CWE-89
21,495 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVEs (21,495)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issu...Show more |
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection.
This issue affects SOPLOG: before Soplog 2026.9.4.1. |
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from...Show more |
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions. |
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions. |
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions. |
Author SQL Injection in WP ERP <= 1.17.9 versions. |
Administrator SQL Injection in Estatik <= 4.3.5 versions. |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2. |
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. |
Author SQL Injection in Quiz Cat <= 3.1.1 versions. |
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. |
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions. |
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the arg...Show more |
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argumen...Show more |
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust re...Show more |
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The m...Show more |
A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulat...Show more |
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vul...Show more |