CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- dataeaseDataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection5.1 Medium
- getfuelcms fuel cmsFuel CMS 1.4.13 Blind SQL Injection via col Parameter7.1 High
- egavilanmedia phpcrudEgavilanMedia PHPCRUD 1.0 SQL Injection via firstname8.8 High
- layerbbLayerBB 1.1.4 SQL Injection via search_query Parameter8.8 High
- supsystic membershipWordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx8.8 High
- supsystic pricing tableWordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS8.8 High
- supsystic ultimate mapsWordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx8.8 High
- givanz vvvebVvveb: Authenticated SQL injection in /user/orders via order_by and direction8.7 High
- timeclock php timeclockPHP Timeclock 1.04 SQL Injection via login.php8.8 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter4.9 Medium
- jasperfx martenMarten has an SQL injection vulnerability in its full-text search regConfig parameter9.8 Critical
- macwarrior clipbucket-v5ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')7.1 High
- n8nn8n: Source Control Pull SQL Injection8.9 High
- postgresqlPostgreSQL REFRESH PUBLICATION allows SQL injection via table name3.7 Low
- postgresqlPostgreSQL refint allows stack buffer overflow and SQL injection8.8 High
- postgresqlPostgreSQL pg_createsubscriber allows SQL injection via subscription name7.2 High
- akilli commerce software technologies ltd. co. e-commerce websiteSQLi in Akıllı Ticaret's E-Commerce Pack9.8 Critical
- taskbuilder – project management & task management tool with kanban boardTaskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter6.5 Medium
- alinto sogoSOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored,...7.1 High
- alinto sogoSOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.7.1 High
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter6.5 Medium
- webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 moreInsufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL...8.1 High
- frappe erpnextERPNext: Possibility of SQL Injection due to missing validation8.8 High
- frappe erpnextERPNext: Possibility of SQL Injection due to missing validation8.8 High
- phili67 ecclesiacrmIncomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm8.7 High
- mispMISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings9.3 Critical
- cubecart v6CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing4.9 Medium
- cubecart v6CubeCart: Time-based Blind SQL Injection7.2 High
- strapi, strapi @strapi/content-type-builder +1 moreStrapi Vulnerable to SQL Injection in Content Type Builder9.3 Critical
- palo alto networks trust protection foundationTrust Protection Foundation: SQL Injection Vulnerability6.1 Medium
- joomsky j2 jobsJoomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby7.1 High
- joomsky j2 jobsJoomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby7.1 High
- hdwplayer com hdwplayerJoomla com_hdwplayer 4.2 SQL Injection via search.php8.8 High
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter6.5 Medium
- themefusion avada (fusion) builderAvada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter7.5 High
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter7.5 High
- smub charitable – donation plugin for wordpress – fundraising with recurring donations & moreCharitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter6.5 Medium
- advantech ecowatch saas-composer, iot edge linux docker, iot edge windows +5 more +7 moreSQL Injection Vulnerability7.2 High
- No product listedqihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the...6.5 Medium
- No product listedqihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the...6.5 Medium
- webmuehle court reservation – manage your court bookings onlineCourt Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection7.5 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems7.2 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems7.2 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems7.2 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems7.2 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 moreAuthenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems7.2 High
- shelf-nu shelf.nuShelf: SQL Injection via sortBy Parameter6.5 Medium
- fortinet fortimailAn improper neutralization of special elements used in an SQL Command ("SQL Injection&")...6.3 Medium
- fortinet fortindrAn improper neutralization of special elements used in an sql command ('sql injection')...4.9 Medium
- artica pandora fms, pandora fms fms +1 moreSQL Injection in Graph Container Parameter7.6 High
- Show moreLoading…