CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- sourcecodester air cargo management systemSourceCodester Air Cargo Management System Master.php save_cargo_type sql injection5.1 Medium
- francoisjacquet rosariosisfrancoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewdoctortimings.php sql injection5.3 Medium
- raisecom communication command and dispatch management platformRaisecom Communication Command and Dispatch Management Platform getpwd.php sql injection6.9 Medium
- budibaseBudibase before 3.40.0 SQL Injection via Oracle connector8.8 High
- budibase serverBudibase before 3.40.0 SQL Injection via Unauthenticated Webhook9.0 Critical
- freepbx missedcall, sangoma freepbx +1 moreFreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover9.3 Critical
- ibm iIBM i is Affected By SQL Injection Vulnerability in Db2 Mirror []7.6 High
- asp-cms project asp-cmsASP-CMS SQL Injection via commentList.asp id Parameter8.7 High
- hongjing e-hrHongjing e-HR Unauthenticated SQL Injection via getSdutyTree8.7 High
- zalktis programmas (sia "zalktis programmas") zalktisZalktis: SQL injection via partner-controlled fields in imported e-invoices8.7 High
- saurus cms community editionCMS Admin SQL Injection via db_data.php table_name Parameter8.6 High
- campcodes simple student information systemSourceCodester Simple Student Information System view_department.php sql injection6.9 Medium
- pimcorePimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name8.5 High
- arraytics bookticsWordPress Booktics plugin 1.0.22 - SQL Injection vulnerability8.5 High
- mailchimp for woocommerce, unknown mailchimp for woocommerce +1 moreWordPress MailChimp For WooCommerce plugin < 6.2 - SQL Injection vulnerability7.6 High
- mvp themes reviewerWordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability8.5 High
- andy moyle church adminWordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability9.3 Critical
- everestthemes everest backupWordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability9.3 Critical
- thimpress realpressWordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability9.3 Critical
- if-so dynamic content personalization, unknown if-so dynamic content personalization +1 moreWordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability9.3 Critical
- realmag777 active products tables for woocommerceWordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability9.3 Critical
- codepress visitor traffic real time statistics proWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.10 - SQL Injection vulnerability8.5 High
- webilia inc. listdomWordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability9.3 Critical
- denishua wpjam basicWordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability9.3 Critical
- emraan cheema cubewpWordPress CubeWP plugin <= 1.1.30 - SQL Injection vulnerability8.5 High
- lasso analytics, inc. do lassoWordPress Do Lasso plugin <= 358 - SQL Injection vulnerability8.5 High
- shamalli web directory freeWordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability9.3 Critical
- wpdirectorykit wp directory kitWordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability9.3 Critical
- wpdirectorykit wp directory kitWordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability7.5 High
- postgresqlPostgreSQL expression deparse allows SQL injection via EXTRACT argument8.8 High
- zohocorp manageengine pam360, manageengine password manager pro +1 moreSQL Injection8.8 High
- ash-project ash, ash-hq ash framework +1 moreFilter expression injection via forged keyset pagination cursor in Ash7.5 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in SQL7.6 High
- owen2345 camaleoncmsCamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 SQL Injection via queryBlocks template8.8 High
- owen2345 camaleoncmsCamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field7.1 High
- ibm iIBM i is Affected By Multiple Vulnerabilities in SQL4.3 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in SQL6.5 Medium
- ibm iIBM i is Affected By Multiple Vulnerabilities in SQL8.5 High
- thorsten phpmyfaqphpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration5.4 Medium
- wintercms winterWinter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax5.9 Medium
- phoenix contact axc f 1152, axc f 1252, axc f 2000 ea +14 more +16 moreSQL injection5.3 Medium
- essekia tablesome tableWordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability9.3 Critical
- unknown wp directory kitWP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category8.6 High
- unknown wp directory kitWP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter8.1 High
- pixelite events managerEvents Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection8.1 High
- unknown form maker by 10webForm Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name8.1 High
- iqonic design kivicareKiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint8.8 High
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.0 Critical
- Show moreLoading…