CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- nelio software ab testingWordPress Nelio AB Testing plugin <= 8.2.4 - SQL Injection vulnerability7.6 High
- yoren chang media search enhancedWordPress Media Search Enhanced plugin <= 0.9.1 - SQL Injection vulnerability7.6 High
- code-projects patient record management systemcode-projects Patient Record Management System fecalysis_not.php sql injection5.3 Medium
- paultgoodchild shield: blocks bots, protects users, and prevents security breachesShield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection6.5 Medium
- owthub library management systemLibrary Management System <= 3.2.1 - Unauthenticated SQL Injection7.5 High
- admerc event management systemitsourcecode Event Management System manage_register.php sql injection6.9 Medium
- admerc event management systemitsourcecode Event Management System Admin Login ajax.php sql injection6.9 Medium
- admerc event management systemitsourcecode Event Management System manage_booking.php sql injection6.9 Medium
- fileflowsFileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in...6.7 Medium
- tsinghua unigroup electronic archives systemTsinghua Unigroup Electronic Archives System prinReport.html sql injection5.3 Medium
- librenmsLibreNMS has Time-Based Blind SQL Injection in address-search.inc.php8.8 High
- librenmsLibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream9.3 Critical
- delinea inc. cloud suite and privileged access serviceCloud Suite and Privilege Access Service – SQL Injection5.3 Medium
- ghostGhost has a SQL Injection in its Content API9.4 Critical
- mjdm majordomoMajorDoMo Unauthenticated SQL Injection in Commands Module8.8 High
- alixhan xh-admin-backendAlixhan xh-admin-backend Database Query query sql injection5.3 Medium
- systems at work time at workSQL injection in time@work from systems@work8.6 High
- smackcoders wp ultimate csv importer – import csv, xml & excel into wordpressWP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name6.5 Medium
- bookster – wordpress appointment booking pluginBookster – WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'4.9 Medium
- qdonow wpnakama – team and multi-client collaboration, editorial and project managementWPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter7.5 High
- taskbuilder – project management & task management tool with kanban boardTaskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters6.5 Medium
- strategy11team business directory plugin – easy listing directories for wordpressBusiness Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter7.5 High
- fabian scholars tracking systemcode-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in...9.8 Critical
- codeastro membership management systemCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in...9.8 Critical
- sciyon koyuan thermoelectricity heat network management systemSciyon Koyuan Thermoelectricity Heat Network Management System AsyncTreeProxy.aspx sql injection6.9 Medium
- huace monitoring and early warning systemHuace Monitoring and Early Warning System ProjectRole.aspx sql injection6.9 Medium
- tumeva internet technologies software information advertising and consulting services trade ltd. co. prime news softwareTime-Based Blind SQLi in Tumeva Internet Technologies' Tumeva Prime News Software8.6 High
- clickedu saas platformSQL Injection in Clickedu's SaaS platform8.3 High
- jizhicmsjizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the...7.2 High
- joraniA SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an...7.6 High
- phpgurukul student management systemphpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search...8.8 High
- tushar-2223 hotel-management-systemtushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection5.3 Medium
- getwpfunnels mail mint – email marketing, newsletter, email automation & woocommerce emailsMail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints4.9 Medium
- savitasoni photostack galleryPhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter7.5 High
- No product listedA SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for...9.8 Critical
- websitem 7070 hazır profesyonel web sitesiPRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass8.8 High
- thrive smart homeThrive Smart Home 1.1 - 'Smart Home' Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8.8 High
- amitkolloldey elearning-scriptelearning-script 1.0 - Authentication Bypass8.8 High
- kostasmitroglou thesystem, password management application +1 morethesystem App 1.0 - 'username' SQL Injection7.1 High
- kostasmitroglou thesystem, password management application +1 morethesystem 1.0 - 'server_name' SQL Injection7.1 High
- glpi-project more reporting, pluginsglpi mreporting +1 moremreporting affected by a SQLI on date change4.9 Medium
- farktor e-commerce packageSQLi in Farktor Software's E-Commerce Package9.8 Critical
- fit2cloud cordys crmCordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list)...9.8 Critical
- veronalabs slimstat analyticsSlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter6.5 Medium
- evershopEverShop has a Second-Order SQL Injection in URL Rewrite Processing Derived from Category URL Keys9.3 Critical
- worklenzWorklenz through 3.0.0 SQL Injection via the sort-field Query Parameter8.6 High
- worklenzWorklenz Boolean-Based Blind SQL Injection via Improper ORDER BY Clause Input Validation8.8 High
- ivanti endpoint managerSQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated...6.5 Medium
- ergosis security systems computer industry and trade inc. zeus pdksSQLi in Ergosis Security Systems' ZEUS PDKS8.8 High
- flowring docpediaFlowring｜Docpedia - SQL Injection8.7 High
- Show moreLoading…