CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- ivanti endpoint managerSQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a...8.8 High
- elixir-ecto postgrexSQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/37.5 High
- dovecot, open-xchange gmbh ox dovecot pro, red hat enterprise linux 10 +3 more +5 moreWhen safe filter is used with variable expansion, all following pipelines on the same string are...7.4 High
- wp travel travelWordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerability7.7 High
- xpro elementor addonsWordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability8.5 High
- realmag777 bearWordPress BEAR plugin <= 1.1.7.1 - SQL Injection vulnerability7.6 High
- saad iqbal apiexperts square for woocommerceWordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerability8.5 High
- aman views for wpformsWordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerability8.5 High
- aman ninja forms views – display & edit ninja forms submissions on your site frontendWordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerability8.5 High
- akilli commerce software technologies ltd. co. e-commerce websiteSQLi in Akilli Commerce's E-Commerce Website9.8 Critical
- siemens blueplanet 100 nx3 m8, blueplanet 100 tl3 gen2, blueplanet 105 tl3 +26 more +28 moreA vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3...5.9 Medium
- 10up eight day week print workflowEight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter6.5 Medium
- wupsales ai chatbot & workflow automation by aiwuAI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated SQL Injection in getListForTbl()7.5 High
- sap se hana deployment infrastructure (hdi) deploy librarySQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library3.4 Low
- sap se s/4hana (sap enterprise search for abap)SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)9.6 Critical
- kysely-org kyselyKysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`7.5 High
- studio-42 elfinderelFinder: SQL Injection MySQL Volume Driver (elFinderVolumeMySQL)8.8 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout8.7 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution8.7 High
- cortezaproject cortezaCorteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping6.0 Medium
- No product listedHireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied...9.8 Critical
- No product listedSQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the...7.3 High
- modalsurvey survey & pollWordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_params8.8 High
- balbooa joomla forms builderBalbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated8.8 High
- opencartextensions extension tmd vendor systemOpencart TMD Vendor System 3.x Blind SQL Injection via product route8.8 High
- codeastro online catering ordering systemCodeAstro Online Catering Ordering System deleteorder.php sql injection5.3 Medium
- php, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreSQL injection in pdo_firebird via NUL bytes in quoted strings7.4 High
- gibbonedu gibbonGibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by...7.0 High
- emlogEmlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions10.0 Critical
- @mikro-orm knex, sql, mikro-orm +2 moreMikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys7.6 High
- mervinpraison praisonaiPraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries6.3 Medium
- unknown ottokit: all-in-one automation platformSureTriggers < 1.1.23 – Unauthenticated SQLi8.6 High
- zyx0814 filepresszyx0814 FilePress Shares Filelist API admin.php sql injection6.9 Medium
- codeastro leave management systemCodeAstro Leave Management System login.php sql injection6.9 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping replymsg.php sql injection6.9 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping message.php sql injection6.9 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping wishlist.php sql injection6.9 Medium
- sourcecodester sup online shoppingSourceCodester SUP Online Shopping viewmsg.php sql injection6.9 Medium
- sourcecodester comment systemSourceCodester Comment System post_comment.php sql injection6.9 Medium
- code-projects simple chat systemcode-projects Simple Chat System sendMessage.php sql injection5.3 Medium
- No product listedBeauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via...9.8 Critical
- No product listedSOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with...6.3 Medium
- No product listedPrison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability...7.3 High
- No product listedCertain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in...9.8 Critical
- No product listedJeecgBoot JSON Object loadTreeData sql injection5.3 Medium
- code-projects feedback systemcode-projects Feedback System checklogin.php sql injection6.9 Medium
- codeastro online classroomCodeAstro Online Classroom askquery.php sql injection5.3 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection6.9 Medium
- wpmart team memberWordPress Team Member plugin <= 8.5 - SQL Injection vulnerability7.6 High
- betterdocs proBetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter7.5 High
- Show moreLoading…