← Back
CWE-89

19,889 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (19,889)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2006-4214
1Zen Cart
1Zen Cart
Apr 16, 2026
Aug 17, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) GPC data to the ipn_get_stored_session function in ipn_main_handler.php, which can b...Show more
Multiple SQL injection vulnerabilities in Zen Cart 1.3.0.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) GPC data to the ipn_get_stored_session function in ipn_main_handler.php, which can be leveraged to modify elements of $_SESSION; and allow remote authenticated users to execute arbitrary SQL commands via (2) a session id within a cookie to whos_online_session_recreate, (3) the quantity field to the add_cart function, (4) an id[] parameter when adding an item to a shopping cart, or (5) a redemption code when checking out (dc_redeem_code parameter to includes/modules/order_total/ot_coupon.php).Show less
CVE-2006-4064
1Yenerturk
1Yenerturk Haber Script
Apr 16, 2026
Aug 10, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it was later reported reported that 2.0 is also...Show more
SQL injection vulnerability in default.asp in YenerTurk Haber Script 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: it was later reported reported that 2.0 is also affected.Show less
CVE-2006-4042
1Mywebland
1Mybloggie
Apr 16, 2026
Aug 9, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) title, (2) url, (3) excerpt, or (4) blog_name paramete...Show more
Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) title, (2) url, (3) excerpt, or (4) blog_name parameters.Show less
CVE-2006-4039
1Chaossoft
1Gaestechaos
Apr 16, 2026
Aug 9, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in eintragen.php in GaesteChaos 0.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) gastname, (2) gastwohnort, or (3) gasteintrag parameters.
CVE-2006-4010
1Vwar
1Virtual War
Apr 16, 2026
Aug 7, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in war.php in Virtual War (Vwar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: other vectors are covered by CVE-2006-3139.
CVE-2006-3960
1X Scripts
1X Poll
Apr 16, 2026
Aug 1, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in top.php in X-Scripts X-Poll, probably 2.30, allows remote attackers to execute arbitrary SQL commands via the poll parameter. NOTE: the provenance of this information is unknown; the detai...Show more
SQL injection vulnerability in top.php in X-Scripts X-Poll, probably 2.30, allows remote attackers to execute arbitrary SQL commands via the poll parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.Show less
CVE-2006-3904
1Etomite
1Etomite
Apr 16, 2026
Jul 27, 2006
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
CVE-2006-3823
1Geodesicsolutions
2Geoauctions Premier
Geoclassifieds Basic
Apr 16, 2026
Jul 25, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
SQL injection vulnerability in index.php in GeodesicSolutions (1) GeoAuctions Premier 2.0.3 and (2) GeoClassifieds Basic 2.0.3 allows remote attackers to execute arbitrary SQL commands via the b parameter.
CVE-2006-3775
1Mybulletinboard
1Mybulletinboard
Apr 16, 2026
Jul 24, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the init function in class_session.php in MyBB (aka MyBulletinBoard) 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header ($_SERVER['HTTP_CLIENT_IP'...Show more
SQL injection vulnerability in the init function in class_session.php in MyBB (aka MyBulletinBoard) 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header ($_SERVER['HTTP_CLIENT_IP'] variable), as utilized by index.php.Show less
CVE-2006-3688
1Francisco Charrua
1Photo Gallery
Apr 16, 2026
Jul 21, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Room.php in Francisco Charrua Photo-Gallery 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2006-3430
2Lumension
Novell
2Patchlink Update Server
Zenworks
Apr 16, 2026
Jul 7, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows remote attackers to execute arbitrary SQ...Show more
SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows remote attackers to execute arbitrary SQL commands via the agentid parameter.Show less
CVE-2006-3318
1Spiffyjr
1Phpraid
Apr 16, 2026
Jun 29, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) em...Show more
SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) email parameters.Show less
CVE-2006-3181
1Mobescripts
1Mobile Space Community
Apr 16, 2026
Jun 23, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in MobeScripts Mobile Space Community 2.0 allows remote attackers to execute arbitrary SQL commands via the browse parameter.
CVE-2006-3139
1Vwar
1Virtual War
Apr 16, 2026
Jun 22, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in war.php in Virtual War (VWar) 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) showgame, (3) sortorder, and (4) sortby parameters...Show more
Multiple SQL injection vulnerabilities in war.php in Virtual War (VWar) 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) showgame, (3) sortorder, and (4) sortby parameters.Show less
CVE-2006-3064
1Coppermine
1Coppermine Photo Gallery
Apr 16, 2026
Jun 19, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the add_hit function in include/function.inc.php in Coppermine Photo Gallery (CPG) 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL co...Show more
SQL injection vulnerability in the add_hit function in include/function.inc.php in Coppermine Photo Gallery (CPG) 1.4.8, when "Keep detailed hit statistics" is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) referer and (2) user-agent HTTP headers.Show less
CVE-2006-3048
1Tiki
1Tikiwiki Cms/groupware
Apr 16, 2026
Jun 16, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2006-2977
1Mafia Moblog
1Mafia Moblog
Apr 16, 2026
Jun 12, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in big.php in Mafia Moblog 0.6M1 and earlier allows remote attackers to execute arbitrary SQL commands via the img parameter.
CVE-2006-2973
1Php Lite
1Calendar Express
Apr 16, 2026
Jun 12, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in month.php in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) catid and (2) cid parameter. NOTE: this might be a duplicate of C...Show more
Multiple SQL injection vulnerabilities in month.php in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) catid and (2) cid parameter. NOTE: this might be a duplicate of CVE-2005-4009.c.Show less
CVE-2006-2760
1Warpspeed
14nforum
Apr 16, 2026
Jun 2, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in modules.php in 4nNukeWare 4nForum 0.91 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
CVE-2006-2416
1E107
1E107
Apr 16, 2026
May 16, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref['cookie_name'].