CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- splunk, splunk enterprise +1 moreStructured Query Language (SQL) Injection through the REST API in Splunk Enterprise4.3 Medium
- code-projects hospital information systemcode-projects Hospital Information System User Login UsersController.php login sql injection6.9 Medium
- ispconfig ispconfig3ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter8.7 High
- orval-labs orvalOrval: RCE via schema property name -> computed-property-key injection in the MSW mock generator9.3 Critical
- orval-labs orvalOrval: Import-time RCE via schema property name -> computed-property-key injection in the zod client9.3 Critical
- wazuhWazuh: Local SQL injection in FIM db due to path lookup interpolation in wazuh-syscheckd5.3 Medium
- cisco unified intelligence centerCisco Unified Intelligence Center SQL Injection Vulnerability6.5 Medium
- cisco crosswork planningCisco Crosswork Security Hardening Release: August 202610.0 Critical
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.39.3 Critical
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of...8.8 High
- phpmyfaqphpMyFAQ before 4.1.7 SQL Injection via Glossary8.6 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of...8.1 High
- faydam innovation inc. dataloggerSQL Injection in Faydam Innovation's FAYDAM Datalogger9.8 Critical
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of...7.1 High
- yootheme.com zoo extension for joomlaJoomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.649.3 Critical
- binti76 total donationsWordPress Total Donations plugin <= 2.0.5 - SQL Injection vulnerability9.3 Critical
- teconcetheme nikstore coreWordPress Nikstore Core plugin <= 1.5 - SQL Injection vulnerability9.3 Critical
- wpo-hr ngg smart image searchWordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability9.3 Critical
- get maps marker pro maps marker proWordPress Maps Marker Pro plugin <= 4.32 - SQL Injection vulnerability9.3 Critical
- peepso community by peepsoWordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability8.5 High
- yith woocommerce membership premiumWordPress YITH WooCommerce Membership Premium plugin <= 2.33.0 - SQL Injection vulnerability8.5 High
- unknown product shortlistProduct Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products8.6 High
- unknown dinaturDinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection8.6 High
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php delete_menu sql injection6.9 Medium
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php save_menu sql injection6.9 Medium
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php login sql injection6.9 Medium
- code-projects online job portal systemcode-projects Online Job Portal System Password Recovery ForPass.php sql injection6.9 Medium
- No product listedSQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker...9.9 Critical
- froxlorFroxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration7.2 High
- xianrendzw easyreportxianrendzw EasyReport Move Operations ModuleController.java sql injection5.3 Medium
- merkulove readablerWordPress Readabler plugin < 2.0.18 - SQL Injection vulnerability9.3 Critical
- crocoblock. jetimpex inc. jetappointmentWordPress JetAppointment plugin <= 2.5.2 - SQL Injection vulnerability9.3 Critical
- mra13 affiliates managerWordPress Affiliates Manager plugin <= 2.9.53 - SQL Injection vulnerability9.3 Critical
- saad iqbal license manager for woocommerceWordPress License Manager for WooCommerce plugin <= 3.0.18 - SQL Injection vulnerability7.1 High
- webnus inc. modern events calendarWordPress Modern Events Calendar plugin < 7.35.0 - SQL Injection vulnerability9.3 Critical
- gingerplugins sticky chat widgetWordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability9.3 Critical
- averta depicter sliderWordPress Depicter Slider plugin <= 4.8.0 - SQL Injection vulnerability7.5 High
- wpexperts gravity forms bookings premiumWordPress Gravity Forms Bookings premium plugin <= 2.1 - SQL Injection vulnerability8.5 High
- code-projects task management systemcode-projects Task Management System Login Form index.php select_with_multiple_condition sql injection6.9 Medium
- phpgurukul complaint management systemPHPGurukul Complaint Management System check_availability.php sql injection6.9 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewbilling.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewdepartment.php sql injection5.3 Medium
- itsourcecode hospital management systemitsourcecode Hospital Management System viewroom.php sql injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_subject1.php sql injection6.9 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System edit_subject2.php sql injection6.9 Medium
- frappe erpnextERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter7.6 High
- sourcecodester pet grooming management softwareSourceCodester Pet Grooming Management Software get_barcode_data.php sql injection6.9 Medium
- joomlack.fr page builder ck extension for joomlaJoomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.59.3 Critical
- itsourcecode hospital management systemitsourcecode Hospital Management System viewprescriptionrecord.php sql injection5.3 Medium
- google cloud secops (chronicle soar)Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service9.4 Critical
- Show moreLoading…