CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- wp inventory managerWordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability8.5 High
- milan petrovic gd rating systemWordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability8.5 High
- acymailing newsletter team smtp newsletterWordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability9.3 Critical
- themeum kirkiWordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability9.3 Critical
- latepointWordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability9.3 Critical
- quantumcloud simple business directory proWordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability9.3 Critical
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability9.3 Critical
- appsbd viteposWordPress Vitepos plugin <= 3.4.2 - SQL Injection vulnerability8.5 High
- sourcecodester online book store systemSourceCodester Online Book Store System login.php sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System patviewprescription.php sql injection5.3 Medium
- codeastro simple online leave management systemCodeAstro Simple Online Leave Management System dashboard.php sql injection5.3 Medium
- jinher oaJinher OA PlanGiveOut.aspx sql injection6.9 Medium
- No product listedSQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote...9.8 Critical
- metasoft 美特软件 metacrmMetasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection6.9 Medium
- aojiaozero antarisAojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection5.3 Medium
- cap-go capgoCapgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint5.1 Medium
- sergomanov smarthomeadatumsergomanov SmartHomeAdatum Login users.php sql injection6.9 Medium
- amtt hotel broadband operation systemAMTT Hotel Broadband Operation System switch_status.php sql injection5.1 Medium
- rafymrx toko-online-rotiRafyMrX TOKO-ONLINE-ROTI add.php sql injection6.9 Medium
- rafymrx toko-online-rotiRafyMrX TOKO-ONLINE-ROTI login.php sql injection6.9 Medium
- aster telecom azcallAster Telecom Azcall HTTP sis.php sql injection6.9 Medium
- icehrmIceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection5.3 Medium
- bahmni bahmni-coreBahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil7.1 High
- bahmni bahmnicoreBahmni bahmnicore Search Endpoint sql additionalParams sql injection5.3 Medium
- mervinpraison praisonaiPraisonAI before 4.6.78 SQL/CQL Injection via vector dimension9.3 Critical
- blendmedia wp cta – call now button, sticky button & call to action builderWP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter7.5 High
- catalyst2020 catalyst connect zoho crm client portalCatalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter4.9 Medium
- masaakitanaka booking packageBooking Package <= 1.7.20 - Unauthenticated SQL Injection via 'email' Form Parameter7.5 High
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in KCQueryBuilder6.5 Medium
- ahmadmj majestic support – the leading-edge help desk & customer support pluginMajestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter6.5 Medium
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController6.5 Medium
- elated-themes frappeFrappe: check_safe_sql_query Permits SELECT INTO OUTFILE2.3 Low
- openreplayOpenReplay: Authenticated ClickHouse SQL injection via session search5.4 Medium
- pluginsglpi datainjectionGLPI DataInjection Plugin Authenticated SQL Injection via CSV Import7.1 High
- difyDify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text8.7 High
- semtek informatics software consulting trade ltd. co. sem-pmpSQLi in Semtek Informatics' SEM-PMP9.8 Critical
- coturnCoturn: SQL Injection in HTTPS Admin Panel Delete Operations7.2 High
- adam retail automation ltd. mobilmen 20tSQLi in AdamPOS' MobilMen 20T9.8 Critical
- getgrav gravgrav-plugin-database: SQL Injection in PDO::tableExists() due to Unsanitized Table Name Interpolation9.2 Critical
- dell powerflex managerDell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of...7.7 High
- dell powerflex managerDell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of...8.5 High
- elixir-ecto postgrexSQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service2.1 Low
- getwpfunnels mail mint – email marketing, newsletter, email automation & woocommerce emailsMail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter4.9 Medium
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute6.5 Medium
- wplegalpages cookie banner for gdpr / ccpa – wplp cookie consentCookie Banner for GDPR / CCPA <= 4.3.6 - Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter4.9 Medium
- wpdevteam betterdocs – ai documentation, knowledge base, docs, wikis, faq with chatbotBetterDocs <= 4.6.0 - Authenticated (Custom+) SQL Injection via 'lang' Parameter6.5 Medium
- ninjew geo my wpGEO my WP <= 4.5.4 - Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters9.1 Critical
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection7.5 High
- wpdevart booking calendar, appointment booking systemBooking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'5.9 Medium
- rtcamp rtmedia for wordpress, buddypress and bbpressrtMedia for WordPress, BuddyPress and bbPress <= 4.6.18 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- Show moreLoading…