CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- liquid web, llc kadence shop kitWordPress Kadence Shop Kit plugin <= 3.0.6 - SQL Injection vulnerability8.5 High
- codepress it solutions llc visitor traffic real time statistics proWordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability9.3 Critical
- No product listedA SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid()...7.2 High
- No product listedA SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker...6.5 Medium
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php login2 sql injection6.9 Medium
- dell cyber recovery, powerprotect cyber recovery, power protect cyber recovery +2 moreDell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of...6.5 Medium
- thinking software efenceThinking Software Technology｜Efence - SQL Injection8.8 High
- zte scpSQL injection vulnerability in ZTE SCP product6.3 Medium
- wpgenie woocommerce lotteryWooCommerce Lottery <= 2.2.9 - Unauthenticated Time-Based SQL Injection via 'orderby' and 'order' Parameters7.5 High
- metagauss registrationmagicRegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter5.5 Medium
- themeum tutor lmsTutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters5.3 Medium
- No product listedFuniture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select...9.8 Critical
- No product listedThe report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution....9.8 Critical
- No product listedThe front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond...9.8 Critical
- No product listedThe front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The...9.8 Critical
- No product listedAn issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges...8.8 High
- No product listedAn issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges...8.8 High
- code-projects simple inventory systemcode-projects Simple Inventory System edit.php sql injection6.9 Medium
- code-projects food ordering systemSililaWijesinghe Food Ordering System search.php sql injection6.9 Medium
- webkul qloappsWebkul QloApps SQL injection8.6 High
- webkul qloappsWebkul QloApps SQL injection8.6 High
- liketrek trekliketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection5.3 Medium
- wpcreatix media sweep – wordpress media cleanerMedia Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter4.9 Medium
- servmask all-in-one wp migration and backupAll-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution8.8 High
- typo3 extension "forms export"SQL Injection in extension "Forms Export" (frp_form_answers)7.7 High
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System cust_del.php sql injection5.3 Medium
- wedevs wp project manager proWP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Action6.5 Medium
- No product listedA SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall...4.3 Medium
- No product listedA SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit...5.4 Medium
- microsoft boostWordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability9.3 Critical
- wbw woobewoo product filter proWordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability9.3 Critical
- cakephp, cakephp cakephp/database +1 moreCakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver9.2 Critical
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection6.9 Medium
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection6.9 Medium
- divinext woo essentialWordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability9.3 Critical
- wedevs pte. ltd wp project manager proWordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability8.5 High
- themebing prolancer elementWordPress ProLancer Element plugin <= 1.4.8 - SQL Injection vulnerability8.5 High
- wp manageninja llc fluentcrm proWordPress FluentCRM Pro plugin <= 3.1.12 - SQL Injection vulnerability7.6 High
- bigprof online clinic management systemitsourcecode Online Clinic Management System Admin Login login.php sql injection6.9 Medium
- codeastro real estate management systemitsourcecode Real Estate Management System search.php sql injection6.9 Medium
- delta electronics diaenergieDIAEnergie - SQL Injection8.8 High
- delta electronics diaenergieDIAEnergie - SQL Injection8.8 High
- delta electronics diaenergieDIAEnergie - SQL Injection8.8 High
- delta electronics diaenergieDIAEnergie - SQL Injection8.8 High
- joomlack.fr page builder ck extension for joomlaJoomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.59.3 Critical
- codeastro payroll systemitsourcecode Payroll System admin_class.php login sql injection6.9 Medium
- itsourcecode library management systemitsourcecode Library Management System editbooks.php sql injection5.3 Medium
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System view_prod.php sql injection6.9 Medium
- sourcecodester simple online food ordering systemSourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection6.9 Medium
- Show moreLoading…