CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- sourcecodester hospitals patient records management systemSourceCodester Hospitals Patient Records Management System view_history.php sql injection5.3 Medium
- ultimate-form-builder-lite ultimate form builder liteWordPress Ultimate Form Builder Lite 1.3.7 SQL Injection via entry_id7.1 High
- harmistechnology ekrishtaJoomla! Component EkRishta 2.10 SQL Injection via username8.8 High
- harmistechnology ek rishtaJoomla! Component Ek Rishta 2.10 SQL Injection via user_detail8.8 High
- web-dorado contact form makerWordPress Contact Form Maker Plugin 1.12.20 SQL Injection7.1 High
- 10web form makerWordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php7.1 High
- behance smartshopSmartshop 1 SQL Injection via search.php8.8 High
- behance smartshopSmartshop 1 SQL Injection via product.php id Parameter8.8 High
- behance smartshopSmartshop 1 SQL Injection via category.php8.8 High
- quantumnous new-apiQuantumNous new-api self Endpoint topup.go SearchAllTopUps sql injection5.3 Medium
- bestpractical rtRT: SQL injection via entry_aggregator parameter in JSON search8.8 High
- yeswikiYesWiki: Unauthenticated SQL Injection9.8 Critical
- centralny instytut ochrony pracy - państwowy instytut badawczy sterSQL Injection in STER8.7 High
- wedevs wp erp proWP ERP Pro <= 1.5.1 - Unauthenticated SQL Injection via 'search_key' Parameter7.5 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/mobile_main.php id Parameter7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via message.php frm_ticket_id and frm_resp_id Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via db_loader.php Multiple Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker Data8.8 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via portal/ajax/list_requests.php sort and dir Parameters7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/sit_incidents.php offset Parameter7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via ajax/fullsit_incidents.php offset Parameter7.1 High
- open ises ticketsOpen ISES Tickets < 3.44.2 SQL Injection via tables.php Multiple Parameters7.1 High
- wp directory kit directory kit, wpdirectorykit wp directory kit +1 moreWordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability9.3 Critical
- netatalkSQL injection in MySQL CNID backend8.8 High
- yith woocommerce product add-onsWordPress YITH WooCommerce Product Add-Ons plugin <= 4.29.0 - SQL Injection vulnerability7.6 High
- brainstormforce surecartSurecart - SQL Injection9.3 Critical
- awesomemotive nextgen galleryNextGEN Gallery - SQL Injection9.3 Critical
- tonnet tpr7308TONNET｜E-LAN Hybrid Recording System - SQL Injection8.7 High
- microsoft boostBoost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters7.5 High
- edmon.parker read more & accordionRead More & Accordion <= 3.5.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- constantcontact creative mail – easier wordpress & woocommerce email marketingCreative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter7.5 High
- infility globalInfility Global <= 2.15.16 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter6.5 Medium
- veritas infoscale operations managerSQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.6.5 Medium
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 28.1.6 - Unauthenticated SQL Injection7.5 High
- typo3 extension "address list"SQL Injection in extension "Address List" (tt_address)8.2 High
- typo3 extension "news system"SQL Injection in extension "News system" (news)8.2 High
billabear/billabearPackagistBillaBear is Vulnerable to SQL Injection in the EventRepository8.8 High- alinto sogo webmailSOGo < 5.12.8 SQL Injection via addUserInAcls endpoint8.6 High
- opajaap wp photo album plusWP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter8.6 High
- projectworlds hospital-management-system-in-phpprojectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection6.9 Medium
- linlinjava litemalllinlinjava litemall Admin Endpoint sql injection5.1 Medium
- linlinjava litemalllinlinjava litemall Front-end WeChat API WxGoodsController.java list sql injection6.9 Medium
- bylancer zechatZechat 1.5 SQL Injection via v parameter (time-based blind)8.8 High
- bylancer zechatZechat 1.5 SQL Injection via hashtag parameter8.8 High
- nordex-online n149 wind turbine web serverNordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection8.8 High
- joomlaextensions joomla! extension ekrishtaJoomla! EkRishta 2.10 Persistent XSS and SQL Injection8.8 High
- wende60 redaxo cms addon myeventsRedaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.php7.1 High
- oinone pamirsOinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injection6.9 Medium
- Show moreLoading…