CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- ghostfol ghostfolioGhostfolio: Time-Based Blind SQL Injection in Manual Asset Import9.3 Critical
- chartbrewChartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)8.8 High
- defaultfuction jeson customer relationship management systemDefaultFuction Jeson Customer Relationship Management System edit.php sql injection5.3 Medium
- openreplayOpenReplay: SQL injection in cards/search via unvalidated sort field parameter6.9 Medium
- elated-themes frappeFrappe: Possibility of SQL Injection due to improper fieldname sanitization6.5 Medium
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module8.6 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports8.6 High
- carlosfazenda fast page & post duplicatorPage and Post Clone <= 6.3 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter6.5 Medium
- loopus wp attractive donations system - easy stripe & paypal donationsWordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection vulnerability9.3 Critical
- eagle-themes eagle bookingWordPress Eagle Booking plugin <= 1.3.4.3 - SQL Injection vulnerability8.5 High
- essekia tablesomeWordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerability8.5 High
- don-themes riode coreWordPress Riode Core plugin <= 1.6.26 - SQL Injection vulnerability9.3 Critical
- blobfolio apocalypse meowApocalypse Meow <= 22.1.0 - Authenticated (Administrator+) SQL Injection via 'type' Parameter4.9 Medium
- cisco secure firewall management center (fmc), secure firewall management center +1 moreA vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote...4.9 Medium
- cisco secure firewall management center (fmc), secure firewall management center +1 moreA vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an...8.1 High
- ashopsoftware ashop shopping cart softwareAshop Shopping Cart Software Lastest SQL Injection via index.php8.8 High
- freesmsFreeSMS 2.1.2 Authentication Bypass via SQL Injection8.8 High
- bdtask tradeboxTradebox 5.4 SQL Injection via symbol Parameter7.1 High
- ncrypted jobgatorNCrypted Jobgator Lastest SQL Injection via agents Find-Jobs8.8 High
- blondish phpadsPHPads 2.0 SQL Injection via click.php3 bannerID7.1 High
- niteosoft simple job script, simplejobscript +1 moreSimple Job Script SQL Injection via delete_application_ajax.php8.8 High
- niteosoft simple job script, simplejobscript +1 moreSimple Job Script SQL Injection via register-recruiters endpoint8.8 High
- niteosoft simple job script, simplejobscript +1 moreSimple Job Script SQL Injection via get_job_applications_ajax.php8.8 High
- niteosoft simple job script, simplejobscript +1 moreSimple Job Script SQL Injection via searched Endpoint8.8 High
- cisco secure firewall management center (fmc)Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities6.5 Medium
- rabilal js help desk – ai-powered support & ticketing systemJS Help Desk – AI-Powered Support & Ticketing System 2.8.2 - Unauthenticated SQL Injection via 'js-support-ticket-token-tkstatus' Cookie7.5 High
- cbutlerjr wp-members membership pluginWP-Members Membership Plugin <= 3.5.5.1 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute6.5 Medium
- icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpressEmail Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter6.5 Medium
- databasirSQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to...9.8 Critical
- faintsnow hardware read \& write utilityAn issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25...9.8 Critical
- angeljudesuarez college management systemitsourcecode College Management System class-result.php sql injection5.1 Medium
- b3log siyuanSiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access5.7 Medium
- angeljudesuarez college management systemitsourcecode College Management System student-fee.php sql injection5.1 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import6.5 Medium
- oretnom23 simple logistic hub parcel\'s management systemSourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in ...7.2 High
- oretnom23 simple logistic hub parcel\'s management systemSourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in ...2.7 Low
- oretnom23 pharmacy point of sale systemSourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy...2.7 Low
- oretnom23 pharmacy point of sale systemSourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy...2.7 Low
- oretnom23 pharmacy point of sale systemSourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy...2.7 Low
- oretnom23 pharmacy point of sale systemSourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy...2.7 Low
- oretnom23 simple online men\'s salon management systemSourcecodester Simple Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in...2.7 Low
- oretnom23 simple online men\'s salon management systemSourcecodester Simple Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in...2.7 Low
- oretnom23 simple online men\'s salon management systemSourcecodester Simple Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in...2.7 Low
- oretnom23 simple online men\'s salon management systemSourcecodester Simple Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in...2.7 Low
- renren renren-securityrenren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component9.8 Critical
- nokia impactNokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time...8.2 High
- wwbn avideoWWBN AVideo: Unauthenticated SQL Injection via JSON Request Bypass in objects/videos.json.php9.8 Critical
- cocoindexCocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements6.9 Medium
- google androidIn multiple locations, there is a possible information disclosure due to SQL injection. This...8.4 High
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 28.1.4 - Unauthenticated SQL Injection7.5 High
- Show moreLoading…