CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- labelblanc improved save buttonImproved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter6.5 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)8.6 High
- lg electronics smartshareImproper neutralization of special elements used in an SQL command ('SQL injection')...7.1 High
- No product listedSourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.9.8 Critical
- No product listedSourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php...9.8 Critical
- No product listedCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the...9.8 Critical
- No product listedCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php...9.8 Critical
- No product listedCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.9.8 Critical
- No product listedCodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and...9.8 Critical
- No product listedCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php...9.8 Critical
- No product listedCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php...9.8 Critical
- No product listedCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership...9.8 Critical
- No product listedCodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in ...9.8 Critical
- No product listedEcommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in ...9.8 Critical
- drivelockDriveLock SQL Injection Privilege Escalation Vulnerability8.8 High
- black duck coverity connectSQL Injection in Coverity Connect SOAP API8.7 High
- balbooa gridbox, balbooa.com gridbox extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.29.2 Critical
- opensolution quick.cmsBlind SQL Injection in Quick.CMS5.1 Medium
- frappe erpnextSQL Injection in Frappe's ERPNext7.1 High
- wp lab wp-lister lite for ebayWP-Lister Lite for eBay <= 3.8.8 - Authenticated (Shop Manager+) SQL Injection via 'orderby' Parameter4.9 Medium
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsSQL injection and unsafe deserialisation vulnerability9.9 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsSQL injection and unsafe deserialisation vulnerability9.9 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsSQL injection and unsafe deserialisation vulnerability9.9 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsPost-authentication SQL injection vulnerability8.1 High
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsPre-authentication error-based SQL injection vulnerability9.1 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsPre-authentication blind SQL injection vulnerability9.1 Critical
- opajaap wp photo album plusWP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter4.9 Medium
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability...7.3 High
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient...7.3 High
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory...7.3 High
- No product listedkishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the...9.8 Critical
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view...9.8 Critical
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user...7.3 High
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in...7.3 High
- No product listedhttps://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL...7.3 High
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in...7.3 High
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud...9.8 Critical
- No product listedSourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in...9.8 Critical
- No product listedkishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates...9.8 Critical
- hypequery@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution9.8 Critical
- ellucian advance web, legacy advance +1 moreAuthenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance9.4 Critical
- tanium patchTanium addressed a SQL injection vulnerability in Patch.6.3 Medium
- foomagoo plugin organizerPlugin Organizer <= 10.2.4 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- ibm sterling b2b integrator, sterling file gateway +1 moreSQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway8.1 High
- enterprisedb pglogicalThe pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a...9.0 Critical
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter4.9 Medium
- mihail-chepovskiy web directory freeWeb Directory Free <= 1.7.13 - Unauthenticated SQL Injection7.5 High
- pickplugins question answerPickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter7.5 High
- weidmueller interface procon-web scadaSQL injection via unauthenticated GetGridData endpoint9.3 Critical
- taskbuilder – project management & task management tool with kanban boardTaskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- Show moreLoading…