CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- codename065 premium packages – sell digital products securelyPremium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter6.5 Medium
- tickera – sell tickets & manage eventsTickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter6.5 Medium
- king-theme product designer for woocommerce wordpress | lumiseProduct Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload7.5 High
- n8nn8n before 1.123.67 SQL Injection via executeQuery Operation5.3 Medium
- n8nn8n before 1.123.67 SQL Injection via PostgresTrigger Node5.8 Medium
- xpoda türkiye informatics technology inc. no code platformSQLi in Xpoda Türkiye Informatics Technology's No Code Platform9.8 Critical
- pixelite events managerEvents Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration7.5 High
- itsourcecode hospital management systemitsourcecode Hospital Management System prescription.php sql injection5.3 Medium
- oracle corporation hcm configuration workbench, oracle human capital management configuration workbench +1 moreVulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite ...6.3 Medium
- oracle learning managementVulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component:...6.3 Medium
- oracle demantra demand managementVulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component:...8.8 High
- oracle common applications calendarVulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite ...6.3 Medium
- oracle e-business suite, oracle corporation supply chain globalization +1 moreVulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite ...6.3 Medium
- oracle enterprise command center frameworkVulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business...8.3 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection6.9 Medium
- aptabaseAptabase SQL Injection via ClickHouse query backend7.1 High
- tenable security centerBlind SQL Injection7.1 High
- kunshi network technology co., ltd. linknat vos3000, linknat vos2009 +1 moreLinknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp9.3 Critical
- dhis2 dhis2-coreDHIS2 SQL injection in SQL View filter values8.7 High
- dhis2 dhis2-coreSQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read8.8 High
- google mcp toolbox for databases (googleapis/mcp-toolbox), mcp toolbox for databases +1 moreSQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox8.6 High
- zsadmin2025 zs-adminzsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection5.3 Medium
- turkmesh communication services inc. turkhotspot 5651 loglamaSQLi in Turkmesh's Turkhotspot 5651 Loglama9.8 Critical
- unknown bpost-shipping-platformBpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection7.5 High
- itsourcecode hospital management systemitsourcecode Hospital Management System prescriptionorder.php sql injection5.3 Medium
- No product listedSQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive...7.5 High
- No product listedSQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via...9.8 Critical
- No product listedSQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges...9.8 Critical
- No product listedSQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges...9.8 Critical
- apache syncopeApache Syncope: SQL injection vulnerability in Audit Events search9.8 Critical
- beijing shenzhou shihan technology multimedia integrated business display systemBeijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection6.9 Medium
- jcd windu cmsBlind SQL Injection in Windu CMS9.3 Critical
- itsourcecode hospital management systemitsourcecode Hospital Management System prescriptionorderreport.php sql injection5.3 Medium
- unknown modern event calendar pro, modern events calendar lite +1 moreModern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more8.6 High
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_subject.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_room1.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_rooma.php sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System prescriptionrecord.php sql injection5.3 Medium
- wordpress, wordpress core +1 moreWordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query5.9 Medium
- aws aws-athena-query-federationSQL injection in Amazon Athena Synapse connector6.1 Medium
- sangoma switchvox, switchvox smb edition +1 moreUnauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB9.3 Critical
- gis informatics engineering consulting laboratory r&d and software services inc. gislab laboratory management systemSQLi in GIS Informatics' GisLab Laboratory Management System9.8 Critical
- code-projects hospital bed management systemcode-projects Hospital Bed Management System Login Form sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System prescriptionorderdetail.php sql injection5.3 Medium
- No product listedcool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.9.8 Critical
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import4.9 Medium
- xylus wp bulk deleteWP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter4.9 Medium
- themexpert.com quix page builder pro extension for joomlaJoomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.18.7 High
- jgwhite33 wp tripadvisor review sliderWP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter4.9 Medium
- Show moreLoading…