CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection5.3 Medium
- flippercode wp maps – store locator,google maps,openstreetmap,mapbox,listing,directory & filtersWP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection via 'orderby' Parameter7.5 High
- code-projects simple gym management systemcode-projects Simple Gym Management System func.php sql injection5.1 Medium
- projectworlds online notes sharing systemprojectworlds Online Notes Sharing System Parameters login.php sql injection6.9 Medium
- code-projects simple food ordering system, carmelo simple food order system +1 morecode-projects Simple Food Ordering System all-tickets.php sql injection5.3 Medium
- apconw aix-dbapconw Aix-DB terminology_retriever.py sql injection4.8 Medium
- i-doit doit cmdb, i-doit +1 morei-doit CMDB 1.12 SQL Injection via objGroupID Parameter8.8 High
- codnloc phptransformerphpTransformer 2016.9 SQL Injection via GeneratePDF.php8.8 High
- keplerwallpapers kepler wallpaper scriptKepler Wallpaper Script 1.1 SQL Injection via category8.8 High
- simplepresscms simplepress cmsSimplePress CMS 1.0.7 SQL Injection via p and s Parameters8.8 High
- greencms green cms, njtech greencms +1 moreGreen CMS 2.x SQL Injection via cat Parameter7.1 High
- vanna-ai vannavanna-ai vanna base.py ask sql injection5.3 Medium
- wpdive elementcampElementCamp <= 2.3.6 - Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter6.5 Medium
- sam perrow pre* party resource hintsPre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter6.5 Medium
- quentn wp, quentn.com gmbh quentn wp +1 moreQuentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie7.5 High
- wisdomlogix fonts manager | custom fontsFonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter7.5 High
- thoefter cms commander – manage multiple sitesCMS Commander <= 2.288 - Authenticated (Custom+) SQL Injection via 'or_blogname' Parameter8.8 High
- silvercover mylinksdumpmyLinksDump <= 1.6 - Authenticated (Administrator+) SQL Injection via 'sort_by' and 'sort_order' Parameters7.2 High
- No product listedPbootCMS Member Login MemberController.php checkUsername sql injection6.9 Medium
- mindinventory mindsqlMindinventory MindSQL mindsql_core.py ask_db sql injection5.3 Medium
- ory ketoOry Keto has a SQL injection via forged pagination tokens7.2 High
- ory hydraOry Hydra has a SQL injection via forged pagination tokens7.2 High
- go-kratos kratosOry Kratos has a SQL injection via forged pagination tokens7.2 High
- kyselyKysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings8.1 High
- kyselyKysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.8.1 High
- wwbn avideoAVideo has an Unauthenticated Blind SQL Injection in RTMP on_publish Callback via Stream Name Parameter7.5 High
- eosphoros-ai db-gpteosphoros-ai db-gpt Incomplete Fix editor sql injection6.9 Medium
- qnap qurouterQuRouter7.3 High
- itsourcecode college management systemitsourcecode College Management System search_student.php sql injection5.3 Medium
- labredescefetrj wegiaWeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter9.3 Critical
- labredescefetrj wegiaWeGIA has an arbitrary SQL execution vulnerability via crafted backup archive8.6 High
- itsourcecode online doctor appointment systemitsourcecode Online Doctor Appointment System appointment_action.php sql injection5.1 Medium
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System admin_edit_supplier.php sql injection5.3 Medium
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System admin_edit_employee.php sql injection5.1 Medium
- wwbn avideo-encoderAVideo-Encoder is Vulnerable to Authenticated SQL Injection via ORDER BY Clause8.6 High
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injection5.1 Medium
- frappe erpnextERP has a possibility SQL Injection vulnerability due to missing validation7.1 High
- dataease sqlbotSQLBot: RCE via SQL Injection in Excel Upload Endpoint8.6 High
- adonesevangelista online frozen foods ordering systemitsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php sql injection5.1 Medium
- opensourcepos open source point of sale, opensourcepos +1 moreOpen Source Point of Sale is Vulnerable to SQL Injection Through its Item Search Functionality8.8 High
- suitecrmSuiteCRM has Authenticated SQL Injection in Authentication Module8.8 High
- suitecrmSuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.8.8 High
- suitecrmSuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields8.1 High
- wwbn avideoAVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass)9.8 Critical
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.10.0 - Unauthenticated SQL Injection via 'fields' Parameter7.5 High
- cozmoslabs profile builder proWordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability9.3 Critical
- No product listedDevome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities...8.8 High
- Show moreLoading…