CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- filerunFileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action8.6 High
- netreviews sas verified reviews (avis vérifiés)WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability9.3 Critical
- openpanel-dev openpanelOpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier8.4 High
- gis informatics gislab laboratory management systemSQLi in GIS Informatics' GisLab Laboratory Management System9.8 Critical
- joomshaper.com sp property extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.49.3 Critical
- armiya information technologies ltd. co. access control systemSQLi in Armiya Information Technologies' Access Control System9.8 Critical
- No product listedGarlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories...9.8 Critical
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection6.9 Medium
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system manage.php update_record sql injection6.9 Medium
- drupal csp logCSP log - Critical - SQL Injection - SA-CONTRIB-2026-1366.5 Medium
- drupal amazee.ai private ai provideramazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-1346.5 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...5.5 Medium
- webpros cpanelA vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root...9.9 Critical
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...5.5 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...7.2 High
- siyuan-note siyuansiyuan before v3.8.2 SQL Injection via fullTextSearchBlock8.7 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...5.4 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...6.5 Medium
- aukejomm wpmr google feed manager for woocommerce – sell on google merchant center & shoppingWPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter6.5 Medium
- quentn.com gmbh quentn wpQuentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter4.1 Medium
- quentn.com gmbh quentn wpQuentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter8.6 High
- elextensions elex woocommerce request a quoteELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id8.6 High
- themeum wp crowdfundingWP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta4.9 Medium
- getwpfunnels mail mint – email marketing, newsletter, email automation & woocommerce emailsMail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter4.9 Medium
- tanium complyTanium addressed a SQL injection vulnerability in Comply.8.3 High
- No product listedSQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user...4.3 Medium
- mageplaza blogSQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2...8.6 High
- No product listedA SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated...8.8 High
- okta access gatewayImproper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores7.7 High
- adobe coldfusion, coldfusion 2023, coldfusion 2025 +2 moreColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)9.1 Critical
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System us_edit.php sql injection5.3 Medium
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 moreMicrosoft SQL Server Elevation of Privilege Vulnerability8.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Information Disclosure Vulnerability6.5 Medium
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 moreSQL Server Elevation of Privilege Vulnerability8.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Elevation of Privilege Vulnerability8.8 High
- microsoft sql server 2017 (cu 31), sql server 2017 (gdr), sql server 2019 (cu 32) +9 more +11 moreMicrosoft SQL Server Elevation of Privilege Vulnerability8.8 High
- microsoft azure arc sql server extension, azure arc sql server extension +1 moreAzure Arc SQL Server Extension Elevation of Privilege Vulnerability8.8 High
- aircheng-org iwebshop-5aircheng-org iWebShop-5 member.php member_list sql injection5.1 Medium
- commvault, commvault cloud +1 morePrivate Metrics Server SQL Injection8.8 High
- wpml multilingual cmsWPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’6.5 Medium
- code-projects student crud operationcode-projects Student Crud Operation edit.php sql injection5.3 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection5.3 Medium
- sap se s/4hana (intercompany matching and reconciliation)SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)6.5 Medium
- No product listedL-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment...6.5 Medium
- No product listedmfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName...9.8 Critical
- No product listedMovie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort...9.8 Critical
- No product listedA SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows...7.5 High
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System cust_edit1.php sql injection5.3 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System pro_searchfrm.php sql injection5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System delete_subject.php sql injection6.9 Medium
- Show moreLoading…