CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- ubiquiti inc unifi talk applicationA malicious actor with access to the network and low privileges could exploit a series of...9.9 Critical
- ubiquiti inc cloud gateways, cloud keys, dream machines +40 more +42 moreA malicious actor with access to the network and low privileges could exploit a series of...8.8 High
- progress software flowmon ads, progress flowmon anomaly detection system +1 morePossibility of unintended database operations when querying data related to detected anomalies in Progress Flowmon ADS8.7 High
- levelfourdevelopment wp easycartWordPress WP EasyCart plugin <= 5.9.0 - SQL Injection vulnerability8.5 High
- 友人a丶 nicen-localize-imageWordPress nicen-localize-image plugin <= 1.4.9 - SQL Injection vulnerability8.5 High
- inet webkitWordPress iNET Webkit plugin 1.2.4 - SQL Injection vulnerability8.5 High
- hiroaki miyashita custom field templateWordPress Custom Field Template plugin <= 2.7.8 - SQL Injection vulnerability8.5 High
- epsiloncool wp fast total searchWordPress WP Fast Total Search plugin <= 1.80.280 - SQL Injection vulnerability9.3 Critical
- ahmad geekybotWordPress GeekyBot plugin <= 1.2.5 - SQL Injection vulnerability9.3 Critical
- thememove unicampWordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability8.5 High
- https://wpreviewslider.com/ wp review slider proWP Review Slider Pro <= 12.7.2 - Unauthenticated SQL Injection via 'notinstring' Parameter7.5 High
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.8 - Authenticated (Custom+) SQL Injection via 'select' Parameter6.5 Medium
- property hive houzez property feedHouzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreCargo Extension: SQLi in Special:Drilldown6.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo extension +1 moreSQLi in Cargo extension via year range filter6.9 Medium
- guardian language-systemGuardian Language-System SQL Injection via id Parameter in translate_text.php8.7 High
- guardian language-systemGuardian Language-System SQL Injection via name Parameter in designer.php8.7 High
- guardian language-systemGuardian Language-System SQL Injection via id Parameter in subtitles.php8.7 High
- guardian language-systemGuardian Language-System SQL Injection via id Parameter in job_info_get.php8.7 High
- guardian language-systemGuardian Language-System SQL Injection via id Parameter in text_file.php8.7 High
- guardian language-systemGuardian Language-System SQL Injection via id Parameter in media.php8.7 High
- guardian language-systemGuardian Language-System Unauthenticated SQL Injection via id Parameter in job_info.php9.3 Critical
- control web panel web panelControl Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter9.3 Critical
- jetmonsters motopress appointment bookingMotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter6.5 Medium
- repute infosystems bookingpress appointment booking proBookingPress Appointment Booking Pro <= 5.7.1 - Unauthenticated SQL Injection via 'store_service_date' Parameter7.5 High
- taskbuilder – project management & task management tool with kanban boardTaskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter6.5 Medium
- taskbuilder – project management & task management tool with kanban boardTaskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter6.5 Medium
- No product listedSQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker...9.8 Critical
- No product listedSQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote...6.5 Medium
- stonefly storage concentrator, storage concentrator virtual machine +1 moreSQL Injection in StoneFly Storage Concentrator9.2 Critical
- ibm app connect enterprise, integration bus for z/os, integration bus +2 moreIBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection4.7 Medium
- dolibarrDolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints7.2 High
- apache gravitinoApache Gravitino: SQL misconfiguration can access or truncate files5.4 Medium
- eksagate electronic engineering and computer industry trade inc. sysguard 6001SQLi in Exagate's SYSGUARD 60019.8 Critical
- exodist dbix::quickormDBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers9.8 Critical
- redeight cmsSQL Injection in Redeight CMS9.3 Critical
- eventon (pro) - wordpress virtual event calendar pluginEventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter9.8 Critical
- raythaSQL Injection in Raytha CMS9.3 Critical
- signozSigNoz 0.130.1 - SQL Injection in Alert History Endpoints via Rule ID Parameter8.3 High
- snowflake cliSnowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands6.0 Medium
- snowflake cliSnowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters3.6 Low
- snowflake cliSnowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input8.3 High
- itsourcecode hospital management systemitsourcecode Hospital Management System patientchangepassword.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System patientdetail.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System insertbillingrecord.php sql injection5.3 Medium
- weng-xianhu eyoucmsweng-xianhu EyouCMS API index.php sql injection5.1 Medium
- frontaccountingFrontAccounting < 2.4.20 SQL Injection via rep601.php7.1 High
- frontaccountingFrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php7.2 High
- frontaccountingFrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()7.2 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System preview3.php sql injection6.9 Medium
- Show moreLoading…