CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- devcode openstamanagerOpenSTAManager has an SQL Injection in Scadenzario Print Template8.7 High
- devcode openstamanagerOpenSTAManager has an SQL Injection in the Prima Nota module8.7 High
- devcode openstamanagerOpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)8.7 High
- code-projects simple blood donor management systemcode-projects Simple Blood Donor Management System editcampaignform.php sql injection6.9 Medium
- bontrofftech medical center portal management systemSourceCodester Medical Center Portal Management System emp_edit1.php sql injection6.9 Medium
- thejshen contentmanagementsystemTheJshen contentManagementSystem 1.04 - 'id' SQL Injection7.1 High
- thejshen globitek cmsthejshen Globitek CMS 1.4 - 'id' SQL Injection7.1 High
- rimbalinux ahadposrimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection7.1 High
- lolypop55 html5 snmphtml5_snmp 1.11 - 'Router_ID' SQL Injection7.1 High
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injection6.9 Medium
- bontrofftech medical center portal management systemSourceCodester Medical Center Portal Management System login.php sql injection6.9 Medium
- itsourcecode school management systemitsourcecode School Management System controller.php sql injection6.9 Medium
- itsourcecode student management system, school management system +1 moreitsourcecode Student Management System index.php sql injection6.9 Medium
- itsourcecode student management system, school management system +1 moreitsourcecode Student Management System index.php sql injection6.9 Medium
- itsourcecode student management system, school management system +1 moreitsourcecode Student Management System index.php sql injection6.9 Medium
- itsourcecode student management system, school management system +1 moreitsourcecode Student Management System controller.php sql injection6.9 Medium
- fortinet forticlientems, forticlient ems +1 moreAn improper neutralization of special elements used in an sql command ('sql injection')...9.1 Critical
- payloadcms payloadPayload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters9.8 Critical
- tanium discoverTanium addressed an improper input validation vulnerability in Discover.6.3 Medium
- ciprianmp phpmychat plus, phpmychat-plus +1 morephpMyChat Plus 1.98 'deluser.php' SQL Injection8.8 High
- ibm aspera consoleA SQL Injection vulnerability has been addressed in IBM Aspera Console8.6 High
- No product listediomad Company Admin Block sql injection5.1 Medium
- nokia infinera dnaA time-based SQL Injection vulnerability in Infinera DNA6.3 Medium
- roxnor popup builder with gamification, multi-step popups, page-level targeting, and woocommerce triggersPopup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints8.2 High
- glpi-project glpiGLPI is Vulnerable to Authenticated SQL Injection6.5 Medium
- martcode software inc. delta course automationSQLi in Martcode Software's Delta Course Automation9.8 Critical
- gtlwpdev all push notification for wpAll push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter4.9 Medium
- comprassibs sibs woocommerce payment gatewaySIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter4.9 Medium
- infility globalInfility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass7.5 High
- arox school erp proSchool ERP Pro 1.0 - 'es_messagesid' SQL Injection7.1 High
- chatelao php address bookaddressbook 9.0.0.1 - 'id' SQL Injection8.8 High
- fishing reservation system reservation systemFishing Reservation System 7.5 - 'uid' SQL Injection7.1 High
- victor cms project cms, victoralagwu cmssite +1 moreVictor CMS 1.0 - 'post' SQL Injection8.8 High
- oxid-esales oxid eshopOXID eShop 6.3.4 - 'sorting' SQL Injection8.8 High
- devcode openstamanagerOpenSTAManager has an SQL Injection in the Stampe Module8.7 High
- devcode openstamanagerOpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)8.7 High
- pear pearwebPEAR is Vulnerable to SQL Injection in /get/<package>/<version> Endpoint9.3 Critical
- pear pearwebPEAR is Vulnerable to SQL Injection in user::maintains() Role IN() Filter6.9 Medium
- pear pearwebPEAR is Vulnerable to SQL Injection in apidoc_queue Insert via Unescaped Filename8.2 High
- pear pearwebPEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email Validation9.2 Critical
- pear pearwebPEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal Substitution6.9 Medium
- pear pearwebPEAR is Vulnerable to SQL Injection in Category Deletion5.3 Medium
- facturascriptsFacturaScripts has SQL Injection vulnerability in Autocomplete Actions8.7 High
- facturascriptsFacturaScripts has SQL Injection vulnerability in API ORDER BY Clause8.3 High
- openeclass gunet openeclass, gunet open eclass platform +1 moreGUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection7.1 High
- davidvg 60cyclecms60CycleCMS 2.5.2 - 'news.php' SQL Injection Vulnerability8.8 High
- allhandsmarketing phpix 2012 professionalPhpIX 2012 Professional - 'id' SQL Injection7.1 High
- redmine pmbPMB 5.6 - 'logid' SQL Injection7.1 High
- emit informatics and communication technologies industry and trade ltd. co. digita efficiency management systemSQLi in Emit Informatics' DIGITA Efficiency Management System9.8 Critical
- iqonic design kivicareWordPress KiviCare plugin <= 3.6.16 - SQL Injection vulnerability8.5 High
- Show moreLoading…