CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- itsourcecode hospital management systemitsourcecode Hospital Management System viewpaymentreport.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewpatient.php sql injection5.3 Medium
- No product listedzuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup...9.8 Critical
- No product listedSQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code9.8 Critical
- No product listedSQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote...9.1 Critical
- No product listedThe CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL...9.8 Critical
- phoca.cz phoca cart extension for joomlaJoomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.69.3 Critical
- bestwebsoft gallery by bestwebsoft – customizable image and photo galleries for wordpressGallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys7.2 High
- unknown wp directory kitWP Directory Kit < 1.5.7 - Admin+ SQL Injection via section Parameter7.2 High
- weblizar the school management – education & learning erpThe School Management <= 5.4 - Authenticated (Custom+) SQL Injection via 'order[0][dir]' Parameter6.5 Medium
- wcvendors wc vendors – woocommerce multivendor, woocommerce marketplace, product vendorsWC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter4.9 Medium
- quantumcloud slider hero with video background, animationSlider Hero with Video Background, Animation <= 9.1.7 - Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate)4.9 Medium
- faiyaz alam user login historyUser Login History <= 2.1.7 - Authenticated (Administrator+) SQL Injection via 'blog_id' Parameter4.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System vieworder.php sql injection5.3 Medium
- expresstech quiz and survey master (qsm) – quiz maker & survey makerQuiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option6.5 Medium
- pdamsten fullscreen galleriaFullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content6.5 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.4 - Authenticated (Admin+) SQL Injection via 'additional_params' Parameter4.9 Medium
- No product listedEvergreen open-ils.fielder OpenSRF Service osrf-gateway-v1 sql injection6.9 Medium
- sourcecodester stock management systemSourceCodester Stock Management System Master.php delete_supplier sql injection5.1 Medium
- code-projects online shopping systemcode-projects Online Shopping System checkout_process.php sql injection5.3 Medium
- code-projects online shopping systemcode-projects Online Shopping System homeaction.php sql injection5.3 Medium
- code-projects online shopping systemcode-projects Online Shopping System action.php sql injection5.3 Medium
- code-projects online shopping systemcode-projects Online Shopping System Login login.php sql injection6.9 Medium
- code-projects online food order systemcode-projects Online Food Order System delete_food_items1.php sql injection5.3 Medium
- jinher oaJinher OA attendance_out_approve.aspx sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_teacher.php sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewmedicine.php sql injection5.3 Medium
- wpml multilingual cmsWPML Multilingual CMS <= 4.9.5 - Authenticated (Translator+) SQL Injection via 'sorting' Parameter6.5 Medium
- appflowy-io appflowy-cloudAuthenticated SQL Injection in AppFlowy7.1 High
- matthiasnordwig invisible anti-spam & captcha — recaptcha alternative for all formsInvisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values4.9 Medium
- matthiasnordwig invisible anti-spam & captcha — recaptcha alternative for all formsInvisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter4.9 Medium
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection via 'searchTerm' Parameter6.5 Medium
- contest-gallery contest gallery – upload & vote photos, media, sell with paypal & stripeContest Gallery <= 30.0.6 - Authenticated (Author+) Second-Order SQL Injection via MultipleFiles Second-Order Payload via 'cg_multiple_files_for_post' -> 'cgRealId'6.5 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.44 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause5.3 Medium
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.5.14 - Authenticated (Vendor+) SQL Injection via 'tag_query' Parameter6.5 Medium
- minnpost object sync for salesforceObject Sync for Salesforce <= 2.2.13 - Unauthenticated SQL Injection7.5 High
- fishpie image uploader for welcartImage Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter6.5 Medium
- icagenda.com icagenda extension for joomlaJoomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.118.6 High
- icagenda.com icagenda extension for joomlaJoomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.119.2 Critical
- ibm db2 mirror for iIBM Db2 Mirror for i is affected by multiple vulnerabilities5.4 Medium
- limesurveyLimeSurvey Community Edition 7.0.5 - Authenticated SQL injection in CPDB6.0 Medium
- nceas metacatMetacat has an unauthenticated SQL injection vulnerability9.8 Critical
- emlogEmlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function8.6 High
- tenable security centerSQL Injection7.1 High
- tenable security centerSQL Injection6.9 Medium
- sourcecodester simple client management systemSourceCodester Simple Client Management System Master.php save_service sql injection6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 SQL Injection via backlink search9.9 Critical
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.9 - Unauthenticated SQL Injection via Paymob Callback Pixel Lookup8.6 High
- cservit affiliate-toolkit – multi-network affiliate & amazon product displayaffiliate-toolkit <= 3.8.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- bitpressadmin bit form – contact form, payment forms, multi step forms, calculator & custom form builderBit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter6.5 Medium
- Show moreLoading…