← Back
CWE-89

20,587 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,587)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2008-2340
1News Manager
1News Manager
Apr 23, 2026
May 19, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid par...Show more
Multiple SQL injection vulnerabilities in News Manager 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) lang parameter to (a) advsearch.php, (b) archive.php, and (c) index.php, and the (2) pid parameter to (d) list_tagitems.php.Show less
CVE-2008-2339
1Turnkeywebtools
1Sunshop Shopping Cart
Apr 23, 2026
May 19, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Turnkey Web Tools SunShop Shopping Cart 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action, a different vector than CVE-2008...Show more
SQL injection vulnerability in index.php in Turnkey Web Tools SunShop Shopping Cart 3.5.1 allows remote attackers to execute arbitrary SQL commands via the id parameter in an item action, a different vector than CVE-2008-2038, CVE-2007-4597, and CVE-2007-2549.Show less
CVE-2008-2337
1Imgallery
1Imgallery
Apr 23, 2026
May 19, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in IMGallery 2.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kategoria parameter to (a) galeria.php and the (2) id_phot...Show more
Multiple SQL injection vulnerabilities in IMGallery 2.5, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kategoria parameter to (a) galeria.php and the (2) id_phot parameter to (b) popup/koment.php and (c) popup/opis.php in, different vectors than CVE-2006-3163.Show less
CVE-2008-2336
168 Classifieds
168 Classifieds
Apr 23, 2026
May 19, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in category.php in 68 Classifieds 4.0.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVE-2008-2334
1Aspindir
1Philboard
Apr 23, 2026
May 19, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) forumid parameter to (a) admin/philboard_admin-forumedit.asp, (b) admin/philboard_admin-...Show more
Multiple SQL injection vulnerabilities in W1L3D4 Philboard 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) forumid parameter to (a) admin/philboard_admin-forumedit.asp, (b) admin/philboard_admin-forum.asp, and (c) W1L3D4_foruma_yeni_konu_ac.asp; the (2) id parameter to (d) W1L3D4_konuoku.asp and (e) W1L3D4_konuya_mesaj_yaz.asp; and the (3) topic parameter to W1L3D4_konuya_mesaj_yaz.asp, different vectors than CVE-2008-1939, CVE-2007-2641, and CVE-2007-0920. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2008-2301
1Phpway
1Kostenloses Linkmanagementscript
Apr 23, 2026
May 18, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Kostenloses Linkmanagementscript allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) view.php and (2) top_view.php.
CVE-2008-2286
1Symantec
1Altiris Deployment Solution
Apr 23, 2026
May 18, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification...Show more
SQL injection vulnerability in axengine.exe in Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 allows remote attackers to execute arbitrary SQL commands via unspecified string fields in a notification packet.Show less
CVE-2008-2278
1Freelanceauction
1Freelance Auction Script
Apr 23, 2026
May 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in browseproject.php in Freelance Auction Script 1.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a pdetails action.
CVE-2008-2277
1Cmsnx
1Feedback And Rating Script
Apr 23, 2026
May 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in detail.php in Feedback and Rating Script 1.0 allows remote attackers to execute arbitrary SQL commands via the listingid parameter.
CVE-2008-2265
1Emophp
1Emo Realty Manager
Apr 23, 2026
May 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in news.php in EMO Realty Manager allows remote attackers to execute arbitrary SQL commands via the ida parameter.
CVE-2008-2263
1Cmsnx
1Automated Link Exchange Portal
Apr 23, 2026
May 16, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. NOTE: linking.page.php is commonly renamed to link.ph...Show more
SQL injection vulnerability in linking.page.php in Automated Link Exchange Portal allows remote attackers to execute arbitrary SQL commands via the cat_id parameter. NOTE: linking.page.php is commonly renamed to link.php, links.php, etc.Show less
CVE-2008-2225
1Gamecms
1Gamecms Lite
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in gameCMS Lite 1.0 allows remote attackers to execute arbitrary SQL commands via the systemId parameter.
CVE-2008-2223
1Buyscripts
1Vshare Youtube Clone
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in group_posts.php in vShare YouTube Clone 2.6 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
CVE-2008-2222
1Eqdkp
1Eqdkp
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in login.php in EQdkp 1.3.2f allows remote attackers to bypass EQdkp user authentication via the user_id parameter.
CVE-2008-2208
1Maianscriptworld
1Maian Greeting
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Maian Greeting 2.1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search action.
CVE-2008-2205
1Maianscriptworld
1Maian Music
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in Maian Music 1.1 allows remote attackers to execute arbitrary SQL commands via the album parameter in an album action.
CVE-2008-2203
1Maianscriptworld
1Maian Search
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in search.php in Maian Search 1.1 allows remote attackers to execute arbitrary SQL commands via the keywords parameter in a search action.
CVE-2008-2197
1Miniweb2
1Blog Writer
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the blogwriter module 2.0 for Miniweb allows remote attackers to execute arbitrary SQL commands via the historymonth parameter to index.php.
CVE-2008-2194
1Deluxebb
1Deluxebb
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in forums.php in DeluxeBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter.
CVE-2008-2191
1Postnuke Software Foundation
1Pnencyclopedia
Apr 23, 2026
May 14, 2008
N/A· v4
N/A· v3
6.8 MEDIUM· v2
SQL injection vulnerability in the pnEncyclopedia module 0.2.0 and earlier for PostNuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a display_term action to index.php.