CWE-89

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the applicati

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracl

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its aut

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decod

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sa

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw P

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Info

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `or

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to v

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-tab

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated re

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to ex

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the ne

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-imp

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolat

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 th

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based)

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality.

SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. Thi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. Thi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. Thi

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to v

The Total Donations plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.5 due

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerab

Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacke

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a s

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allo

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1)

An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backen

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php.

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the

NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection v

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound v

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Nat

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada all

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Fr

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automot

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Le

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerL

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® Cleve

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Dow