探索與 SQL Injection 漏洞相關的 CVE，並依公開年份篩選。本清單預設優先展示最新揭露，並支援依 CVSS 與 EPSS 風險分數進一步篩選。
涵蓋最新漏洞揭露與趨勢，協助安全團隊快速識別高風險問題與被利用可能性。
目前為 SQL Injection 類型、2013 年公開的 CVE。 檢視完整 CVE 清單
| CVE | 描述 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|
| CVE-2013-7242 | SQL injection vulnerability in zp-core/zp-extensions/wordpress_import.php in Zenphoto before 1.4.5.4 allows remote authenticated administrators to execute arbitrary SQL commands via the tableprefix parameter. | 6.5 | 1.84% | 2013-12-31 | 2026-06-16 |
| CVE-2013-6983 | SQL injection vulnerability in the web interface in Cisco Unified Presence Server allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCuh35615. | 6.5 | 2.10% | 2013-12-31 | 2026-06-16 |
| CVE-2013-7232 | SQL injection vulnerability in ESRI ArcGIS for Server through 10.2 allows remote attackers to execute arbitrary SQL commands via unspecified input to the map or feature service. | 7.5 | 2.04% | 2013-12-29 | 2026-06-16 |
| CVE-2013-7149 | SQL injection vulnerability in www/delivery/axmlrpc.php (aka the XML-RPC delivery invocation script) in Revive Adserver before 3.0.2, and OpenX Source 2.8.11 and earlier, allows remote attackers to execute arbitrary SQL commands via the what parameter to an XML-RPC method. | 7.5 | 2.01% | 2013-12-27 | 2026-06-16 |
| CVE-2013-6929 | SQL injection vulnerability in Cybozu Garoon 3.7 SP2 and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted API input. | 6.5 | 1.55% | 2013-12-27 | 2026-06-16 |
| CVE-2013-7216 | Multiple SQL injection vulnerabilities in Classifieds Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) ID parameter to demo/classifieds/product.asp, or (2) UserID or (3) Password field to demo/classifieds/admin.asp. | 7.5 | 1.30% | 2013-12-24 | 2026-06-16 |
| CVE-2013-4461 | SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary SQL commands via vectors related to the "filtering table operator." | 7.5 | 1.89% | 2013-12-23 | 2026-06-16 |
| CVE-2013-5409 | Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. | 6.5 | 1.03% | 2013-12-21 | 2026-06-16 |
| CVE-2013-7193 | Multiple SQL injection vulnerabilities in C2C Forward Auction Creator 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) pa parameter to auction/asp/list.asp, or the (2) UserID or (3) Password to auction/casp/admin.asp. | 7.5 | 2.50% | 2013-12-20 | 2026-06-16 |
| CVE-2013-7192 | Multiple SQL injection vulnerabilities in Dynamic Biz Website Builder (QuickWeb) allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/news-events/newdetail.asp, or the (2) UserID or (3) Password to login.asp. | 7.5 | 2.30% | 2013-12-20 | 2026-06-16 |
| CVE-2013-2627 | SQL injection vulnerability in action.php in Leed (Light Feed), possibly before 1.5 Stable, allows remote attackers to execute arbitrary SQL commands via the id parameter in a removeFolder action. | 7.5 | 1.23% | 2013-12-20 | 2026-06-16 |
| CVE-2013-7189 | Multiple SQL injection vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to execute arbitrary SQL commands via the cmbdomain parameter to (1) checktransferstatus.php, (2) checktransferstatusbck.php, or (3) additionalsettings.php; or (4) invno parameter to payinvoiceothers.php. | 7.5 | 1.35% | 2013-12-20 | 2026-06-16 |
| CVE-2013-7187 | SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. | 7.5 | 4.78% | 2013-12-20 | 2026-06-16 |
| CVE-2013-7096 | Multiple SQL injection vulnerabilities in SAP EMR Unwired allow remote attackers to execute arbitrary SQL commands via unspecified vectors. | 7.5 | 1.89% | 2013-12-13 | 2026-06-16 |
| CVE-2013-7094 | SQL injection vulnerability in the RSDDCVER_COUNT_TAB_COLS function in SAP NetWeaver 7.30 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | 7.5 | 1.35% | 2013-12-13 | 2026-06-16 |
| CVE-2013-7092 | Multiple SQL injection vulnerabilities in /admin/cgi-bin/rpc/doReport/18 in McAfee Email Gateway 7.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) events_col, (2) event_id, (3) reason, (4) events_order, (5) emailstatus_order, or (6) emailstatus_col JSON keys. | 6.5 | 1.90% | 2013-12-13 | 2026-06-16 |
| CVE-2013-6839 | SQL injection vulnerability in InstantSoft InstantCMS 1.10.3 and earlier allows remote attackers to execute arbitrary SQL commands via the orderby parameter to catalog/[id]. | 7.5 | 1.30% | 2013-12-13 | 2026-06-16 |
| CVE-2013-6985 | SQL injection vulnerability in m_worklog/log_searchday.jsp in Enorth Webpublisher CMS, possibly 5.0 and earlier, allows remote attackers to execute arbitrary SQL commands via the thisday parameter. | 7.5 | 1.13% | 2013-12-09 | 2026-06-16 |
| CVE-2013-5354 | Multiple SQL injection vulnerabilities in Sharetronix 3.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) fb_user_id or (2) tw_user_id parameter to signup. | 7.5 | 1.22% | 2013-12-09 | 2026-06-16 |
| CVE-2013-6787 | SQL injection vulnerability in the check_user_password function in main/auth/profile.php in Chamilo LMS 1.9.6 and earlier, when using the non-encrypted passwords mode set at installation, allows remote authenticated users to execute arbitrary SQL commands via the "password0" parameter. | 6.0 | 2.74% | 2013-12-05 | 2026-06-16 |