CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.1 Critical
- pgpartman pg partmanpg_partman has privilege escalation through SQL injection in create_partition_time()9.9 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.9 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.8 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.8 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.6 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.8 Critical
- ibm spectrum-lsf : ibm platform rtmThe IBM Platform RTM is affected by an SQL injection vulnerability8.6 High
- chanjet information technology co., ltd. crmChanjet CRM SQL Injection via get_usedspace.php8.7 High
- weaver network co., ltd. e-cologyWeaver E-cology SQL Injection via SyncUserInfo.jsp8.7 High
- hongjing e-hrHongjing e-HR < 8.2 SQL Injection via /servlet/codesettree9.3 Critical
- macwarrior clipbucket-v5ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint7.1 High
- macwarrior clipbucket-v5ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint7.1 High
- siyuan-note siyuanSiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go7.2 High
- synology diskstation manager (dsm)An improper neutralization of special elements used in an SQL command ('SQL injection')...6.5 Medium
- synology diskstation manager (dsm)An improper neutralization of special elements used in an SQL command ('SQL Injection')...2.7 Low
- hcl software bigfix service managementHCL BigFix Service Management is affected by multiple security vulnerabilities.9.8 Critical
- ayecode ltd location managerLocation Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters7.5 High
- 10web photo gallery by 10web – mobile-friendly image galleryPhoto Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute6.5 Medium
- wpexpertsio wp multi store locator proWP Multi Store Locator Pro <= 4.5.1 - Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter7.5 High
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.3.0 - Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter4.9 Medium
- wclovers wcfm marketplace – multivendor marketplace for woocommerceWCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter7.5 High
- chuck1982 wp inventory manager, wp inventory manager +1 moreWP Inventory Manager <= 2.5.1 - Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute6.5 Medium
- infinitewp client, revmakx infinitewp client +1 moreInfiniteWP Client <= 1.13.9 - Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key6.5 Medium
- unknown tz weekly radio scheduleTz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell8.6 High
- unknown tz weekly radio scheduleTz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week8.6 High
- unknown product question and answerProduct Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read8.6 High
- unknown price drop alert for woo commercePrice Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product8.6 High
- unknown wp shortcut link and advertisement banerWP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url8.6 High
- zohocorp datasecurity plusAuthenticated SQL injection8.1 High
- cubecart v6CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php7.2 High
- cubecart v6CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php7.2 High
- dataease sqlbotSQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution7.7 High
- dataease sqlbotSQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read6.0 Medium
- signozSigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names8.4 High
- itflow-org itflowITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter8.3 High
- itflow-org itflowITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration8.1 High
- mapserverMapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation8.2 High
- frappe hrmsFrappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report7.1 High
- traccarTraccar: Authenticated Blind SQL Injection in DELETE /api/permissions7.1 High
- code-projects matrimonial systemcode-projects Matrimonial System partner_preference.php writepartnerprefs sql injection6.9 Medium
- signozSigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders8.4 High
- cakephpCakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection9.2 Critical
- moreconvert mc woocommerce wishlistWordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability7.6 High
- publishpress seriesWordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability7.6 High
- wp lab wp-lister lite for ebayWordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability7.6 High
- sonal s sinha skt addons for elementorWordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability7.6 High
- wcvendors wc vendors marketplaceWordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability7.6 High
- ludwig you wpmastertoolkitWordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability7.6 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability7.6 High
- Show moreLoading…