CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- dataease DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection 6.9 Medium
- wpvibes dynific addons for elementor (formerly anywhere elementor) Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter 6.5 Medium
- amelia booking for appointments and events calendar – amelia pro Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys 7.5 High
- tomdever wpforo forum wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter 7.5 High
- tomdever wpforo forum wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter 7.5 High
- rubengc gamipress – gamification plugin to reward points, badges & ranks in wordpress, now with ai GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter 6.5 Medium
- webtoffee wp backup and migration WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography 5.7 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & maps WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter 5.3 Medium
- unknown event tickets with ticket scanner Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search 6.3 Medium
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.6 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 8.5 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.6 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 9.9 Critical
- ibm api connect Multiple Vulnerabilities in IBM API Connect 7.7 High
- iovamihai affiliate program suite — slicewp affiliates Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter 7.5 High
- chartbrew Chartbrew SQL injection in dashboard filter substitution 9.8 Critical
- freescout-help-desk freescout FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Query 7.7 High
- snowflake connector for python, connector for python (universal core) +1 more SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) 8.1 High
- posit software, pbc workbench Posit Workbench code-server session-state RPC (get_last_seen) SQL injection 5.7 Medium
- craftcms cms Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select 8.8 High
- craftcms cms Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria 7.1 High
- craftcms cms Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint 9.3 Critical
- wazuh Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params 7.1 High
- yaycommerce yaysmtp – wp mail smtp with email logs, tracking & reports YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter 4.9 Medium
- atmira sirec SQL injection in Atmira’s SIREC 8.7 High
- unknown mail mage Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter 8.6 High
- cern-fts fts-monitoring FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an... 7.5 High
- subnet solutions powersystem center 2024, powersystem center 2026 +1 more Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated... 9.4 Critical
-
libsql-abstract-perlDebian,perl-SQL-AbstractopenSUSE +1 more SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update No score - kubeflow pipelines Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server 6.5 Medium
- tpc software matchpoint SQL injection in the push notification handler of the MatchPoint Android app 8.6 High
- suitecrm SuiteCRM: Authenticated SQL Injection In action_get_end_date function 6.5 Medium
- suitecrm SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list 8.8 High
- suitecrm SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User 8.8 High
- suitecrm SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database 8.8 High
- suitecrm SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management 8.8 High
- suitecrm SuiteCRM: SQL injection via search param in modules/Cases/controller.php 8.3 High
- suitecrm SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter 8.8 High
- suitecrm SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php 8.3 High
- suitecrm SuiteCRM: AOR Reports aor_fields.field SQL Injection 6.5 Medium
- suitecrm SuiteCRM: Authenticated SQL Injection In handleAttachments function 7.1 High
- suitecrm SuiteCRM: Authenticated SQL Injection In Project Module 7.1 High
- suitecrm SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php 8.3 High
- suitecrm SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php 8.3 High
- suitecrm SuiteCRM: Time-Based Blind SQL Injection via REST API 8.3 High
- Show olderLoading…