CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- carmelo question paper generatorcode-projects Question Paper Generator selectquestionuser.php sql injection5.3 Medium
- carmelogarcia employee profile management systemcode-projects Employee Profile Management System view_personnel.php sql injection5.3 Medium
- rashmindungrani online-bankingRashminDungrani online-banking auth_login.php sql injection6.9 Medium
- chanjet tplusChanjet TPlus sql injection6.9 Medium
- chanjet crmChanjet CRM jxf_dump_table_demo.php sql injection6.9 Medium
- yonyou u8 cloudYonyou U8 Cloud AppServletService.class sql injection5.3 Medium
- stevejburge tag, category, and taxonomy manager – ai autotagger with openaiTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause6.5 Medium
- trippwastaken php-guitar-shopTrippWasTaken PHP-Guitar-Shop Product Details product.php sql injection6.9 Medium
- amtt hotel broadband operation system, amttgroup hibos +1 moreAMTT Hotel Broadband Operation System cardmake_down.php sql injection5.1 Medium
- wphocus my auctions allegroMy auctions allegro <= 3.6.32 - Unauthenticated SQL Injection via auction_id7.5 High
- advantech iviewAdvantech iView SQL Injection8.7 High
- obi08/enrollment system systemObi08-Enrollment System 1.0 get_subject.php SQL Injection8.7 High
- mayurik dawa-pharmadawa-pharma-1.0 - SQL Injection via Email Parameter8.7 High
- jizhicmsJIZHICMS Batch Delete Comments deleteAll.html delete sql injection5.1 Medium
- jizhicmsJIZHICMS Add Display Name Field addcomment.html commentlist sql injection5.1 Medium
- freepbx restappsAuthenticated SQL Injection in Endpoint Module Rest API8.6 High
- stevejburge tag, category, and taxonomy manager – ai autotagger with openai, taxopress +1 moreTag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection6.5 Medium
- wpmanageninja fluentcart a new era of ecommerce – faster, lighter, and simplerFluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter4.9 Medium
- djangoproject djangoPotential SQL injection in FilteredRelation column aliases on PostgreSQL4.3 Medium
- tcman gimSQL injection vulnerability in TCMAN GIM8.7 High
- opensolution quickcmsBlind SQL Injection in QuickCMS8.6 High
- wpdirectorykit wp directory kitWP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection4.9 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parameter7.5 High
- themeisle visualizer: tables and charts manager for wordpressVisualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection6.5 Medium
- unknown donation, kieranoshea donations +1 moreDonation <= 1.0 - Admin+ SQLi4.1 Medium
- jimbob1953 db-accessDB Access <= 0.8.7 - Subscriber+ SQLi7.7 High
- long2ice asyncmyasyncmy is vulnerable to SQL injection via crafted dict keys9.8 Critical
- wanliofficial lvzhou cmsLvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to...7.5 High
- phpgurukul billing systemPHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint....6.5 Medium
- phpgurukul billing systemPHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php...6.5 Medium
- hashenudara edoc-doctor-appointment-systemEdoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via...9.8 Critical
- anisha online medicine guidecode-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the...9.8 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameter5.1 Medium
- elated-themes frappeFrappe has the possibility of SQL Injection due to improper validations7.1 High
- jsnjfz webstack-gunsjsnjfz WebStack-Guns PageFactory.java sql injection5.3 Medium
- shridharshukl blood bank management systemA SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php...9.6 Critical
- shridharshukl blood bank management systemA SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel...9.6 Critical
- shridharshukl blood bank management systemA SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the...10.0 Critical
- mjobtimeA blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers...9.8 Critical
- chanjet crmChanjet CRM upgradeattribute.php sql injection6.9 Medium
- taosir wtcmstaosir WTCMS CommentadminController CommentadminController.class.php delete sql injection5.3 Medium
- taosir wtcmstaosir WTCMS SlideController SlideController.class.php delete sql injection6.9 Medium
- uniong webitrUniong｜WebITR - SQL Injection7.1 High
- uniong webitrUniong｜WebITR - SQL Injection7.1 High
- devolutions serverSQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects...8.8 High
- frappe crmFrappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller7.1 High
- apache hiveApache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs5.4 Medium
- db electronica telecomunicazioni s.p.a. mozart fm transmitter, dbbroadcast mozart dds next 1000 firmware, mozart dds next 100 firmware +20 more +22 morePostgreSQL SQL Injection (status_sql.php)7.2 High
- opencode ussd gatewayOpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection...9.8 Critical
- opencode ussd gatewayOpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL...9.8 Critical
- Show moreLoading…