CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- jettweb rent a car scripti, php ready rent a car site script +1 moreJettweb Hazir Rent A Car Scripti V4 SQL Injection via admin8.8 High
- jettweb hazir rent a car sitesi scripti, php ready rent a car site script +1 moreJettweb PHP Hazir Rent A Car Sitesi Scripti V2 SQL Injection8.8 High
- iscripts reservelogiciScripts ReserveLogic Lastest SQL Injection via search endpoint8.8 High
- inoutscripts inout realestateInout RealEstate Lastest SQL Injection via agentlistdetails8.8 High
- softwebinternational clinic proClinic Pro SQL Injection via monthly_expense_overview month Parameter7.1 High
- itsourcecode cafe reservation systemitsourcecode Cafe Reservation System Registration signup.php sql injection6.9 Medium
- itsourcecode online doctor appointment systemitsourcecode Online Doctor Appointment System doctor_action.php sql injection6.9 Medium
- itsourcecode online doctor appointment systemitsourcecode Online Doctor Appointment System patient_action.php sql injection6.9 Medium
- premio my sticky bar – floating notification bar & sticky header (formerly mystickymenu)My Sticky Bar <= 2.8.6 - Unauthenticated SQL Injection via 'stickymenu_contact_lead_form' Action7.5 High
- feminer wmsFeMiner wms Basic Organizational Structure depart_add_bg.php sql injection6.9 Medium
- gl-inet ar300m16 firmwareGL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the...8.8 High
- xierongwkhd weimai-wetappxierongwkhd weimai-wetapp Endpoint HomeController.java getLikeMovieList sql injection5.1 Medium
- open-emr openemrSQL Injection Vulnerability in ajax graphs library (OpenEMR)8.8 High
- xierongwkhd weimai-wetappxierongwkhd weimai-wetapp Admin_AdminUserController.java getAdmins sql injection5.1 Medium
- parse-community parse-serverParse Server has a SQL injection via query field name when using PostgreSQL5.1 Medium
- labredescefetrj wegiaWeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php9.8 Critical
- labredescefetrj wegiaWeGIA has a SQL Injection via Direct Query Interpolation in restaurar_produto.php8.8 High
- elated-themes frappeFrappe SQL Injection due to improper field sanitization9.3 Critical
- varient sql inj.Varient 1.6.1 SQL Injection via user_id Parameter8.8 High
- crocoblock jetbookingJetBooking <= 4.0.3 - Unauthenticated SQL Injection via 'check_in_date' Parameter7.5 High
- angeljudesuarez university management systemitsourcecode University Management System att_add.php sql injection6.9 Medium
- qnap video stationVideo Station0.1 Low
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter7.5 High
- kohaAuthenticated SQL Injection in Koha displayby parameter of suggestion.pl8.7 High
- flippercode wp maps – store locator,google maps,openstreetmap,mapbox,listing,directory & filtersWP Maps <= 4.9.1 - Unauthenticated SQL Injection via 'location_id' Parameter7.5 High
- elemntor ally – web accessibility & usabilityAlly – Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path7.5 High
- parse-community parse-serverParse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL9.3 Critical
- craftcms cms, craft cms +1 moreCraftCMS's `ElementSearchController` Affected by Blind SQL Injection8.7 High
- parse-community parse-serverParse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL9.3 Critical
- No product listedAn issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command...9.8 Critical
- syliusSylius has a DQL Injection via API Order Filters5.3 Medium
- sequelize, red hat confidential compute attestation, enterprise linux 10 +2 more +4 moreSequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type7.5 High
- parse-community parse-serverParse Server has a SQL injection via dot-notation field name in PostgreSQL9.3 Critical
- craftcms commerce, craft commerce +1 moreCraft Commerce has a SQL Injection in Commerce Inventory Table Sorting8.7 High
- craftcms commerce, craft commerce +1 moreCraft Commerce has a SQL Injection in Commerce Purchasables Table Sorting8.7 High
- microsoft sql server 2025 (cu 2), sql server 2025 for x64-based systems (gdr), sql server 2016 +4 more +6 moreSQL Server Elevation of Privilege Vulnerability8.8 High
- fortinet fortianalyzer, fortianalyzer-bigdata, fortianalyzer big data +2 moreAn improper neutralization of special elements used in an sql command ('sql injection')...5.6 Medium
- bukts buk ts-g gas station automation systemSQL Injection in Nefteprodukttekhnika BUK TS-G Allows Remote Code Execution9.3 Critical
- sap se netweaver (feedback notification)SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)6.4 Medium
- limesurveyLimeSurvey is vulnerable to SQL injection7.5 High
- nicolargo glancesGlances has SQL Injection via Process Names in TimescaleDB Export7.3 High
- tiandy easy7 cms windows, easy7 cms +1 moreTiandy Easy7 CMS Windows GetDBData.jsp sql injection6.9 Medium
- eventobotSQL injection in Eventobot8.7 High
- janobe resort reservation systemSourceCodester/janobe Resort Reservation System room_rates.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System GET Parameter sales_invoice1.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System GET Parameter purchase_invoice.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System Search dashboard.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System POST Parameter check_supplier_details.php sql injection5.3 Medium
- easycmsEasyCMS Request Parameter RbacuserAction.class.php sql injection5.3 Medium
- easycmsEasyCMS Request Parameter RbacnodeAction.class.php sql injection5.3 Medium
- Show moreLoading…