CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- aiopmsd finalAiOPMSD Final 1.0.0 SQL Injection via watch.php8.8 High
- aiopmsd finalAiOPMSD Final 1.0.0 SQL Injection via genre.php8.8 High
- aiopmsd finalAiOPMSD Final 1.0.0 SQL Injection via year.php8.8 High
- aiopmsd finalAiOPMSD Final 1.0.0 SQL Injection via quality.php8.8 High
- aiopmsd finalAiOPMSD Final 1.0.0 SQL Injection via country.php8.8 High
- aiopmsd finalAiOPMSD Final 1.0.0 SQL Injection via director Parameter8.8 High
- aiopmsd finalAiOPMSD Final 1.0.0 SQL Injection via actor.php8.8 High
- aiopmsd finalAiOPMSD Final 1.0.0 SQL Injection via search.php8.8 High
- m-gb mgb opensource guestbookMGB OpenSource Guestbook 0.7.0.2 SQL Injection via email.php8.8 High
- simpkh sim-pkhSIM-PKH 2.4.1 SQL Injection via media.php id Parameter7.1 High
- endonesia portaleNdonesia Portal 8.7 SQL Injection via mod.php8.8 High
- endonesia portaleNdonesia Portal 8.7 SQL Injection via mod.php8.8 High
- endonesia portaleNdonesia Portal 8.7 SQL Injection via mod.php8.8 High
- ninjew geo my wpGEO my WP <= 4.5.5 - Unauthenticated SQL Injection via 'swlatlng' / 'nelatlng' Parameters7.5 High
- cyber-iii student-management-systemsambitraj STUDENT-MANAGEMENT-SYSTEM Login Page sql injection6.9 Medium
- code-projects student details management systemcode-projects Student Details Management System index.php sql injection6.9 Medium
- eidetic-labs stigmemstigmem Postgres SQL Injection via Schema Identifier7.5 High
- agenticmail @agenticmail/api, @agenticmail/core +1 moreAgenticMail API/storage and outbound relay hardening8.2 High
ezsystems/ezpublish-legacyPackagistezsystems/ezpublish-legacy has a SQL injection in dfscleanup7.1 High- agnoagno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()8.7 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via add_facnote.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via city_graph.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via inc_types_graph.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via sever_graph.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via form_post.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via nearby.php8.8 High
- open ises projectThe Open ISES Project 3.30A SQL Injection via main.php8.8 High
- kados r10 greenbeeKados R10 GreenBee SQL Injection via update_feature.php8.8 High
- kados r10 greenbeeKados R10 GreenBee SQL Injection via update_release.php8.8 High
- talagasoft maxon erpMaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter7.1 High
- sitejo hape pkhHaPe PKH 1.1 SQL Injection via desa Parameter8.8 High
- sitejo hape pkhHaPe PKH 1.1 SQL Injection via nama_kelompok Parameter8.8 High
- sitejo hape pkhHaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php8.8 High
- eregistrasi-kejuaraan-silat registrasi pencak silatE-Registrasi Pencak Silat 18.10 SQL Injection via id_partai8.8 High
- bylancer zechatZechat 1.5 SQL Injection via uname Parameter8.8 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports8.5 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter4.9 Medium
mautic/corePackagistMautic has SQL Injection in API Contact Filtering7.1 High- No product listedBolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages...6.5 Medium
- 10web photo gallery by 10web – mobile-friendly image galleryPhoto Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute6.5 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter7.5 High
- cache symfonySymfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix6.3 Medium
- langroidLangroid has Prompt to SQL Injection, Leading to RCE9.8 Critical
- leiweibau pi.alertPi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection8.7 High
- arjun thakur duplicate page and postWordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability8.5 High
- dalibo anonymizer, postgresql anonymizer +1 morePostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function6.8 Medium
- realmag777 active products tables for woocommerceWordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability9.3 Critical
- realmag777 tableonWordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability9.3 Critical
- hassantafreshi easy form builderWordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability9.3 Critical
- tainacanWordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability9.3 Critical
- Show moreLoading…