CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- koha community kohaKoha - SQL Injection in reports/acquisitions_stats.pl8.8 High
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter6.8 Medium
- cemtan sar2htmlcemtan sar2html Search sar2html.py sql injection5.3 Medium
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)10.0 Critical
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.9 Critical
- shlinkio shlinkShlink Blind SQL Injection via tags/stats orderBy Parameter7.1 High
- sequelizeSequelize: SQL Injection (Oracle DB)9.8 Critical
- krayin laravel-crmKrayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter8.7 High
- siyuan-note siyuanSiYuan before v3.7.3 SQL Injection via searchDocs9.9 Critical
- siyuan-note siyuanSiYuan before v3.7.3 SQL Injection via searchEmbedBlock9.9 Critical
- siyuan-note siyuanSiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent9.9 Critical
- oscommerceosCommerce Email Template Configuration EmailController.php EmailController sql injection5.1 Medium
- unknown logmytripLogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie8.6 High
- unknown sm page duplicatorSM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication8.1 High
- unknown super store finder wordpressSuper Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking9.1 Critical
- unknown link libraryLink Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form9.1 Critical
- No product listedA SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute...8.1 High
- No product listedSQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary...9.8 Critical
- laughingman7743 pyathenaPyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS9.3 Critical
- acymailing newsletter team acymailingAcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter8.2 High
- cubewp1211 cubewp frameworkCubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter6.5 Medium
- wpvividplugins wpvivid — backup, migration & stagingWPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter4.9 Medium
- icegram mailer – reliable email deliverability, no-code smtp replacement & email logsIcegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter4.9 Medium
- westerndeal gsheetconnector – cf7 google sheets connectorGSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter4.9 Medium
- dave jesch database collation fixDatabase Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter5.3 Medium
- icegram engage – popups, optins, ctas & lead generationIcegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter6.5 Medium
- unknown participants databaseParticipants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search9.1 Critical
- dotonpaper pinpoint booking system – version 2Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter4.9 Medium
- webpros cpanel, wp squared +1 moreImproper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in...9.4 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)9.4 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)8.7 High
- dynatrace-oss dynatrace-mcpDynatrace MCP Server: DQL injection via parameters not documented as DQL4.3 Medium
- php jabbers poll scriptAuthenticated SQL Injection in PHP Poll Script8.6 High
- gz scripts car rental script, event booking calendar, property listing script +32 more +34 moreAuthenticated SQL Injection in PHP Jabbers scripts8.6 High
- gz scripts car rental scriptUnauthenticated SQL Injection in PHP Jabbers - Car Rental Script script9.3 Critical
- themeum kirkiKirki < 6.0.13 - Unauthenticated SQL Injection8.6 High
- unknown wp go maps, wp go maps (formerly wp google maps) go maps +1 moreWP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter3.7 Low
- unknown product feed manager for woocommerceProduct Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter8.1 High
- unknown check & log emailCheck & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters6.5 Medium
- codeigniter4CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions9.4 Critical
- No product listedSourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin...9.8 Critical
- No product listedSourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php...9.8 Critical
- clastix kamajiKamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers4.7 Medium
- umai vision traffic analysis systemSQLi in UMAI Vision's Traffic Analysis System9.8 Critical
- gladinet centrestackCentreStack < 17.4 SQL Injection via x-glad-filter Header8.7 High
- phpSQL injection in ext-pgsql via E'...' backslash breakout8.1 High
- eaton padmImproper input validation in the authentication component of Eaton's Tripp Lite series PADM...8.6 High
- pleskImproper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged...9.9 Critical
- unknown online scheduling and appointment booking systemBookly < 27.8 - Unauthenticated SQL Injection via staff_id8.6 High
- thimpress wp hotel bookingWP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search6.8 Medium
- Show moreLoading…