CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- campcodes supplier management systemCampcodes Supplier Management System add_retailer.php sql injection6.9 Medium
- hclsoftware travelerWordPress Traveler theme < 3.2.6 - SQL Injection vulnerability8.5 High
- mmetrodw tplayerWordPress tPlayer plugin <= 1.2.1.6 - SQL Injection vulnerability9.3 Critical
- smartcms advance seat reservation management for woocommerceWordPress Advance Seat Reservation Management for WooCommerce plugin <= 3.1 - SQL Injection vulnerability9.3 Critical
- roxnor popupkitWordPress PopupKit plugin <= 2.1.5 - SQL Injection vulnerability8.5 High
- craigtaub phpmsadminA SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An...5.4 Medium
- carmelo simple stock systemcode-projects Simple Stock System checkuser.php sql injection5.3 Medium
- powerstonegh affiliate meAffiliate Me 5.0.1 SQL Injection Vulnerability via Admin Panel8.7 High
- phpjabbers simple cmsPHPJabbers Simple CMS 5.0 SQL Injection via Column Parameter8.7 High
- anisha online appointment booking systemcode-projects Online Appointment Booking System deletemanagerclinic.php sql injection6.9 Medium
- admerc online cake ordering systemitsourcecode Online Cake Ordering System updateproduct.php sql injection6.9 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php9.3 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL injection in EditEventAttendees.php9.6 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in eGive Import Feature7.2 High
- churchcrm, churchcrm crm +1 moreChurchCRM SQL Injection Vulnerability7.4 High
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in User Editor via `type` Parameter Key7.2 High
- churchcrm, churchcrm crm +1 moreSQL Injection in Event List via `WhichType` Parameter8.8 High
- angeljudesuarez covid tracking system using qr-codeA SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID...7.3 High
- xiongwei smart catering cloud platformXiongwei Smart Catering Cloud Platform dish_trade_detail_get sql injection5.3 Medium
- lambertgroup lbg zoominoutsliderWordPress LBG Zoominoutslider plugin <= 5.4.4 - SQL Injection vulnerability8.5 High
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability8.5 High
- lambertgroup countdown with image or video backgroundWordPress CountDown With Image or Video Background plugin <= 1.5 - SQL Injection vulnerability8.5 High
- lambertgroup xpromoterWordPress xPromoter plugin <= 1.3.4 - SQL Injection vulnerability8.5 High
- stefano lissa newsletterWordPress Newsletter plugin <= 9.0.9 - SQL Injection vulnerability7.6 High
- aioseo plugin team broken link checkerWordPress Broken Link Checker plugin <= 1.2.6 - SQL Injection vulnerability7.6 High
- syed balkhi all in one seo packWordPress All In One SEO Pack plugin <= 4.9.1 - SQL Injection vulnerability8.5 High
- qnap qts, quts hero +1 moreQTS, QuTS hero5.2 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix7.2 High
- freepbx tts, sangoma freepbx +1 moreAuthenticated SQL Injection in FreePBX tts (Text To Speech) module8.6 High
- phpjabbers bus reservation systemBus Reservation System 1.1 Multiple SQL Injection via pickup_id Parameter9.3 Critical
- manager-io managerNetSupport Manager < 14.12.0001 Unauthenticated SQLi Local File Disclosure8.7 High
- wpdevelop booking calendarBooking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check7.5 High
- fantasticlbp hotels serverFantasticLBP Hotels Server hotelList.php sql injection6.9 Medium
- fantasticlbp hotels serverFantasticLBP Hotels Server OrderList.php sql injection6.9 Medium
- ketr jepaasketr JEPaaS readAllPostil sql injection5.1 Medium
- frappe erpnextAn issue was discovered in Frappe ERPNext through 15.89.0. Function...8.8 High
- frappe erpnextAn issue was discovered in Frappe ERPNext through 15.89.0. Function...8.8 High
- sunbirddcim power iqAn error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The...2.5 Low
- anirbandutta9 news-buzzSQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute...5.3 Medium
- inventory management system project management systemInventory Management System 1 was discovered to contain a SQL injection vulnerability.5.3 Medium
- campcodes advanced online examination systemcampcodes Advanced Online Examination System loginExe.php sql injection6.9 Medium
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection6.9 Medium
- angeljudesuarez covid tracking systemitsourcecode COVID Tracking System page sql injection6.9 Medium
- campcodes supplier management systemCampcodes Supplier Management System view_unit.php sql injection6.9 Medium
- itsourcecode student managemen system, angeljudesuarez student management system +1 moreitsourcecode Student Managemen System advisers.php sql injection6.9 Medium
- angeljudesuarez student management systemitsourcecode Student Management System addrecord.php sql injection6.9 Medium
- admerc online cake ordering systemitsourcecode Online Cake Ordering System admindetail.php sql injection6.9 Medium
- admerc online cake ordering systemitsourcecode Online Cake Ordering System product.php sql injection6.9 Medium
- admerc online cake ordering systemitsourcecode Online Cake Ordering System supplier.php sql injection6.9 Medium
- carmelo computer book storecode-projects Computer Book Store admin_delete.php sql injection6.9 Medium
- Show moreLoading…