2007-5485
1Kwsphp
1Kwsphp
Apr 23, 2026
Oct 16, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in the mg2 1.0 module for KwsPHP allows remote attackers to execute arbitrary SQL commands via the album parameter.
CVE-2007-5458
1Alorys Hebergement
2Kwsphp
Newsletter Module
Apr 23, 2026
Oct 14, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
CVE-2007-5452
1Php Stats
1Php Stats
Apr 23, 2026
Oct 14, 2007
N/A· v4
N/A· v3
10.0 HIGH· v2
Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) ip or (2) t parameter.
CVE-2007-5449
2Softbiz
Softbizscripts
2Recipes Portal Script
Recipes Portal Script
Apr 6, 2026
Oct 14, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in searchresult.php in Softbiz Recipes Portal Script allows remote attackers to execute arbitrary SQL commands via the sbcat_id parameter.
CVE-2007-5430
1Scottmanktelow
1Stride Cms
Apr 23, 2026
Oct 12, 2007
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Stride 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the p parameter to main.php in the Content Management System, (2) the id parameter in a sto cmd action...Show more
Multiple SQL injection vulnerabilities in Stride 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the p parameter to main.php in the Content Management System, (2) the id parameter in a sto cmd action to shop.php in the Merchant subsystem, or the (3) course or (4) provider parameter to detail.php in the Courses subsystem.Show less
CVE-2007-5408
1Cplinks
1Cpdynalinks
Apr 23, 2026
Oct 12, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL commands via the category parameter.
CVE-2007-5372
2Dws Systems Inc.
Ledgersmb
2Ledgersmb
Sql Ledger
Apr 23, 2026
Oct 11, 2007
N/A· v4
N/A· v3
10.0 HIGH· v2
Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort f...Show more
Multiple SQL injection vulnerabilities in (a) LedgerSMB 1.0.0 through 1.2.7 and (b) DWS Systems SQL-Ledger 2.x allow remote attackers to execute arbitrary SQL commands via (1) the invoice quantity field or (2) the sort field.Show less
CVE-2007-5371
1Modxcms
1Modxcms
Apr 23, 2026
Oct 11, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
Multiple SQL injection vulnerabilities in mutate_content.dynamic.php in MODx 0.9.6 allow remote attackers to execute arbitrary SQL commands via the (1) documentDirty or (2) modVariables parameter.
CVE-2007-5316
1Softbizscripts
1Softbiz Jobs And Recruitment Script
Apr 23, 2026
Oct 9, 2007
N/A· v4
N/A· v3
5.0 MEDIUM· v2
SQL injection vulnerability in browsecats.php in Softbiz Jobs and Recruitment Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
CVE-2007-5308
1Php Homepage M
1Php Homepage M
Apr 23, 2026
Oct 9, 2007
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in galerie.php in PHP Homepage M (phpHPm) 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a show action.