CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array6.5 Medium
- tickera – sell tickets & manage eventsTickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter6.5 Medium
- expresstech quiz and survey master (qsm) – quiz maker & survey makerQuiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter6.5 Medium
- unknown wp job portalWP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter6.5 Medium
- cleverplugins seo boosterSEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter4.9 Medium
- cleverplugins seo boosterSEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- wcmp multivendorx – woocommerce multivendor marketplace ai powered solutionsMultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter6.5 Medium
- themehunk advance product search- voice & ajax search for woocommerceAdvance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter7.5 High
- No product listedA SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9...9.8 Critical
- No product listedLogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the...8.8 High
- h3c secpath f1000-c8300H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection6.9 Medium
- knadh listmonklistmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials5.5 Medium
- nocobaseNocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE10.0 Critical
- dataeaseDataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection8.7 High
- dataeaseDataEase: Stored SQL Injection Vulnerability8.7 High
- dataeaseDataEase: Arbitrary SQL execution in preview path (direct data disclosure)7.1 High
- dataeaseDataEase: SQL injection vulnerability8.7 High
mantisbt/mantisbtPackagistMantisBT: SQL Injection via history_order Configuration Value8.5 High- apache fineractApache Fineract: Office list: SQL Injection via Subquery in orderBy8.1 High
- apache fineractApache Fineract: SQL injection in runreports endpoint8.8 High
- apache fineractApache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure8.1 High
- joomdonation.com edocman extension for joomlaJoomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.98.7 High
- digital-peak.com dp calendar extension for joomlaJoomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.28.7 High
- metaguru hcmMetaGuru｜HCM - SQL Injection8.7 High
- oooorgle quotes llamaQuotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc Parameter8.6 High
- asus routerImproper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web...5.9 Medium
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.1 Critical
- adobe commerce, commerce b2b, commerce events +4 more +6 moreAdobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)7.2 High
facturascripts/facturascriptsPackagistFacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`9.9 Critical- microsoft sql server 2016 service pack 3 (gdr), sql server 2016 service pack 3 azure connect feature pack, sql server 2017 (cu 31) +12 more +14 moreMicrosoft SQL Server Elevation of Privilege Vulnerability8.8 High
- microsoft sql server 2016 service pack 3 (gdr), sql server 2016 service pack 3 azure connect feature pack, sql server 2017 (cu 31) +12 more +14 moreMicrosoft SQL Server Elevation of Privilege Vulnerability7.5 High
- sourcecodester simple and nice shopping cart scriptSourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection6.9 Medium
- snowflake sqlalchemyMultiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy8.3 High
- apache kylinApache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API9.8 Critical
- snowflake spark connectorInput Validation Vulnerabilities in Snowflake Spark Connector9.2 Critical
- code-projects online job portalcode-projects Online Job Portal DeleteUser.php sql injection6.9 Medium
- code-projects online job portalcode-projects Online Job Portal EditUser.php sql injection6.9 Medium
- itsourcecode electronic judging systemitsourcecode Electronic Judging System add_judges.php sql injection5.3 Medium
- sap se s/4hana project management (ppm-pro)SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO)5.5 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_exam2.php sql injection6.9 Medium
diracPyPIDIRAC: SQL injection and lack of access control in PilotManager service8.5 High- diracgrid diracDIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval9.9 Critical
- decidimDecidim: Admin user search allows SQL injection through similarity-based sorting5.5 Medium
- codeastro simple online leave management systemCodeAstro Simple Online Leave Management System POST accept.php sql injection5.3 Medium
- codeastro simple online leave management systemCodeAstro Simple Online Leave Management System deletemp.php sql injection5.3 Medium
- hannan گرویتی فرم فارسیWordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability7.6 High
- sergey aiwuWordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability9.3 Critical
- saad iqbal apiexperts square for woocommerceWordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability8.5 High
- creativews cws svgiconsWordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability8.5 High
- zorem advanced shipment tracking for woocommerceWordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability7.6 High
- Show moreLoading…