CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- siyuan-note siyuanSiYuan: SQL Query in Block Search Exposes Hidden Published Document Content7.5 High
- yeswikiYesWiki Authenticated SQL Injection in ReactionManager8.8 High
- yeswikiYesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)8.3 High
- yeswikiImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki7.5 High
- pimcorePimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes7.7 High
- yeswikiYesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read6.5 Medium
- sourcecodester simple and nice shopping cart scriptSourceCodester Simple and Nice Shopping Cart Script login.php sql injection6.9 Medium
- acymailing, acymailing.com acymailing extension for joomla, datasolution acymailing.com acymailing extension for joomla +2 moreJoomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.19.2 Critical
- soplanningSQL Injection in SOPlanning Audit Retention Configuration8.6 High
- inrove software and internet services bieticaretSQLi in Inrove Software's BiEticaret9.8 Critical
- getwpfunnels mail mint – email marketing, newsletter, email automation & woocommerce emailsMail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter4.9 Medium
- wedevs erp: complete hr, accounting & crm suite built for woocommerceERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support <= 1.17.5 - Authenticated (HR Manager+) SQL Injection via 'orderby' Parameter6.5 Medium
- code-projects interview management systemcode-projects Interview Management System View.php sql injection6.9 Medium
- code-projects online food order systemcode-projects Online Food Order System edit_food_items.php sql injection6.9 Medium
- codeastro simple online leave management systemCodeAstro Simple Online Leave Management System index.php sql injection6.9 Medium
- drupal location selectorLocation Selector - Critical - SQL Injection - SA-CONTRIB-2026-0727.4 High
- ibm api connectIBM API Connect SQL Injection9.1 Critical
- snowflake terraform provider for snowflakeMultiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account Takeover8.8 High
- snowflake snowpark python sdkSQL Injection in Snowflake Snowpark Python SDK9.6 Critical
- n8nn8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation5.3 Medium
- webbeyaz web design mediküm webSQLi in Webbeyaz's Mediküm Web9.8 Critical
- joedolson my calendar – accessible event managerMy Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters7.5 High
- tainacanTainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter7.5 High
- devitemsllc recurio – ultimate subscription for woocommerceRecurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter4.9 Medium
- imithemes eventerEventer <= 4.4.2 - Unauthenticated SQL Injection via 'code' Parameter7.5 High
sogoDebianA SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute...6.3 MediumsogoDebianA SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute...6.3 Medium- kedacore kedaKEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping5.9 Medium
- dataeaseDataEase: Authenticated SQL Injection in Chart Quota Filters8.7 High
- openremoteOpenRemote has authenticated SQL injection in crosstab datapoint exports7.2 High
- openremoteOpenRemote < 1.26.0 SQL Injection via Crosstab Export7.2 High
- fossbillingFOSSBilling has improper SQL neutralization in `Massmailer` recipient filters6.9 Medium
- langroidLangroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls9.3 Critical
- aws mcp gateway & registryAuthenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry8.6 High
- prog mis management systemPROG MIS｜Prog Management System - SQL Injection8.7 High
- codeastro ecommerce websiteCodeAstro Ecommerce Website my_account.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System visitor-entry.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System edit-apartment.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System report.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System action-visitor.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System paymentdischarge.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System payment.php sql injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_course1.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_exam1.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_room.php sql injection6.9 Medium
- code-projects real state servicescode-projects Real State Services pay.php sql injection6.9 Medium
- code-projects real state servicescode-projects Real State Services builderHome.php sql injection6.9 Medium
- codeastro ecommerce websiteCodeAstro Ecommerce Website POST Parameter confirm.php sql injection5.3 Medium
- codeastro apartment visitor management systemCodeAstro Apartment Visitor Management System POST Parameter search-result.php sql injection5.3 Medium
- code-projects hotel and tourism reservationcode-projects Hotel and Tourism Reservation Event Management add_event.php sql injection6.9 Medium
- Show moreLoading…