CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates8.7 High
- budibaseBudibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL8.4 High
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability8.5 High
- ubb systems ubb.threadsBlind SQL Injection in UBB.threads8.6 High
- frappe lmsSQL Injection in LMS8.6 High
- claudiopizzillo piaf-hmsPIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query9.3 Critical
- nur-alam39 bus-ticketSQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter9.3 Critical
- algolplus advanced order export for woocommerceAdvanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter4.9 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter4.9 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter4.9 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter4.9 Medium
- langchain4jLangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector7.6 High
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Neutralization of Special...5.7 Medium
- dell powerflex, powerflex manager +1 moreDell PowerFlex Manager, version(s) [Versions], contain(s) an Improper Neutralization of Special...3.5 Low
- stylemixthemes motorsWordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability9.3 Critical
- villatheme gift4uWordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability9.3 Critical
- wp travel gutenberg blocksWordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability9.3 Critical
- brainstorm force suredashWordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability8.5 High
- cargo rd shipping location for woocommerceWordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability9.3 Critical
- veronalabs slimstat analyticsWordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability8.5 High
- webilia inc. listdomWordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerability9.3 Critical
- advanced ads gmbh ads – trackingWordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerability9.3 Critical
- tips and tricks hq wp ememberWordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability9.3 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability9.3 Critical
- eyecix jobsearchWordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability9.3 Critical
- themeco cornerstoneWordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerability8.5 High
- crocoblock jetengineWordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability9.3 Critical
- crocoblock jetsearchWordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability9.3 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability9.3 Critical
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerability8.5 High
- crocoblock jetsmartfiltersWordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability9.3 Critical
- creative themes blocksy companion proWordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability9.3 Critical
- jobster marketplace wpjobsterWordPress WPJobster theme <= 6.3.5 - SQL Injection vulnerability9.3 Critical
- wc lovers. woocommerce frontend manager – ultimateWordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability8.5 High
- themeum tutor lms proWordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability9.3 Critical
- curlythemes events schedule - wordpress events calendar pluginWordPress Events Schedule - WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection vulnerability8.5 High
- androidIn Contacts Provider, there is a possible way to access the contacts database due to SQL...10.0 Critical
- crocoblock jetengineJetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint7.5 High
- directorist booking booking, wpwax directorist booking +1 moreWordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability8.5 High
- tms wpdatatablesWordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability9.3 Critical
- cridiostudio listingproWordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability9.3 Critical
- n8nn8n: NoSQL Injection in MongoDB Node Find And Replace Operation6.5 Medium
- n8nn8n: SQL Injection in Postgres v1/TimesclaeDB Nodes6.5 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability9.3 Critical
- eyal fitoussi geo my wordpressWordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability9.3 Critical
- tnomi attendance managerWordPress Attendance Manager plugin <= 0.6.2 - SQL Injection vulnerability7.6 High
- activity-log.com wp sessions time monitoring full automaticWordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability8.5 High
- realmag777 inpost galleryWordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability9.3 Critical
- https://wpreviewslider.com/ wp review slider proWP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter8.8 High
- https://wpreviewslider.com/ wp review slider proWP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter8.8 High
- Show moreLoading…