← Back
CWE-89

20,574 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

JSON object

Loading...

CVEs (20,574)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2006-3048
1Tiki
1Tikiwiki Cms/groupware
Apr 16, 2026
Jun 16, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in TikiWiki 1.9.3.2 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2006-2977
1Mafia Moblog
1Mafia Moblog
Apr 16, 2026
Jun 12, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in big.php in Mafia Moblog 0.6M1 and earlier allows remote attackers to execute arbitrary SQL commands via the img parameter.
CVE-2006-2973
1Php Lite
1Calendar Express
Apr 16, 2026
Jun 12, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in month.php in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) catid and (2) cid parameter. NOTE: this might be a duplicate of C...Show more
Multiple SQL injection vulnerabilities in month.php in PHP Lite Calendar Express 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) catid and (2) cid parameter. NOTE: this might be a duplicate of CVE-2005-4009.c.Show less
CVE-2006-2760
1Warpspeed
14nforum
Apr 16, 2026
Jun 2, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in modules.php in 4nNukeWare 4nForum 0.91 allows remote attackers to execute arbitrary SQL commands via the tid parameter.
CVE-2006-2416
1E107
1E107
Apr 16, 2026
May 16, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref['cookie_name'].
CVE-2006-2363
1Limbo Cms
1Limbo Cms
Apr 16, 2026
May 15, 2006
N/A· v4
N/A· v3
5.1 MEDIUM· v2
SQL injection vulnerability in the weblinks option (weblinks.html.php) in Limbo CMS allows remote attackers to execute arbitrary SQL commands via the catid parameter.
CVE-2006-2301
1Ozzywork
1Galeri
Apr 16, 2026
May 11, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in admin_default.asp in OzzyWork Galeri allows remote attackers to execute arbitrary SQL commands via the (1) Login or (2) password fields.
CVE-2006-2268
1Flexcustomer
1Flexcustomer
Apr 16, 2026
May 9, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably involving the (1) chec...Show more
SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably involving the (1) checkuser and (2) checkpass parameters to (a) admin/index.php, and (3) username and (4) password parameters to (b) index.php. NOTE: it was later reported that 0.0.6 is also affected.Show less
CVE-2006-2259
1Maxxcode
1Maxxschedule
Apr 16, 2026
May 9, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in Logon.asp in MaxxSchedule 1.0 allows remote attackers to execute arbitrary SQL commands via the txtLogon parameter.
CVE-2006-2239
1Tuomas Airaksinen
1Newsadmin
Apr 16, 2026
May 9, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in readarticle.php in Newsadmin 1.1 allows remote attackers to execute arbitrary SQL commands via the nid parameter.
CVE-2006-2157
1Plogger
1Plogger
Apr 16, 2026
May 3, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, when the level is set to "slideshow". NOTE: This is a different...Show more
SQL injection vulnerability in gallery.php in Plogger Beta 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter, when the level is set to "slideshow". NOTE: This is a different vulnerability than CVE-2005-4246.Show less
CVE-2006-2128
1Deltascripts
1Pro Publish
Apr 16, 2026
May 1, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameter to (a) admin/login.php, (3) find_str parameter to (b) search...Show more
Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) email and (2) password parameter to (a) admin/login.php, (3) find_str parameter to (b) search.php, or (4) artid parameter to (c) art.php, or (5) catid parameter to (d) cat.php.Show less
CVE-2006-2103
1Mybulletinboard
1Mybulletinboard
Apr 16, 2026
Apr 29, 2006
N/A· v4
N/A· v3
2.1 LOW· v2
SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the (1) query string ($querystring variable) in (a) admin/adminlogs.php, which...Show more
SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the (1) query string ($querystring variable) in (a) admin/adminlogs.php, which is not properly handled by adminfunctions.php; or (2) setid, (3) expand, (4) title, or (5) sid2 parameters to (b) admin/templates.php.Show less
CVE-2006-2090
1Mysmartbb
1Mysmartbb
Apr 16, 2026
Apr 29, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in misc.php in MySmartBB 1.1.x allow remote attackers to execute arbitrary SQL commands via the (1) id and (2) username parameters.
CVE-2006-1978
1Flexbb
1Flexbb
Apr 16, 2026
Apr 21, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in inc/start.php in FlexBB 0.5.5 and earlier allows remote attackers to execute arbitrary SQL commands via the flexbb_username COOKIE parameter.
CVE-2006-1962
1Pcpin
1Pcpin Chat
Apr 16, 2026
Apr 21, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in PCPIN Chat 5.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the username field (login parameter) to main.php.
CVE-2006-1871
1Oracle
1Database Server
Apr 16, 2026
Apr 20, 2006
N/A· v4
N/A· v3
6.5 MEDIUM· v2
SQL injection vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.5 allows remote attackers to execute arbitrary SQL commands via the DELETE_FROM_TABLE function in the DBMS_LOGMNR_SESSION (Log Miner) package, aka...Show more
SQL injection vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.5 allows remote attackers to execute arbitrary SQL commands via the DELETE_FROM_TABLE function in the DBMS_LOGMNR_SESSION (Log Miner) package, aka Vuln# DB06.Show less
CVE-2006-1751
1Michiel Van Baak
1Mvblog
Apr 16, 2026
Apr 12, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in MvBlog before 1.6 allow remote attackers to execute arbitrary SQL commands via unknown vectors.
CVE-2006-1676
1Maxdev
1Md Pro
Apr 16, 2026
Apr 11, 2006
N/A· v4
N/A· v3
6.4 MEDIUM· v2
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands vi...Show more
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.Show less
CVE-2006-1501
1Oneorzero
1Oneorzero
Apr 16, 2026
Mar 30, 2006
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action.