CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- element invader elementinvader addons for elementorWordPress ElementInvader Addons for Elementor plugin <= 1.4.2 - SQL Injection vulnerability8.5 High
- wpfactory advanced woocommerce product sales reportingWordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability9.3 Critical
- nootheme organici libraryWordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerability8.5 High
- pebas lisfinity coreWordPress Lisfinity Core plugin <= 1.5.0 - SQL Injection vulnerability9.3 Critical
- opencart, opencart core +1 moreOpenCart Core 4.0.2.3 SQL Injection via search Parameter8.8 High
- schiocco support boardSQL Injection vulnerability in Support Board8.7 High
- code-projects simple laundry systemcode-projects Simple Laundry System Parameter checkcheckout.php sql injection6.9 Medium
- itsourcecode college management systemitsourcecode College Management System Parameter add-single-student-results.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP GET Parameter update_purchase.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP GET Parameter update_out_standing.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP GET Parameter update_customer_details.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injection5.3 Medium
- mobsf mobile-security-framework-mobsf, opensecurity mobile security framework +1 moreMobSF has SQL Injection in its SQLite Database Viewer Utils5.3 Medium
- zabbixBlind, read-only SQL injection in Zabbix API via sortfield parameter8.7 High
- parse-community parse-serverParse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter8.6 High
- endonesia portaleNdonesia Portal v8.7 SQL Injection via banners.php8.8 High
- bootstrapy cmsBootstrapy CMS Lastest Multiple SQL Injection via Forum and Contact Modules8.8 High
- netartmedia vlog systemNetartmedia Vlog System Lastest SQL Injection via email Parameter8.8 High
- inoutscripts inout article base cmsInout Article Base CMS Lastest SQL Injection via portalLogin.php8.8 High
- matri4web matrimony website scriptMatrimony Website Script M-Plus Multiple SQL Injection8.8 High
- meeplace business review scriptMeeplace Business Review Script Lastest SQL Injection via addclick.php7.1 High
- zeeways jobsite cmsZeeways Jobsite CMS Lastest SQL Injection via id Parameter8.8 High
- zeeways matrimony cmsZeeways Matrimony CMS Lastest SQL Injection via profile_list8.8 High
- crocoblock jetengineJetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via Listing Grid 'filtered_query' Parameter7.5 High
- itsourcecode online enrollment systemitsourcecode Online Enrollment System Parameter index.php sql injection6.9 Medium
- projectworlds online admission systemSourceCodester Online Admission System programmes.php sql injection6.9 Medium
- code-projects online library management systemSourceCodester Online Library Management System Parameter home.php sql injection6.9 Medium
- stellarwp learndash lmsLearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter6.5 Medium
- esiclivreSQL injection in Solicitante::resetaSenha() in esiclivre/esiclivre v0.2.2 and earlier allows...6.5 Medium
- sourcecodester online catering reservationSourceCodester Online Catering Reservation search.php sql injection6.9 Medium
- itsourcecode sanitize or validate this inputitsourcecode sanitize or validate this input Parameter subjects.php sql injection5.3 Medium
- sourcecodester e-commerce siteSourceCodester E-Commerce Site products.php sql injection6.9 Medium
- wpjobportal wp job portal – ai-powered recruitment system for company or job board websiteWP Job Portal <= 2.4.8 - Unauthenticated SQL Injection via 'radius' Parameter7.5 High
- expresstech quiz and survey master (qsm) – easy quiz and survey makerQuiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter6.5 Medium
- itsourcecode free hotel reservation systemitsourcecode Free Hotel Reservation System Parameter index.php sql injection6.9 Medium
- 648540858 wvp-gb28181-pro648540858 wvp-GB28181-pro Stream Proxy Query StreamProxyProvider.java selectAll sql injection5.3 Medium
- wwbn avideoAVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php7.1 High
- wwbn avideoAVideo has a Blind SQL Injection in Live Schedule Reminder via Unsanitized live_schedule_id in Scheduler_commands::getAllActiveOrToRepeat()8.1 High
- erupts erupterupts erupt EruptJpaUtils.java geneEruptHqlOrderBy sql injection6.9 Medium
- erupts erupterupts erupt MCP Tool EruptDataQuery.java EruptDataQuery sql injection5.3 Medium
- sinturnoSQL Injection in Sinturno9.3 Critical
- cuantisSQL Injection in Cuantis9.3 Critical
- helmholz myrex24v2, myrex24v2.virtual, mb connect line mbconnect24 +1 more +3 morePre-Auth Blind SQLi in userinfo Endpoint7.5 High
- code-projects simple laundry systemcode-projects Simple Laundry System Parameters checklogin.php sql injection6.9 Medium
- code-projects simple laundry systemcode-projects Simple Laundry System Parameters checkupdatestatus.php sql injection6.9 Medium
- code-projects simple laundry systemcode-projects Simple Laundry System Parameters viewdetail.php sql injection6.9 Medium
- sourcecodester simple e-learning systemSourceCodester Simple E-learning System User Profile Update sql injection5.3 Medium
- sourcecodester simple e-learning systemSourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injection5.3 Medium
- ahsanriaz26gmailcom sales and inventory systemSourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injection5.3 Medium
- Show moreLoading…