CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- mondial relay woocommerce - wcmultishipping wcmultishippingWordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerability8.5 High
- taskbuilderWordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability8.5 High
- implecode ecommerce product catalogWordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerability9.3 Critical
- jextensions store gptranslate – multilingual ai translation for wordpress: automatically translate websitesWordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability9.3 Critical
- yydevelopment advanced 301 and 302 redirectWordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability9.3 Critical
- elextensions elex wordpress helpdesk & customer ticketing systemWordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability8.5 High
- ahmad js help deskWordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability9.3 Critical
- codepeople wp time slots booking formWordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerability8.5 High
- ruben garcia gamipressWordPress GamiPress plugin <= 7.8.7 - SQL Injection vulnerability8.5 High
- realtyna organic idx pluginWordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerability9.3 Critical
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability9.3 Critical
- dev4press gd rating systemWordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability9.3 Critical
- tychesoftwares order delivery date for woocommerceWordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability9.3 Critical
- funnelkit funnel builder by funnelkitWordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability9.3 Critical
- tomdever wpforo forumWordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability9.3 Critical
- wasiliy strecker contest galleryWordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability9.3 Critical
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability8.5 High
- wpgraphqlWordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability7.5 High
- speakout! email petitions, steve d speakout! email petitions +1 moreWordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability9.3 Critical
- ahmad geekybotWordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability9.3 Critical
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability9.3 Critical
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability9.3 Critical
- 10web form maker by 10webWordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability9.3 Critical
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability9.3 Critical
- flipper code – wordpress development company wp mapsWordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability9.3 Critical
- naked cat plugins (by webdados) feed kuantokusta for woocommerce – freeWordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability9.3 Critical
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability8.5 High
- nceas metacatMetacat has an unauthenticated SQL injection vulnerability9.8 Critical
- codepeople booking calendar contact formWordPress Booking Calendar Contact Form 1.0.23 SQL Injection8.8 High
- slicedinvoices sliced invoicesWordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter7.1 High
- mattkaye answer my questionAnswer My Question 1.3 Plugin WordPress SQL Injection via modal.php8.8 High
- bbsetheme bbs e-franchiseBBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid8.8 High
- 404-redirection-manager 404 redirection managerWordPress 404 Redirection Manager Plugin 1.0 SQL Injection8.8 High
- codepeople booking calendar contact formWordPress Booking Calendar Contact Form 1.0.23 SQL Injection8.8 High
- ancorathemes gritGrit42 Grit data_table_entity.rb DataTableEntity sql injection5.3 Medium
- No product listedBernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product...9.8 Critical
- No product listedDatadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the...9.8 Critical
- No product listedRuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue...9.8 Critical
- No product listedA Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control...8.8 High
- ancorathemes gritGrit42 Grit GritEntityController grit_entity_controller.rb sql injection5.3 Medium
- codeastro student attendance management systemCodeAstro Student Attendance Management System createStudents.php sql injection5.1 Medium
- koha community kohaKoha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter5.6 Medium
- emarket-design customer support ticket system & helpdeskWP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter7.5 High
- codeastro human resource management systemCodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection5.3 Medium
- fleetdm fleetFleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint6.5 Medium
- fleetdm fleetFleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint6.5 Medium
- elated-themes frappeFrappe Vulnerable to Possible SQL Injection via get_blog_list6.9 Medium
- phpbbSQL injection vulnerability in phpBB profile field migration due to improper handling of user...7.1 High
- macwarrior clipbucket-v5ClipBucket: Blind SQL Injection in progress_video.php9.8 Critical
- macwarrior clipbucket-v5ClipBucket: Blind SQL Injection in subtitle_edit.php8.8 High
- Show moreLoading…