CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- pierrelannoy mailarchiverMailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter4.9 Medium
- jizhicmsjizhiCMS Batch Model.php findAll sql injection5.3 Medium
- youlai youlai-mallyoulaitech youlai-mall App-side Product Pagination Endpoint SpuController.java listPagedSpuForApp sql injection5.3 Medium
- phishing.club phishing club, phishingclub +1 morePhishing Club has Authenticated Blind SQL Injection in GetOrphaned Recipient Listing6.5 Medium
- itsourcecode school management systemitsourcecode School Management System Setting index.php sql injection6.9 Medium
- spipSPIP < 4.4.10 SQL Injection RCE via Union & PHP Tags8.7 High
- discourseDiscourse has SQL injection in PM tag filtering4.9 Medium
- n8nn8n - SQL Injection in MySQL, PostgreSQL, and Microsoft SQL Nodes5.3 Medium
- simple sa simple.erpSQL Injection in SIMPLE.ERP8.6 High
- veronalabs wp smsWordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability7.6 High
- fleetdm fleetFleet has a SQL injection via backtick escape in ORDER BY parameter5.1 Medium
- n8nn8n has Potential Remote Code Execution via Merge Node9.4 Critical
- z-9527 adminz-9527 admin user.js getUsers sql injection6.9 Medium
- open-emr openemrOpenEMR has SQL Injection Vulnerability8.8 High
- open-emr openemrOpenEMR has SQL Injection in Patient API Sort Parameter10.0 Critical
- open-emr openemrOpenEMR has SQL Injection in Immunization Search/Report7.4 High
- opensipsOpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass8.3 High
- linksys mr9600, mx4200 +1 moreMissing authentication in Linksys MR9600, Linksys MX42009.8 Critical
- redhat developer hub, red hat developer hub 1.8, developer hub 1.9 +2 moreRhdh: graphql injection leading to platform-wide denial of service (dos) in rh developer hub orchestrator plugin6.5 Medium
- cyberhobo geo mashupGeo Mashup <= 1.13.17 - Unauthenticated SQL Injection via 'sort' Parameter7.5 High
- clive 21 news portal projectitsourcecode News Portal Project contactus.php sql injection6.9 Medium
- admerc document management systemitsourcecode Document Management System register.php sql injection6.9 Medium
- angeljudesuarez college management systemitsourcecode College Management System teacher-salary.php sql injection6.9 Medium
- angeljudesuarez college management systemitsourcecode College Management System login.php sql injection6.9 Medium
- angeljudesuarez college management systemitsourcecode College Management System display-teacher.php sql injection5.3 Medium
- angeljudesuarez college management systemitsourcecode College Management System asign-single-student-subjects.php sql injection5.3 Medium
- haben-cs9 simple and nice shopping cart scriptSourceCodester Simple and Nice Shopping Cart Script signup.php sql injection6.9 Medium
- spip referer spamSPIP referer_spam < 1.3.0 Unauthenticated SQL Injection9.3 Critical
- spip interface traduction objetsSPIP interface_traduction_objets < 2.2.2 Authenticated SQL Injection7.1 High
- clive 21 news portal projectitsourcecode News Portal Project add-category.php sql injection6.9 Medium
- clive 21 news portal projectitsourcecode News Portal Project edit-category.php sql injection6.9 Medium
- admerc document management systemitsourcecode Document Management System Login loging.php sql injection6.9 Medium
- insat masterscada, masterscada buk-ts +1 moreInSAT MasterSCADA BUK-TS SQL Injection9.3 Critical
- acquia mauticSQL Injection in Contact Activity API Sorting7.6 High
- apache supersetApache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering5.3 Medium
- apache supersetApache Superset: Improper Neutralization of Special Elements used in a SQL Command5.3 Medium
- dotcmsA sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows...9.4 Critical
- admerc document management systemitsourcecode Document Management System edtlbls.php sql injection6.9 Medium
- admerc document management systemitsourcecode Document Management System deluser.php sql injection6.9 Medium
- pimcorePimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause6.9 Medium
- a54552239 pearprojectapia54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection5.3 Medium
- emiloi e-logbook with health monitoring system for covid-19itsourcecode E-Logbook with Health Monitoring System for COVID-19 check_profile_old.php sql injection6.9 Medium
- admerc event management systemitsourcecode Event Management System index.php sql injection6.9 Medium
- collerek ormarormar is vulnerable to SQL Injection through aggregate functions min() and max()9.8 Critical
- manantial de ideas infoticketingSQL injection in Infoticketing9.3 Critical
- zohocorp manageengine adselfservice plusSQL Injection8.3 High
- order up online ordering systemSQL injection vulnerability in Order Up Online Ordering System9.8 Critical
- jinher oa c6Jinher OA C6 OfficeSupplyTypeRight.aspx sql injection5.3 Medium
- web-ofisi rent a carWeb Ofisi Rent a Car v3 SQL Injection via klima Parameter8.8 High
- web-ofisi platinum e-ticaret, ticaret +1 moreWeb Ofisi Platinum E-Ticaret v5 SQL Injection via ajax/productsFilterSearch8.8 High
- Show moreLoading…