CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- automattic woocommerceWordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability7.6 High
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter4.1 Medium
- code-projects doctor appointment systemcode-projects Doctor Appointment System contactus.php sql injection6.9 Medium
- code-projects doctor appointment systemcode-projects Doctor Appointment System booking.php sql injection6.9 Medium
- code-projects hospital information systemcode-projects Hospital Information System PrespController.php getSinglePresp sql injection6.9 Medium
- code-projects hospital information systemcode-projects Hospital Information System viewReq.php viewReq sql injection6.9 Medium
- code-projects hospital information systemcode-projects Hospital Information System addReq.php findBySearch sql injection6.9 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System inv_del.php sql injection5.3 Medium
- light0011 cmslight0011 cms Query Builder ChapterController.class.php searchChapter sql injection6.9 Medium
- No product listedSQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain...7.4 High
- No product listedSQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute...9.8 Critical
- code-projects doctor appointment systemcode-projects Doctor Appointment System patient_login.php sql injection6.9 Medium
- sciphi-ai r2rR2R 3.6.6 SQL Injection via Retrieval Search Filter Key8.7 High
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection5.3 Medium
- sciphi-ai r2rR2R 3.6.6 SQL Injection via Vector Index Creation Endpoint9.3 Critical
- itsourcecode online medicine delivery systemitsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection6.9 Medium
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability9.3 Critical
- e4j s.r.l. vikappointments services booking calendarWordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability9.3 Critical
- seacmsSeaCMS WeChat index.php addslashes sql injection6.9 Medium
- joodb.feenders.de joodatabase lite extension for joomlaJoomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.09.3 Critical
- wwbn avideoWWBN AVideo SQL Injection via get.json.php APIName channels8.7 High
- ocs inventory ng ocsreportsMultiple vulnerabilities in Ocsreports for OCS Inventory NG8.6 High
- ocs inventory ng ocsreportsMultiple vulnerabilities in Ocsreports for OCS Inventory NG8.6 High
- craftcms cmsAuthenticated SQL Injection via nested eager-loading criteria7.1 High
- wc lovers wcfm marketplaceWordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability9.3 Critical
- zohocorp manageengine password manager pro, manageengine access manager plus, manageengine pam360 +2 moreZohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561,...8.8 High
- unknown wpvivid — backup, migration & stagingWPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation4.1 Medium
- unknown commentsComments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi5.3 Medium
- baserowBaserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction8.6 High
- wwbn avideoAVideo User_Location Plugin Unauthenticated SQL Injection8.7 High
- arubanetworks fabric composerAuthenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer7.2 High
- xinhu rainrock rockoaXinhu Rainrock RockOA index.php toaddval sql injection5.3 Medium
- tmt machine industry and trade ltd. co. talassoft industrial management softwareSQL Injection in TMT Machine's Talassoft Industrial Management Software8.8 High
- chanjet crmChanjet CRM jxf_dump_table.php sql injection6.9 Medium
- xinhu rainrock rockoaXinhu Rainrock RockOA webmainAction.php getOrder sql injection5.3 Medium
- trtek technological products computer software hardware industry and trade limited company products's storeSQL Injection in TRtek Technological Products's Store9.8 Critical
- teracity software technologies inc. e-osbSQL Injection in Teracity Sotware's Teracity E-OSB Platform9.8 Critical
- zhongyu09 openchatbizhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection5.3 Medium
- smub charitable – donation & fundraising platform (donation forms, recurring donations & fundraising campaigns)Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute6.5 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9 Medium
- ays-pro photo gallery by ays – responsive image galleryPhoto Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter4.9 Medium
- drupal persistent loginPersistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie6.5 Medium
- levelfourstorefront shopping cart & ecommerce storeShopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter4.9 Medium
- shopex ecshopShopEx ECShop flow.php flow_update_cart sql injection6.9 Medium
- kishan0725 hospital-management-systemkishan0725 Hospital-Management-System search.php sql injection6.9 Medium
- unknown throws spam awayWordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability9.3 Critical
- autorius e-goi smart marketing sms and newsletters formsWordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability9.3 Critical
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability9.3 Critical
- syed balkhi charitableWordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability8.5 High
- tranquil it waptWAPT Server SQL Injection via /api/v3/hosts Endpoint7.1 High
- Show moreLoading…