Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,665)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-13299 1Itsourcecode 1Web Based Internet Laboratory Management System Jun 17, 2026 Nov 17, 2025 5.5 MEDIUM· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A flaw has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. This impacts an unknown function of the file /user/controller.php. Executing a manipulation can lead to sql injection. The attack...Show more A flaw has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. This impacts an unknown function of the file /user/controller.php. Executing a manipulation can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.Show less
CVE-2025-13298 1Itsourcecode 1Web Based Internet Laboratory Management System Jun 17, 2026 Nov 17, 2025 5.5 MEDIUM· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability was detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. This affects an unknown function of the file /enrollment/controller.php. Performing a manipulation results in sql injectio...Show more A vulnerability was detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. This affects an unknown function of the file /enrollment/controller.php. Performing a manipulation results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.Show less
CVE-2024-44664 1Phpgurukul 1Online Shopping Portal Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in product-details.php.
CVE-2024-44659 1Phpgurukul 1Online Shopping Portal Jun 17, 2026 Nov 17, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php.
CVE-2024-44663 1Phpgurukul 1Online Shopping Portal Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the product parameter in search-result.php.
CVE-2024-44662 1Phpgurukul 1Online Shopping Portal Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page.
CVE-2024-44660 1Phpgurukul 1Online Shopping Portal Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the fullname, emailid, and contactno parameters in login.php.
CVE-2024-44658 1Phpgurukul 1Complaint Management System Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php.
CVE-2024-44654 1Phpgurukul 1Complaint Management System Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php.
CVE-2025-13297 1Itsourcecode 1Web Based Internet Laboratory Management System Jun 17, 2026 Nov 17, 2025 5.5 MEDIUM· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A security vulnerability has been detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. The impacted element is an unknown function of the file /course/controller.php. Such manipulation leads to s...Show more A security vulnerability has been detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. The impacted element is an unknown function of the file /course/controller.php. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.Show less
CVE-2024-44657 1Phpgurukul 1Complaint Management System Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the fromdate and todate parameters in between-date-userreport.php.
CVE-2024-44653 1Kashipara 1Ecommerce Website Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email parameter in user_login.php.
CVE-2024-44651 1Kashipara 1Ecommerce Website Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the recover_email parameter in user_password_recover.php.
CVE-2025-62519 1Phpmyfaq 1Phpmyfaq Jun 17, 2026 Nov 17, 2025 N/A· v4 7.2 HIGH· v3 N/A· v2 phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuratio...Show more phpMyFAQ is an open source FAQ web application. Prior to version 4.0.14, an authenticated SQL injection vulnerability in the main configuration update functionality of phpMyFAQ allows a privileged user with 'Configuration Edit' permissions to execute arbitrary SQL commands. Successful exploitation can lead to a full compromise of the database, including reading, modifying, or deleting all data, as well as potential remote code execution depending on the database configuration. This issue has been patched in version 4.0.14.Show less
CVE-2025-13319 - - Jun 17, 2026 Nov 17, 2025 N/A· v4 8.8 HIGH· v3 N/A· v2 An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API t...Show more An injection vulnerability has been discovered in the API feature in Digi On-Prem Manager, enabling an attacker with valid API tokens to inject SQL via crafted input. The API is not enabled by default, and a valid API token is required to perform the attack.Show less
CVE-2025-13291 1Campcodes 1Supplier Management System Jun 17, 2026 Nov 17, 2025 5.5 MEDIUM· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A vulnerability was found in Campcodes Supplier Management System 1.0. This affects an unknown part of the file /manufacturer/confirm_order.php. Performing a manipulation of the argument ID results in sql injection. The...Show more A vulnerability was found in Campcodes Supplier Management System 1.0. This affects an unknown part of the file /manufacturer/confirm_order.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.Show less
CVE-2025-13290 1Fabian 1Simple Food Ordering System Jun 17, 2026 Nov 17, 2025 2.1 LOW· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /saveorder.php. Such manipulation of the argument ID leads to sql injectio...Show more A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /saveorder.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.Show less
CVE-2024-44652 1Kashipara 1Ecommerce Website Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email, username, user_firstname, user_lastname, and user_address parameters in user_register.php.
CVE-2024-44648 1Phpgurukul 1Small Crm Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-details.php.
CVE-2024-44644 1Phpgurukul 1Small Crm Jun 17, 2026 Nov 17, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via the frm_id and aremark parameters in manage-tickets.php.

Previous 1...178179180...1034 Next