CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table7.0 High
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase7.1 High
- pandora fms fmsSQL Injection in Grafana Integration Endpoint (query.php)7.2 High
- unknown pro like buttonPro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter8.6 High
- paytm payment gateway, unknown paytm payment gateway +1 morePaytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback7.5 High
- codeastro leave management systemitsourcecode Leave Management System controller.php sql injection5.3 Medium
- accellion kiteworks, kiteworks secure data forms +1 moreKiteworks Secure Data Forms SQL injection7.1 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core SQL Injection7.2 High
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection6.9 Medium
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection6.9 Medium
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injection6.9 Medium
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection6.9 Medium
- joomcode jc tables, joomcode.com jctables extension for joomla +1 moreJoomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.110.0 Critical
- trex digital smart manufacturing systems inc. mesSQL Injection in Trex Digital Manufacturing's Trex MES9.8 Critical
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability7.6 High
- dolusoft software technologies soplogMultiple Vulnerabilities in Dolusoft Software's SOPLOG9.8 Critical
- os4ed opensis-classicOS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection5.1 Medium
- os4ed opensis-classicOS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection5.3 Medium
- david lingren media library assistantWordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability8.5 High
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability8.5 High
- vidish category discount woocommerceWordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability7.6 High
- melapress admin notices managerWordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability7.6 High
- hossni mubarak books galleryWordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability9.3 Critical
- wedevs wp erpWordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability7.6 High
- estatikWordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability7.6 High
- ruben garcia gamipressWordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability8.5 High
- fatcatapps easy pricing tablesWordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability8.5 High
- fatcatapps quiz catWordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability7.6 High
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability8.2 High
- melapress wp activity logWordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability7.6 High
- os4ed opensis-classicOS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection5.3 Medium
- os4ed opensis-classicOS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection5.3 Medium
- os4ed opensis-classicOS4ED openSIS-Classic General Information Tab Student.php save action sql injection5.1 Medium
- moodleMoodle: sql injection in question bank web service5.5 Medium
- digiwin easyflow .netDigiWin｜EasyFlow .NET - SQL Injection7.1 High
- wpdirectorykit wp directory kitWP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter6.5 Medium
- stylemix motors – car dealership & classified listings pluginMotors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters7.5 High
- sourcecodester car driving school management systemSourceCodester Car Driving School Management System Master.php save_enrollment sql injection6.9 Medium
- sourcecodester online leave management systemSourceCodester Online Leave Management System page reports sql injection5.1 Medium
- sourcecodester online reviewer management systemSourceCodester Online Reviewer Management System exam-delete.php sql injection6.9 Medium
- sourcecodester online reviewer management systemSourceCodester Online Reviewer Management System btn_functions.php sql injection6.9 Medium
- sourcecodester online reviewer management systemSourceCodester Online Reviewer Management System questions-view.php sql injection6.9 Medium
- zetetic sqlcipherZetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function...2.1 Low
- shopify tophat, toptech systems tms7 +1 moreToptech TMS7 and TopHAT SQL Injection8.5 High
- shopify tophat, toptech systems tms7 +1 moreToptech TMS7 and TopHAT SQL Injection8.5 High
- shopify tophat, toptech systems tms7 +1 moreToptech TMS7 and TopHAT SQL Injection8.5 High
- shopify tophat, toptech systems tms7 +1 moreToptech TMS7 and TopHAT SQL Injection8.5 High
- shopify tophat, toptech systems tms7 +1 moreToptech TMS7 and TopHAT SQL Injection8.5 High
- risesoft-y9 workflow-enginerisesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection6.9 Medium
- wikimedia foundation mediawiki - userpageviewtracker extensionUnauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters7.5 High
- Show moreLoading…