Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (21,495)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-105920 - - Oct 9, 2026 Oct 6, 2026 5.5 MEDIUM· v4 7.3 HIGH· v3 7.5 HIGH· v2 A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Studen...Show more A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.Show less
CVE-2026-105919 - - Oct 6, 2026 Oct 6, 2026 5.5 MEDIUM· v4 7.3 HIGH· v3 7.5 HIGH· v2 A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administr...Show more A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.Show less
CVE-2026-105918 - - Oct 6, 2026 Oct 6, 2026 5.5 MEDIUM· v4 7.3 HIGH· v3 7.5 HIGH· v2 A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The ma...Show more A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.Show less
CVE-2026-4889 - - Oct 6, 2026 Oct 6, 2026 7.8 HIGH· v4 N/A· v3 N/A· v2 SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-...Show more SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.Show less
CVE-2026-42417 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
CVE-2026-42416 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
CVE-2026-42415 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
CVE-2026-42414 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
CVE-2026-41555 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
CVE-2026-39795 - - Oct 28, 2026 Oct 6, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brewlabs SendPress Newsletters sendpress allows Blind SQL Injection.This issue affects SendPress Newsletters: from n/a...Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brewlabs SendPress Newsletters sendpress allows Blind SQL Injection.This issue affects SendPress Newsletters: from n/a through 1.26.1.20.Show less
CVE-2026-39785 - - Oct 13, 2026 Oct 6, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: fro...Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1.Show less
CVE-2026-39771 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
CVE-2026-39764 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
CVE-2026-39747 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Subscriber SQL Injection in Woffice <= 5.4.35 versions.
CVE-2026-39746 - - Oct 29, 2026 Oct 6, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.
CVE-2026-32581 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 7.1 HIGH· v3 N/A· v2 Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
CVE-2026-32580 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
CVE-2026-32557 - - Oct 29, 2026 Oct 6, 2026 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce...Show more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from n/a through 5.3.2.Show less
CVE-2026-25434 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
CVE-2026-105317 - - Oct 6, 2026 Oct 6, 2026 N/A· v4 8.5 HIGH· v3 N/A· v2 Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.

Previous 1...212223...1075 Next