CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- apache doris mcp serverApache Doris MCP Server: SQL injection leading the authentication bypass8.1 High
- ilias learning management systemILIAS Learning Management System Learning Progress Tracking class.ilTrQuery.php executeQueries sql injection5.1 Medium
- montodel house-rental-managementMontodel House-Rental-Management index.php houses sql injection5.3 Medium
- montodel house-rental-managementMontodel House-Rental-Management login.php sql injection6.9 Medium
typeormnpm,@rootio/typeormRoot +1 moreTypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)5.9 Medium- joomboost joomcrmJoomla! Component JoomCRM 1.1.1 SQL Injection via deal_id7.1 High
- wdmtech vbizzJoomla! Component vBizz 1.0.7 SQL Injection7.1 High
- wdmtech vwishlistJoomla vWishlist 1.0.1 SQL Injection via vproductid Parameter7.1 High
- wdmtech vaccountJoomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard8.8 High
- wdmtech vreviewJoomla vReview 1.9.11 SQL Injection via editReview8.8 High
- wdmtech vrestaurantJoomla vRestaurant 1.9.4 SQL Injection via menu-listing-layout8.8 High
- wdmtech vmapJoomla! Component VMap 1.9.6 SQL Injection via loadmarker8.8 High
- cmsjunkie j-businessdirectoryJoomla! Component J-BusinessDirectory 4.9.7 SQL Injection8.8 High
- cmsjunkie classifiedsmanagerJoomla J-ClassifiedsManager 3.0.5 SQL Injection8.8 High
- cmsjunkie multiplehotelreservationJoomla J-MultipleHotelReservation 6.0.7 SQL Injection8.8 High
- cmsjunkie j-cruiseportalJoomla J-CruisePortal 6.0.4 SQL Injection via cruises7.1 High
- cmsjunkie jhotelreservationJoomla JHotelReservation 6.0.7 SQL Injection via search-hotels8.8 High
- jcart for opencart, soft-php jcart for opencart +1 moreJoomla! Component jCart for OpenCart 2.0 SQL Injection8.8 High
- joomlaboat extra searchJoomla! Component Extra Search 2.2.8 SQL Injection8.8 High
- myportfolioJoomla Component Myportfolio 3.0.2 SQL Injection via pid Parameter8.8 High
- extensions joomla payageJoomla Payage 2.05 SQL Injection via aid Parameter8.8 High
- joomboost joomrecipeJoomla JoomRecipe 1.0.3 SQL Injection via category parameter8.8 High
- joomboost joomla joomrecipeJoomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_author8.8 High
- simbunch simgenealogyJoomla! Component SIMGenealogy 2.1.5 SQL Injection8.8 High
- adobe bridgeJoomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter8.8 High
- king-products lms king professional, learning management system king +1 moreJoomla LMS King Professional 3.2.4.0 SQL Injection via learningpath8.8 High
- joomalshowroom event registration pro calendarJoomla Event Registration Pro Calendar 4.1.3 SQL Injection8.8 High
- faboba ultimate property listingJoomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_id8.8 High
- nordmograph streetguessr gameJoomla StreetGuessr Game 1.1.8 SQL Injection via catid8.8 High
- raindropsinfotech twitch tvJoomla! Component Twitch Tv 1.1 SQL Injection8.8 High
- terrywcarter kissgalleryJoomla! Component KissGallery 1.0.0 SQL Injection8.8 High
- zcontent zap calendar liteJoomla! Component Zap Calendar Lite 4.3.4 SQL Injection8.8 High
- joomla calendar plannerJoomla! Component Calendar Planner 1.0.1 SQL Injection8.8 High
- joomshaper sp movie databaseJoomla SP Movie Database 1.3 SQL Injection via searchword8.8 High
- pulseextensions flip wallJoomla! Component Flip Wall 8.0 SQL Injection7.1 High
- pulseextensions sponsor wallJoomla! Component Sponsor Wall 8.0 SQL Injection7.1 High
- focalpointx focalpoint, focalpoint pro / free +1 moreJoomla! FocalPoint Pro Free 1.2.3 SQL Injection via location8.8 High
- webkul ajax quizJoomla! Component Ajax Quiz 1.8 SQL Injection8.8 High
- weborange bargain product vm3Joomla! Component Bargain Product VM3 1.0 SQL Injection8.8 High
- weborange price alertJoomla! Component Price Alert 3.0.2 SQL Injection8.8 High
- joomlashack osdownloadsJoomla OSDownloads 1.7.4 SQL Injection via item view8.8 High
- extro responsive portfolio, rpc +1 moreJoomla! Component RPC Responsive Portfolio 1.6.1 SQL Injection8.8 High
- joomplace quiz deluxeJoomla! Component Quiz Deluxe 3.7.4 SQL Injection8.8 High
- joomplace survey force deluxeJoomla Survey Force Deluxe 3.2.4 SQL Injection via invite Parameter8.8 High
- joombooking jb visaJoomla! Component JB Visa 1.0 SQL Injection via visatype8.8 High
- gegabyte user benchJoomla! Component User Bench 1.0 SQL Injection via userid8.8 High
- gegabyte my projectsJoomla! Component My Projects 2.0 SQL Injection8.8 High
- nextgeneditor nextgen editorJoomla NextGen Editor 2.1.0 SQL Injection via plname Parameter8.8 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution9.4 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: SQL injection in named restore point endpoint5.3 Medium
- Show moreLoading…