CWE-89
20,900 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVEs (20,900)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Injection. This issue affects Quality Management System: through...Show more |
SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProcess() method. |
SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the da...Show more |
SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the databas...Show more |
SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by send...Show more |
SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of the Address.php component. |
SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the setPrice() function of the Goodsbatchset.php component. |
SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the system/role/list interface. |
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php. |
1Campcodes 1Online Marriage Registration System Jun 17, 2026 Mar 22, 2024 5.3 MEDIUM· v4 6.5 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability has been found in Campcodes/PHPGurukul Online Marriage Registration System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/application-bwdates...Show more |
1Campcodes 1Online Marriage Registration System Jun 17, 2026 Mar 22, 2024 N/A· v4 6.5 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability, which was classified as critical, was found in Campcodes Online Marriage Registration System 1.0. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdat...Show more |
1Campcodes 1Online Marriage Registration System Jun 17, 2026 Mar 21, 2024 N/A· v4 6.5 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability classified as critical was found in Campcodes Online Marriage Registration System 1.0. This vulnerability affects unknown code of the file /user/search.php. The manipulation of the argument searchdata lea...Show more |
1Campcodes 1Complete Online Beauty Parlor Management System Jun 17, 2026 Mar 21, 2024 N/A· v4 6.5 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/contact-us.php. The manip...Show more |
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow...Show more |
Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.17 allows a remote...Show more |
SQL injection vulnerability exists in GetDIAE_astListParameters.
|
SQL injection vulnerability exists in GetDIAE_slogListParameters.
|
SQL injection vulnerability exists in GetDIAE_unListParameters.
|
1Campcodes 1Complete Online Beauty Parlor Management System Jun 17, 2026 Mar 21, 2024 2.1 LOW· v4 6.5 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability was detected in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/admin-profile.php. The manipulation of the argument adminname/...Show more |
1Campcodes 1Complete Online Beauty Parlor Management System Jun 17, 2026 Mar 21, 2024 N/A· v4 6.5 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability was found in Campcodes Complete Online Beauty Parlor Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of th...Show more |