CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- chocobozzz peertubePeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()9.8 Critical
- weaver network co., ltd. e-cology 8.0, e-cology 9.0 +1 moreWeaver E-cology 8.0 / 9.0 SQL Injection via HrmCareerApplyPerView.jsp8.7 High
- weaver network co., ltd. e-cology 8.0Weaver E-cology 8.0 SQL Injection File Read via SignatureDownLoad8.7 High
- microsoft entra connectMicrosoft Entra Connect Elevation of Privilege Vulnerability7.8 High
- twentyhq twentyTwenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution9.1 Critical
- koha community kohaKoha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation4.3 Medium
- koha community kohaKoha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl7.1 High
- koha community kohaKoha Community Koha - Stored SQL Injection via Patron Card Layout image_name6.5 Medium
- koha community kohaKoha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age7.1 High
- e107e107 e107 - SQL Injection9.8 Critical
- pimcore admin-ui-classic-bundlePimcore pimcore admin-ui-classic-bundle - SQL Injection8.8 High
- civicrmCiviCRM CiviCRM - SQL Injection8.8 High
- friendicaFriendica Friendica - SQL Injection9.8 Critical
- win men intermational travel agency management systemWin Men Intermational｜Travel Agency Management System - SQL Injection9.3 Critical
- sap se social intelligenceSQL Injection vulnerability in SAP Social Intelligence6.3 Medium
- frappe erpnextERPNext: Possibility of SQL injection due to missing validation6.5 Medium
- tbea tlogger (tbea communication box 3rd generation)Unauthenticated SQL Injection9.3 Critical
- metabaseMetabase SQL injection via public card or dashboard10.0 Critical
- metabaseMetabase SQL injection via password reset endpoint10.0 Critical
- discourseDiscourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer7.1 High
- razinsoft ready ecommerceReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php9.3 Critical
- tencent apijsonTencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass9.8 Critical
- apache rangerApache Ranger: SQL Injection vulnerability in lookup functionality9.8 Critical
- appsbd viteposVitepos < 3.6.0 - Admin+ SQL Injection via product-details-report4.1 Medium
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter9.1 Critical
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie8.6 High
- unknown term pagesTerm Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup5.8 Medium
- owthub library management systemLibrary Management System < 3.6.7 - Subscriber+ SQL Injection via Filter Value4.3 Medium
- sourcecodester simple doctors appointment systemSourceCodester Simple Doctors Appointment System ajax.php set_appointment sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection5.3 Medium
- mingsoft mcmsMingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection6.9 Medium
- lock-upme opmslock-upme OPMS IN Clause message.go sql injection5.3 Medium
- dresende node-sql-querydresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewdoctor.php sql injection5.3 Medium
- code-projects task management systemcode-projects Task Management System comment_count_user.php sql injection6.9 Medium
- code-projects task management systemcode-projects Task Management System AdminLogin.php sql injection6.9 Medium
- cubewp1211 cubewp frameworkCubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation8.1 High
- unknown wp directory kitWP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter9.1 Critical
- nickboss iptanus file uploadWordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid8.6 High
- unknown wp directory kitWP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter7.7 High
- sourcecodester simple doctors appointment systemSourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection6.9 Medium
- pleskAn SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an...7.7 High
- sourcecodester photo share websiteSourceCodester Photo Share Website ajax.php signup sql injection6.9 Medium
- elixir-ecto postgrexSQL injection via the :comment option in Postgrex.stream/45.9 Medium
- unknown content viewsContent Views < 4.5 - Subscriber+ SQL Injection via preview_request8.1 High
- sourcecodester photo share websiteSourceCodester Photo Share Website ajax.php login sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewappointment.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewadmin.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System treatmentrecord.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System treatmentdetail.php sql injection5.3 Medium
- Show moreLoading…