CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.2 - Unauthenticated SQL Injection7.5 High
- codename065 premium packages – sell digital products securelyPremium Packages <= 6.2.0 - Unauthenticated SQL Injection7.5 High
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection7.5 High
- epsiloncool wp fast total search – the power of indexed searchWP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection7.5 High
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings4.4 Medium
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter4.9 Medium
- cozyvision1 sms alert – sms & otp for woocommerce, order notifications & abandoned cart recoverySMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- devitemsllc shoplentor – all-in-one woocommerce growth & store enhancement pluginShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- chaty pro, notfound chaty pro +1 moreChaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter6.5 Medium
- arista networks velocloud orchestrator on-premVeloCloud Orchestrator Flow Metrics API SQL Injection8.5 High
- jgwhite33 wp google review sliderWordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability7.6 High
- rtcamp rtmedia for wordpress, buddypress and bbpressWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability8.5 High
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability9.3 Critical
- rtcamp rtmedia for wordpress, buddypress and bbpressWordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability9.3 Critical
- ruben garcia gamipressWordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability9.3 Critical
- sender – newsletter, sms and email marketing automation for woocommerceWordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability7.6 High
- christoph vielgrader relevanssi lightWordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability9.3 Critical
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability9.3 Critical
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.09.2 Critical
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.18.2 High
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.19.2 Critical
- unknown wpbotWPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields3.8 Low
- No product listedSQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive...7.5 High
- No product listedSQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in...9.1 Critical
- budibase serverBudibase before 3.40.0 NoSQL Injection via MongoDB datasource7.1 High
- budibaseBudibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector7.6 High
- budibaseBudibase: SQL Injection via `multipleStatements: true`9.6 Critical
- likeadmin-likeshop likeshopLikeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint8.5 High
- kstover ninja forms – the contact form builder that grows with youNinja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key4.9 Medium
- codeastro online classroomCodeAstro Online Classroom loginlinkadmin.php sql injection6.9 Medium
- appriss insights victim information notification exchange (vine), equifax victim information notification exchange +1 moreAppriss Insights VINE SQLI9.3 Critical
- joomshaper.com easy store extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.19.3 Critical
- persianscript persian woocommerce smsWordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability7.6 High
- themeisle visualizerWordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability8.5 High
- dokan proWordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability7.1 High
- uncanny owl automatorWordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability7.6 High
- expresstech systems quiz and survey masterWordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability8.5 High
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability8.5 High
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability8.5 High
- themetechmount truebookerWordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability9.3 Critical
- booklyWordPress Bookly plugin <= 27.7 - SQL Injection vulnerability9.3 Critical
- shahjada wpdm – premium packagesWordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability9.3 Critical
- romancode mapsvgWordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability9.3 Critical
- roland barker participants databaseWordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability9.3 Critical
- boss media buddyboss platform, buddyboss platform +1 moreWordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability9.3 Critical
- digitalme eroomWordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability8.5 High
- catch themes createWordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability8.5 High
- tickera – sell tickets & manage eventsTickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter6.5 Medium
- roundupwp registrations for the events calendar – event registration pluginRegistrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter6.5 Medium
- wupsales ai copilot – content generatorAI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter6.5 Medium
- Show moreLoading…