CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- katojkalemba online food ordering systemSourceCodester/katojkalemba Online Food Ordering System order.php sql injection6.9 Medium
- katojkalemba online food ordering systemSourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection6.9 Medium
- sourcecodester college notes gallery management systemSourceCodester College Notes Gallery Management System login.php sql injection6.9 Medium
- phpgurukul daily expense tracker systemPHPGurukul Daily Expense Tracker System forgot-password.php sql injection6.9 Medium
- phpgurukul daily expense tracker systemPHPGurukul Daily Expense Tracker System Login index.php sql injection6.9 Medium
- No product listedkaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements...9.9 Critical
- codeastro blood donor management systemPHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection6.9 Medium
- absmach magistralaMagistrala < 1.0.0 SQL Injection via format Parameter in Reader API8.7 High
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system doctorlogin.php sql injection6.9 Medium
- cisco asyncos, secure email, secure email gateway +2 moreCisco Secure Email Gateway SQL Injection Vulnerability9.8 Critical
- codeastro leave management systemitsourcecode Leave Management System index.php sql injection5.3 Medium
- codeastro leave management systemitsourcecode Leave Management System login.php sql injection6.9 Medium
- alior bank ratySQL Injection in Alior Bank raty PrestaShop module8.6 High
- alior bank ratySQL Injection in Alior Bank raty PrestaShop module8.6 High
- apache software foundation syncopeApache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search9.8 Critical
- statamic cmsYot CMS Cookie global.php login sql injection6.9 Medium
- joomshaper.com sp page builder (free and pro) extension for joomlaJoomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.08.6 High
- apache software foundation syncopeApache Syncope: SQL injection via sort parameter in Task search9.8 Critical
- apache software foundation syncopeApache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence9.8 Critical
- thinking software efenceThinking Software Technology｜EFence - SQL Injection8.7 High
- subhajitkhan online-clinic-management-systemsubhajitkhan online-clinic-management-system listdoctor.php sql injection6.9 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System pro_edit1.php sql injection5.3 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System inv_edit1.php sql injection5.3 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System sup_edit1.php sql injection5.3 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System emp_transac.php add sql injection5.3 Medium
- sourcecodester school registration and fee systemSourceCodester School Registration and Fee System save_class.php sql injection6.9 Medium
- itsourcecode sales and inventory systemitsourcecode Sales and Inventory System cust_pos_trans.php sql injection5.3 Medium
- sourcecodester school registration and fee systemSourceCodester School Registration and Fee System pay_report.php sql injection6.9 Medium
- sourcecodester school registration and fee systemSourceCodester School Registration and Fee System delete_stud.php sql injection6.9 Medium
- sourcecodester school registration and fee systemSourceCodester School Registration and Fee System save_stud.php sql injection6.9 Medium
- gongshengyue onlinebooksGongShengyue OnlineBooks listSplit BooksServlet.java sql injection5.3 Medium
- fengoffice feng officeFengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injection5.1 Medium
- fengoffice feng officeFengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injection6.9 Medium
- luxsoft luxcal web calendarA SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common...5.8 Medium
- librenmsAn issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges...5.0 Medium
- e-goi smart marketing sms and newsletters formsSmart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name6.5 Medium
- themeisle mpg – multiple page generator, bulk landing pages & programmatic seoMPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path6.5 Medium
- rtcamp rtmedia for wordpress, buddypress and bbpressrtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter7.5 High
- unknown album cover finderAlbum Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_action8.6 High
- unknown samo formsSAMO Forms <= 1.0.0 - Unauthenticated SQLi8.6 High
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.9 - SQL Injection vulnerability7.6 High
- wowdevs sky addons for elementorWordPress Sky Addons for Elementor plugin <= 3.8.4 - SQL Injection vulnerability7.6 High
- spipSPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html8.7 High
- rubengc gamipress – gamification plugin to reward points, badges & ranks in wordpress, now with aiGamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- nextgen healthcare mirth connectNextGen Healthcare Mirth Connect SQL Injection7.2 High
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection7.5 High
- gingerplugins sticky chat widget – floating chat icons, contact form, call, click to chat, email & message buttonsSticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection7.5 High
- No product listedSQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to...9.8 Critical
- openstack horizon, the opennms group meridian +1 moreOpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)6.5 Medium
- pimcorePimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization8.8 High
- Show moreLoading…