CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- web-ofisi platinum e-ticaret, ticaret +1 moreWeb Ofisi Platinum E-Ticaret v5 SQL Injection via q Parameter8.8 High
- web-ofisi emlakWeb Ofisi Emlak V2 SQL Injection via emlak-ara.html8.8 High
- web-ofisi firma rehberiWeb Ofisi Firma Rehberi v1 SQL Injection via firmalar.html8.8 High
- web-ofisi firmaWeb Ofisi Firma v13 SQL Injection via oz Parameter8.8 High
- web-ofisi emlakWeb Ofisi Emlak v2 SQL Injection via ara Parameter8.8 High
- web-ofisi e-ticaret, ticaret +1 moreWeb Ofisi E-Ticaret v3 SQL Injection via ara.html8.8 High
- ashopsoftware ashop shopping cart softwareAshop Shopping Cart Software Lastest Latest SQL Injection via bannedcustomers.php8.8 High
- microasp (portal+) cmsmicroASP Portal+ CMS SQL Injection via pagina.phtml8.8 High
- webincorp erpWebIncorp ERP Every version SQL Injection via product_detail.php8.8 High
- novismart cmsNoviSmart CMS SQL Injection via Referer HTTP Header8.8 High
- xoops cmsXOOPS CMS 2.5.9 SQL Injection via gerar_pdf.php8.8 High
- dolibarr erp/crm, erp\/crm +1 moreDolibarr ERP/CRM 10.0.1 SQL Injection via elemid8.8 High
- dolibarr erp/crm, erp\/crm +1 moreDolibarr ERP/CRM 10.0.1 SQL Injection via card.php7.1 High
- digit-rs digit centrisDIGIT CENTRIS ERP Every version SQL Injection via datum1 Parameter8.8 High
- edlangley inventory-webappInventory Webapp SQL Injection via add-item.php8.8 High
- webwiz web wiz forumsWeb Wiz Forums 12.01 SQL Injection via PF Parameter8.8 High
- code-projects online reviewer systemcode-projects Online Reviewer System studentresult-view.php sql injection6.9 Medium
- admerc vehicle management systemitsourcecode Vehicle Management System billaction.php sql injection6.9 Medium
- zoneminderZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields8.8 High
- adonesevangelista agri-trading online shopping systemitsourcecode Agri-Trading Online Shopping System HTTP POST Request productcontroller.php sql injection6.9 Medium
- agilebio labcollectorLabCollector 5.423 SQL Injection via login.php8.8 High
- part-dbPart-DB 0.4 Authentication Bypass via login.php8.8 High
- delpino73 blue-smiley-organizerdelpino73 Blue-Smiley-Organizer 1.32 SQL Injection via datetime8.8 High
- phpscriptsmall fiverr clone scriptFiverr Clone Script 1.2.2 SQL Injection via page Parameter8.8 High
- oretnom23 simple responsive tourism websiteSourceCodester Simple Responsive Tourism Website Registration Master.php sql injection6.9 Medium
- joomsky js help deskWordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerability8.5 High
- shahjada download manager addons for elementorWordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability9.3 Critical
- teconcetheme emerce coreWordPress Emerce Core plugin <= 1.8 - SQL Injection vulnerability9.3 Critical
- teconcetheme uroan coreWordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerability9.3 Critical
- don-themes wolmart coreWordPress Wolmart Core plugin <= 1.9.6 - SQL Injection vulnerability9.3 Critical
- teconcetheme woodly coreWordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerability9.3 Critical
- teconcetheme saasplate coreWordPress Saasplate Core plugin <= 1.2.8 - SQL Injection vulnerability9.3 Critical
- teconcetheme nestbyte coreWordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerability9.3 Critical
- teconcetheme medinik coreWordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerability9.3 Critical
- teconcetheme electio coreWordPress Electio Core plugin <= 1.4 - SQL Injection vulnerability9.3 Critical
- teconcetheme crete coreWordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerability9.3 Critical
- teconcetheme allmartWordPress Allmart plugin <= 1.1 - SQL Injection vulnerability9.3 Critical
- teconcetheme coven coreWordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability9.3 Critical
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 10.3.1 - SQL Injection vulnerability8.5 High
- kolay software inc. talenticsSQLi in Kolay Software's Talentics9.8 Critical
- jeecg bootJeecgBoot Backend airag_app,1,create_by sql injection5.3 Medium
- fujian smart integrated management platform systemFujian Smart Integrated Management Platform System XCamera.ashx sql injection6.9 Medium
- fujian smart integrated management platform systemFujian Smart Integrated Management Platform System XAccessPermissionPlus.ashx sql injection6.9 Medium
- opensourcepos open source point of saleOpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the...5.3 Medium
- tanium assetASSET-77066.3 Medium
- delinea cloud suiteImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...9.3 Critical
- wcproducttable product table and list builder for woocommerce liteProduct Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter7.5 High
- tomdever wpforo forumwpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection7.5 High
- nestersoft worktime, nestersoft inc. worktime (on-prem/cloud) +1 moreSQL Injection in NesterSoft WorkTime8.8 High
- bit apps form, unknown bit form +1 moreWordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability7.6 High
- Show moreLoading…