CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- mailcow mailcow-dockerizedmailcow: dockerized vulnerable to Second Order SQL Injection in quarantine category via API7.2 High
- zeon global tech academy proSQL injection in Zeon Academy Pro by Zeon Global Tech9.3 Critical
- tholstkabelbwde plugin: cms für motorrad werkstättenPlugin: CMS für Motorrad Werkstätten <= 1.0.0 - Authenticated (Subscriber+) SQL Injection via 'arttype' Parameter6.5 Medium
- openbaoOpenBao allows SQL Injection in PostgreSQL database secrets engine4.6 Medium
- nicolargo glancesGlances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values6.3 Medium
- apache doris mcp serverApache Doris MCP Server: MCP SQL inject5.3 Medium
- metasoft 美特软件 metacrmMetasoft 美特软件 MetaCRM Interface sql.jsp Statement.executeUpdate sql injection6.9 Medium
- phili67 ecclesia crmphili67 Ecclesia CRM Query Viewer view ValidateInput sql injection5.3 Medium
- digiwin easyflow .netDigiwin｜EasyFlow .NET - SQL Injection9.3 Critical
- digiwin easyflow .netDigiwin｜EasyFlow .NET - SQL Injection9.3 Critical
- projectsandprograms school management systemProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection6.9 Medium
- No product listedSQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management...7.5 High
- No product listedSQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management...8.2 High
- No product listedSQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management...9.4 Critical
- dameng100 muucmfdameng100 muucmf index.html getListByPage sql injection6.9 Medium
- dagster-io dagsterDagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations8.3 High
- yeswikiYesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()8.8 High
- churchcrm crmChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`7.1 High
- mervinpraison praisonai, praison praisonaiagents +1 morePraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)8.1 High
- labredescefetrj wegiaWeGIA has SQL Injection via Session Variable Override in DespachoControle.php8.8 High
- querymine smsQueryMine sms GET Request Parameter deletecourse.php sql injection6.9 Medium
- querymine smsQueryMine sms GET Request Parameter editcourse.php sql injection5.3 Medium
- sparx systems pty ltd. pro cloud serverUnauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server9.5 Critical
- cubecartAn SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to...5.1 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter6.5 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.40 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter4.9 Medium
- stylemix masterstudy lms wordpress plugin – for online courses and educationMasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters6.5 Medium
- No product listedA SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote...9.8 Critical
- saltcornSaltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId)10.0 Critical
- dataeaseDataEase has SQL Injection via Stacked Queries8.7 High
- dataeaseDataEase SQL Injection Vulnerability8.6 High
- dataeaseDataEase has SQL Injection via Datasource Management8.6 High
- dataeaseDataEase has SQL Injection via Datasource Save Flow8.7 High
- dataeaseDataEase has SQL Injection through its getFieldEnumObj Endpoint8.7 High
- dataeaseDataEase has SQL Injection in Order By Clause8.7 High
- dataeaseDataEase: SQL Injection in v2 Dataset Export8.7 High
- zohocorp manageengine pam360, manageengine password manager pro +1 moreSQL Injection8.1 High
- designinvento directorypress – business directory and classified ad listingDirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'7.5 High
- onlineada accessibility suite by ability, incAccessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter6.5 Medium
- imprintnext riaxe product customizerRiaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_data7.5 High
- No product listedSourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in...9.1 Critical
- No product listedSourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in...4.7 Medium
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...9.8 Critical
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...7.2 High
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...7.2 High
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...7.2 High
- No product listedSourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the...7.2 High
- No product listedSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the...9.8 Critical
- No product listedSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the...9.8 Critical
- No product listedSourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the...9.4 Critical
- Show moreLoading…