CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- quatuor evaluacion de desempeno, evaluación de desempeño (edd) +1 moreOut-of-band SQL injection in Quatuor Performance Evaluation9.3 Critical
- testa online test management systemTesta Online Test Management System 3.4.7 - 'q' SQL Injection8.8 High
- geraked phpscript-sghPhpscript-sgh 0.1.0 - Time Based Blind SQL Injection8.8 High
- librenmsLibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection7.1 High
- fabian mobile shop management systemcode-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php...9.8 Critical
- fabian mobile shop management systemcode-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage...9.8 Critical
- hisense transtech smart bus management systemHisense TransTech Smart Bus Management System TireMng.aspx Page_Load sql injection6.9 Medium
- expressionengineSQL Injection vulnerability in the Structure for Admin authenticated user6.0 Medium
- code-projects online music sitecode-projects Online Music Site AdminDeleteUser.php sql injection6.9 Medium
- code-projects online examination systemcode-projects Online Examination System Login Page index.php sql injection6.9 Medium
- unknown recipe card blocks liteRecipe Card Blocks < 3.4.13 - Contributor+ SQLi6.8 Medium
- andddd wp-clanwarsWP-ClanWars <= 2.0.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- saeros1984 neoforumWordPress Neoforum plugin <= 1.0 - SQL Injection vulnerability7.6 High
- nelio software contentWordPress Nelio Content plugin <= 4.2.0 - SQL Injection vulnerability8.5 High
- red hat amq broker 7, build of optaplanner 8, data grid 8 +20 more +22 moreOrg.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection8.3 High
- aptsys gemscms backendAn SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys...9.4 Critical
- hclsoftware travelerWordPress Traveler theme < 3.2.8 - SQL Injection vulnerability8.5 High
- firestorm plugins professional real estateWordPress FireStorm Professional Real Estate plugin <= 2.7.11 - SQL Injection vulnerability7.6 High
- themepassion ultra portfolioWordPress Ultra Portfolio plugin <= 6.7 - SQL Injection vulnerability8.5 High
- fooevents for woocommerceWordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerability8.5 High
- happymonster happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.20.4 - SQL Injection vulnerability8.5 High
- saad iqbal appexpertsWordPress AppExperts plugin <= 1.4.5 - SQL Injection vulnerability8.5 High
- ichurakov paid downloadsWordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerability9.3 Critical
- cleverreach® wpWordPress CleverReach® WP plugin <= 1.5.21 - SQL Injection vulnerability9.3 Critical
- antideo email validatorWordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerability7.5 High
- mailerlite – woocommerce integrationWordPress MailerLite – WooCommerce integration plugin <= 3.1.2 - SQL Injection vulnerability9.3 Critical
- kamleshyadav wp lead capturing pagesWordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerability9.3 Critical
- kamleshyadav wp lead capturing pagesWordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerability8.5 High
- zoomit dzs video galleryWordPress DZS Video Gallery plugin <= 12.39 - SQL Injection vulnerability8.5 High
- dell unisphere for powermax, unisphere for powermax virtual appliance +1 moreDell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of...8.8 High
- aida hotel guest hotspotSQLi in Aida Computer's Hotspot8.0 High
- altium aes, on-prem enterprise server +1 moreSQL Injection in AES Due to Inactive SQL Parsing Configuration8.6 High
- seo panel panelSEO Panel < 4.9.0 - 'order_col' Blind SQL Injection7.0 High
- satndy aplikasi-biro-travelBlitar Tourism 1.0 - Authentication Bypass SQLi8.8 High
- i want source codes digital crime report management systemDigital Crime Report Management System 1.0 - SQL Injection8.8 High
- abacre retail point of saleAbacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The...6.5 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter user_popedom.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter select.jsp sql injection6.9 Medium
- yonyou ksoaYonyou KSOA HTTP GET Parameter save_folder.jsp sql injection6.9 Medium
- itsourcecode school management systemitsourcecode School Management System index.php sql injection6.9 Medium
- ibericode koko analytics, koko-analytics +1 moreKoko Analytics vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import8.4 High
- Show moreLoading…