CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- tms wpdatatablesWordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability9.3 Critical
- crocoblock jetbookingWordPress JetBooking plugin <= 4.0.4.1 - SQL Injection vulnerability9.3 Critical
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.4 - Authenticated (Custom+) SQL Injection via 'after' Parameter6.5 Medium
- cactiCacti: SQL Injection in managers.php7.2 High
- tenable nessusSQL Injection in Nessus via Malicious Scan Result File Import1.6 Low
- tenable nessusSQL Injection in Nessus via Reverse DNS Lookup2.1 Low
- jacob n. breetvelt wp photo album plusWordPress WP Photo Album Plus plugin <= 9.1.13.005 - SQL Injection vulnerability7.5 High
- wssoffice21 ymc filter, ymc filter +1 moreWordPress Filter & Grids plugin <= 3.11.5 - SQL Injection vulnerability9.3 Critical
- premmerce wishlist for woocommerceWordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.11 - SQL Injection vulnerability9.3 Critical
- pluginus.net mdtfWordPress MDTF plugin <= 1.3.7 - SQL Injection vulnerability9.3 Critical
- rymera web co wc vendors marketplaceWordPress WC Vendors Marketplace plugin <= 2.6.8 - SQL Injection vulnerability8.5 High
- salesmanago & leadooWordPress SALESmanago & Leadoo plugin <= 3.11.2 - SQL Injection vulnerability8.5 High
- themefic tourfic – ai powered travel booking, hotel booking & car rental wordpress pluginTourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter7.5 High
- gravitymore gravity bookingsGravity Forms Booking <= 2.7.1 - Authenticated (Subscriber+) Time-Based SQL Injection via 'staff_id'6.5 Medium
- dokan pro, wedevs dokan pro +1 moreDokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters7.5 High
- dokan pro, wedevs dokan pro +1 moreDokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter6.5 Medium
- No product listedGROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a...7.7 High
- quest netvault backupQuest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability8.8 High
- cactiCacti: Stored SQL Injection via graph_name_regexp in Reports feature7.6 High
- quest netvault backupQuest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability8.8 High
- quest netvault backupQuest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability8.8 High
- cactiCacti has SQL Injection via rfilter parameter in RLIKE clauses9.3 Critical
- cactiCacti has Pre-Authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php9.8 Critical
- cactiCacti: Pre-authentication SQL injection via rfilter RLIKE clause in graph_view.php9.8 Critical
- dopry geolocation fieldGeolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-0626.5 Medium
- funnelkit funnel builder by funnelkitWordPress Funnel Builder by FunnelKit plugin <= 3.15.0.5 - SQL Injection vulnerability7.6 High
- clearsale totalClearSale Total <= 3.4.2 - Unauthenticated SQL Injection7.5 High
- hancock11 wp forms connectorWP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter7.5 High
- budibaseBudibase: Anonymous NoSQL operator injection via published-app query templates10.0 Critical
- revive adserverA missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and...8.3 High
- No product listedSQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute...6.5 Medium
virtuoso-opensourceDebianAn issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to...7.5 High- red hat enterprise linux 7An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers...7.5 High
virtuoso-opensourceDebianAn issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to...7.5 Highvirtuoso-opensourceDebianAn issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers...7.5 Highvirtuoso-opensourceDebianAn issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows...7.5 High- red hat enterprise linux 7An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to...7.5 High
virtuoso-opensourceDebianAn issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows...7.5 Highvirtuoso-opensourceDebian,virtuoso-opensource-debuginfoRed Hat,virtuoso-opensource-utilsRed Hat +2 moreAn issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows...7.5 High- red hat enterprise linux 7An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows...7.5 High
virtuoso-opensourceDebianAn issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows...7.5 High- red hat enterprise linux 7An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows...7.5 High
- cap-go capgoCap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts7.1 High
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization...8.1 High
- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization...8.8 High
- ibm sterling b2b integrator, sterling file gateway, watson speech services cartridge +2 moreIBM Sterling File Gateway SQL Injection6.0 Medium
- Show moreLoading…