Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

CVEs (20,860)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-42781 1Lopalopa 1Music Management System Jun 17, 2026 Aug 21, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 A SQL injection vulnerability in "/music/ajax.php?action=login" of Kashipara Music Management System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email parameter.
CVE-2024-5725 1Centreon 1Centreon Web Jun 17, 2026 Aug 21, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit...Show more Centreon initCurveList SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the initCurveList function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-22683.Show less
CVE-2024-5723 1Centreon 1Centreon Web Jun 17, 2026 Aug 21, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to expl...Show more Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateServiceHost function. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of the apache user. Was ZDI-CAN-23294.Show less
CVE-2024-6814 1Netgear 1Prosafe Network Management System Jun 17, 2026 Aug 21, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSA...Show more NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the getFilterString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-23399.Show less
CVE-2024-6813 1Netgear 1Prosafe Network Management System Jun 17, 2026 Aug 21, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE...Show more NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability. The specific flaw exists within the getSortString method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-23207.Show less
CVE-2024-7854 1Sjhoo 1Woo Inquiry Jun 17, 2026 Aug 21, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the e...Show more The Woo Inquiry plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 0.1 due to insufficient escaping on the user supplied parameter 'dbid' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.Show less
CVE-2024-7651 1Appcheap 1App Builder Jun 17, 2026 Aug 21, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and including, 4.2.6 due to insuf...Show more The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and including, 4.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.Show less
CVE-2024-8023 1Bladex 1Springblade Jun 17, 2026 Aug 21, 2024 5.3 MEDIUM· v4 9.8 CRITICAL· v3 6.5 MEDIUM· v2 A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is po...Show more A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2024-42361 1Apache 1Hertzbeat Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with...Show more Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection.Show less
CVE-2024-43406 1Lfedge 1Ekuiper Jun 17, 2026 Aug 20, 2024 N/A· v4 8.8 HIGH· v3 N/A· v2 LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query v...Show more LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore. This vulnerability is fixed in 1.14.2.Show less
CVE-2024-34458 1Keyfactor 1Command Jun 17, 2026 Aug 20, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure.
CVE-2024-33872 - - Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges.
CVE-2024-42575 1Arajajyothibabu 1School Management System Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php.
CVE-2024-42574 1Arajajyothibabu 1School Management System Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php.
CVE-2024-42573 1Arajajyothibabu 1School Management System Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at dtmarks.php.
CVE-2024-42572 1Arajajyothibabu 1School Management System Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at unitmarks.php.
CVE-2024-42571 1Arajajyothibabu 1School Management System Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.php.
CVE-2024-42570 1Arajajyothibabu 1School Management System Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php.
CVE-2024-42569 1Arajajyothibabu 1School Management System Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php.
CVE-2024-42568 1Arajajyothibabu 1School Management System Jun 17, 2026 Aug 20, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.

Previous 1...420421422...1043 Next