Browse / SQL Injection

SQL Injection

See it on the mapBypass libraryPayloads

Weaknesses in this class

• SQL Injection330
• Blind SQL Injection1
• NoSQL Injection1

Often found together with

• Information Disclosure63
• Code Execution34

Most upvoted SQL Injection reports

AllValidInformativeN/ADuplicate

1. SQL Injection Extracts Starbucks Enterprise Accounting, Financial, Payroll DatabaseSQL Injection · critical · Starbucks
   801 votes
2. SQL injection in https://labs.data.gov/dashboard/datagov/csv_to_json via User-agent SQL Injection · critical · GSA Bounty
   699 votes
3. Time-Based SQL injection at city-mobil.ruSQL Injection · Mail.ru
   $15,000631 votes
4. SQL injection at https://sea-web.gold.razer.com/ajax-get-status.php via txid parameterSQL Injection · Razer
   $2,000580 votes
5. SQL Injection in https://api-my.pay.razer.com/inviteFriend/getInviteHistoryLogSQL Injection · Razer
   $2,000528 votes
6. Blind SQL Injection SQL Injection · InnoGames
   $2,000432 votes
7. SQL Injection in report_xml.php through countryFilter[] parameterSQL Injection · critical · Valve
   $25,000410 votes
8. SQL injection at fleet.city-mobil.ruSQL Injection · Mail.ru
   $10,000372 votes
9. [windows10.hi-tech.mail.ru] Blind SQL Injection SQL Injection · Mail.ru
   $5,000330 votes
10. [www.zomato.com] SQLi - /php/██████████ - item_idSQL Injection · critical · Eternal
    $4,500326 votes
11. SQL Injection on cookie parameterSQL Injection · high · MTN Group
    323 votes
12. SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour ParameterSQL Injection · Razer
    $2,000240 votes
13. SQL Injection in agent-managerSQL Injection · high · Acronis
    237 votes
14. Blind SQLi leading to RCE, from Unauthenticated access to a test API WebserviceSQL Injection · critical · Starbucks
    236 votes
15. [api.easy2pay.co] SQL Injection at fortumo via TransID parameter [Bypassing Signature Validation🔥]SQL Injection · Razer
    $4,000232 votes
16. Boolean-based SQL Injection on relap.ioSQL Injection · Mail.ru
    227 votes
17. Blind SQL Injection in city-mobil.ru domainSQL Injection · Mail.ru
    $2,000224 votes
18. SQL LIKE clauses wildcard injectionSQL Injection · Mail.ru
    $8,000217 votes
19. Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)SQL Injection · Pornhub
    211 votes
20. Blind SQL Injection on starbucks.com.gt and WAF Bypass :*SQL Injection · high · Starbucks
    210 votes
21. www.drivegrab.com SQL injectionSQL Injection · high · Grab
    $4,500205 votes
22. Blind SQL injection on id.indrive.comBlind SQL Injection · critical · inDrive
    $4,134199 votes
23. SQLi at https://sea-web.gold.razer.com/demo-th/purchase-result.php via orderid ParameterSQL Injection · Razer
    $2,000183 votes
24. Blind SQL injection in Hall of FapSQL Injection · Pornhub
    179 votes
25. SQL injection in GraphQL endpoint through embedded_submission_form_uuid parameterSQL Injection · critical · HackerOne
    174 votes
26. Sql injection on docs.atavist.comSQL Injection · high · Automattic
    170 votes
27. bypass sql injection #1109311SQL Injection · medium · Acronis
    164 votes
28. SQL Injection [unauthenticated] with direct output at https://news.mail.ru/SQL Injection · Mail.ru
    $7,500156 votes
29. SQLi | in URL pathsSQL Injection · critical · MTN Group
    149 votes
30. SQL Injection vulnerability found on ibm.com endpointSQL Injection · critical · IBM
    137 votes
31. SQL Injection Union BasedSQL Injection · critical · Automattic
    137 votes
32. Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.jsonSQL Injection · critical · Eternal
    $2,000137 votes
33. [intensedebate.com] SQL Injection Time Based On /js/commentAction/SQL Injection · critical · Automattic
    130 votes
34. SQL injection in structure pluginSQL Injection · medium · ExpressionEngine
    125 votes
35. SQL injection in Razer Gold List Admin at /lists/index.php via the `list[]` parameter. SQL Injection · Razer
    $2,000122 votes
36. SQL Injection at https://files.palantir.com/ due to CVE-2021-38159SQL Injection · high · Palantir Public
    121 votes
37. SQL Injection at api.easy2pay.co/add-on/get-sig.php via partner_id ParameterSQL Injection · Razer
    $2,000119 votes
38. SQL injection on admin.acronis.host development web serviceSQL Injection · high · Acronis
    $250118 votes
39. SQL injection in URL path leads to Database AccessSQL Injection · critical · MTN Group
    115 votes
40. SQL injection in https://www.acronis.cz/ via the log parameterSQL Injection · medium · Acronis
    103 votes
41. SQL Injection intensedebate.comSQL Injection · medium · Automattic
    102 votes
42. Complete authentication bypass to admin permissionsSQL Injection · critical · Rocket.Chat
    100 votes
43. SQL Injection when using FilteredRelationSQL Injection · critical · Django
    96 votes
44. Woocommerce SQL Injection in WC_Report_Coupon_UsageSQL Injection · medium · Automattic
    96 votes
45. Time based SQL injection at████████SQL Injection · high · U.S. Dept Of Defense
    96 votes
46. Error-Based & Time-Based SQL Injection in 'keyword' Parameter of admin-search.php Allowing Full Database Access in Revive Adserver v6.0.0SQL Injection · high · Revive Adserver
    93 votes
47. SQL Injection on prod.oidc-proxy.prod.webservices.mozgcp.net via invite_code parameter - Mozilla social inscriptionSQL Injection · critical · Mozilla
    93 votes
48. turboslim.lady.mail.ru - Blind sql-injection.SQL Injection · Mail.ru
    $5,00093 votes
49. SQL Injection on sctrack.email.uber.com.cnSQL Injection · Uber
    $4,00093 votes
50. SQL InjectionSQL Injection · high · U.S. Dept Of Defense
    91 votes
51. SQL Injection in CVE Discovery Search SQL Injection · high · HackerOne
    87 votes
52. [SQLI ]Time Bassed Injection at ██████████ via referer headerSQL Injection · high · U.S. Dept Of Defense
    87 votes
53. SQL injection on jd.mail.ruSQL Injection · Mail.ru
    $30087 votes
54. 3igames.mail.ru SQL Injection SQL Injection · Mail.ru
    $1,50086 votes
55. Blind Sql Injection in https://████SQL Injection · medium · U.S. Dept Of Defense
    81 votes
56. SQL Injection in Column Type Parameter Allows Arbitrary SQL ExecutionSQL Injection · high · Nextcloud
    80 votes
57. [intensedebate.com] SQL Injection Time Based on /changeReplaceOpt.phpSQL Injection · critical · Automattic
    80 votes
58. Blind SQL Injection at http://easytopup.in.th/es-services/mps.php via serial_no parameterSQL Injection · Razer
    $1,00080 votes
59. SQL Injection on www.██████████ on countID parameterSQL Injection · high · U.S. Dept Of Defense
    80 votes
60. SQL Injection in Django ORM via Unvalidated `_connector` in Q ObjectsSQL Injection · critical · Django
    77 votes
61. Arbitrary SQL command injectionSQL Injection · critical · Nextcloud
    77 votes
62. SQL injection delivery-club.ru (ClickHouse)SQL Injection · Mail.ru
    $5,00076 votes
63. SQL Injection on https://www.olx.co.idSQL Injection · OLX
    75 votes
64. SQL Injection at https://████ via ███ parameterSQL Injection · critical · Sony
    74 votes
65. SQL Injection in ████SQL Injection · high · U.S. Dept Of Defense
    73 votes
66. sqli on █████████ search functionalitySQL Injection · medium · Mars
    72 votes
67. [https://reviews.zomato.com] Time Based SQL InjectionSQL Injection · critical · Eternal
    $1,00072 votes
68. SQL injection at https://sea-web.gold.razer.com/demo-th/goto-e2p-web-api.php via Multiple ParametersSQL Injection · Razer
    $2,00071 votes
69. SQL injection in JSONField KeyTransformSQL Injection · high · Django
    68 votes
70. Blind SQL injection at tsftp.informatica.comSQL Injection · critical · Informatica
    68 votes
71. [www.zomato.com] Blind SQL Injection in /php/geto2bannerSQL Injection · critical · Eternal
    $2,00068 votes
72. Blind SQL Injection(Time Based Payload) in https://www.easytopup.in.th/store/game/digimon-master via CheckuserForm[user_id]SQL Injection · Razer
    $1,00068 votes
73. Boolen Based Blind Sql Injection Via User Agent in ███.milSQL Injection · medium · U.S. Dept Of Defense
    67 votes
74. Time Based SQL InjectionSQL Injection · critical · U.S. Department of State
    64 votes
75. SQL injection at ███████SQL Injection · critical · Sony
    63 votes
76. [www.zomato.com] SQLi on `order_id` parameterSQL Injection · critical · Eternal
    $1,00063 votes
77. SQLi At `███████` via `theme_name` SQL Injection · critical · Mars
    62 votes
78. SQL Injection at https://lite.r-keeper.ru/site_api/clients/derision/?lang=ruSQL Injection · Mail.ru
    $1,50062 votes
79. CVE-2024-53908: Django Potential SQL injection in `HasKey(lhs, rhs)` on OracleSQL Injection · high · Internet Bug Bounty
    61 votes
80. Unauthenticated SQL Injection at █████████ [HtUS]SQL Injection · critical · U.S. Dept Of Defense
    61 votes
81. Blind SQL injection in third-party software, that allows to reveal user statistic from rocket.chat and possibly hack into the rocketchat.agilecrm.comSQL Injection · Rocket.Chat
    61 votes
82. [www.zomato.com] Union SQLi + Waf BypassSQL Injection · Eternal
    $1,00061 votes
83. SQL injection in 3rd party software AnomaliSQL Injection · high · Uber
    $2,50061 votes
84. Time-base SQL Injection in Search UsersSQL Injection · medium · Concrete CMS
    60 votes
85. Blind SQL in id_locality GET param on [city-mobil.ru/taxiserv]SQL Injection · Mail.ru
    $3,50055 votes
86. Multiple vulnerabilities in a WordPress plugin at drive.uber.comSQL Injection · Uber
    55 votes
87. SQL Injection in IBM access control panel & Broken access in admin panelSQL Injection · critical · IBM
    54 votes
88. [www.zomato.com] Blind SQL Injection in /php/widgets_handler.phpSQL Injection · critical · Eternal
    $2,00054 votes
89. SQL Injection https://www.olx.co.idSQL Injection · OLX
    54 votes
90. Time-based blind SQL injectionSQL Injection · medium · U.S. Dept Of Defense
    53 votes
91. Potential SQL Injection when annotating FilteredRelation on PostgreSQLSQL Injection · high · Django
    52 votes
92. CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()SQL Injection · high · Internet Bug Bounty
    $4,26352 votes
93. Blind SQL Injection on news.mail.ruSQL Injection · Mail.ru
    $3,00052 votes
94. A SQL injection vulnerability in VanillaSQL Injection · Vanilla
    $60051 votes
95. SQL Injection /webApp/oma_conf ctx parameter (viestinta.lahitapiola.fi)SQL Injection · LocalTapiola
    $1,35050 votes
96. [contact-sys.com] SQL Injection████ limit paramSQL Injection · QIWI
    50 votes
97. Blind SQL injection via clientid parameter in zone‑include.phpSQL Injection · high · Revive Adserver
    49 votes
98. SQL injection in https://demor.adr.acronis.com/ via the username parameterSQL Injection · high · Acronis
    49 votes
99. SQL Injection in ████SQL Injection · high · U.S. Dept Of Defense
    49 votes
100. Sqli on ██████ search functionalitySQL Injection · medium · Mars
     47 votes