CWE-89

Traq 3.7.1 allows SQL Injection via a tickets?search= URI.

A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component.

LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.

Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.

The DB abstraction layer of OXID eSales 4.10.6 is vulnerable to SQL injection via the oxid or synchoxid parameter to the oxConfig::getRequestParameter() method in core/oxconfig.php.

CubeCart before 6.1.13 has SQL Injection via the validate[] parameter of the “I forgot my Password!” feature.