CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System edit_class.php sql injection5.1 Medium
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System Student Registration add_student.php sql injection6.9 Medium
- itsourcecode online admission systemitsourcecode Online Admission System login1.php sql injection6.9 Medium
- No product listedFineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order...9.8 Critical
- No product listedApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin...6.5 Medium
- No product listedGouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the...9.8 Critical
- kishor-23 food-waste-management-systemkishor-23 food-waste-management-system Take Order delivery.php sql injection6.9 Medium
- kishor-23 food-waste-management-systemkishor-23 food-waste-management-system Order Assignment Block admin.php sql injection5.3 Medium
- kishor-23 food-waste-management-systemkishor-23 food-waste-management-system donate.php sql injection6.9 Medium
- kishor-23 food-waste-management-systemkishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection6.9 Medium
- rainygao docsysRainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection6.9 Medium
- No product listedmooSocial all-products sql injection6.9 Medium
- comsenz discuz!Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection5.1 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability9.3 Critical
- storeapps smart manager – woocommerce bulk edit: products, orders, users & more (spreadsheet)Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter8.8 High
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter7.5 High
- unitecms unlimited elements for elementorUnlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data6.3 Medium
- unknown saveto wishlist liteSaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters8.6 High
- unitecms unlimited elements for elementorUnlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter6.8 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing7.5 High
- psmplugins supportcandy – ai customer support ticket system & live chatbot agentSupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter6.5 Medium
- beaverbuilder beaver builder page builder – drag and drop website builderBeaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter6.5 Medium
- triggerdotdev trigger.devTrigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Name8.3 High
- utmstackUTMStack < 11.2.16 JPQL Injection via searchPropertyValues7.1 High
- utmstackUTMStack < 11.2.16 SQL Injection via searchGroupsByFilter8.7 High
- codeastro simple loan management systemCodeAstro Simple Loan Management System index.php sql injection5.3 Medium
- codeastro simple pharmacy management systemCodeAstro Simple Pharmacy Management System delete.php sql injection5.3 Medium
- codeastro simple pharmacy management systemCodeAstro Simple Pharmacy Management System view.php sql injection5.3 Medium
- gg soft software services inc. paperworkSQL Injection in GG Soft's Paperwork7.1 High
- onetwothreeneth hospitalmanagementsystemonetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection6.9 Medium
- yeswikiYesWiki before 4.6.7 SQL Injection via nuagetag tags parameter8.8 High
- yeswikiYesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch8.7 High
- yeswikiYesWiki before 4.6.7 SQL Injection via filtertags filterN parameter8.8 High
- yeswikiYesWiki before 4.6.7 Second-Order SQL Injection via ACL Username7.2 High
- itsourcecode online admission system projectitsourcecode Online Admission System Project confirm.php sql injection5.3 Medium
- havelsan inc. sef - ai chatbot platformSQL Injection in HAVELSAN's Sef - AI Chatbot Platform8.8 High
- stellarwp event tickets and registrationEvent Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter6.5 Medium
- wcmp multivendorx – woocommerce multivendor marketplace ai powered solutionsMultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter6.5 Medium
- moby buildkitBuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter6.2 Medium
- sourcecodester online reviewer management systemSourceCodester Online Reviewer Management System btn_functions.php activity sql injection6.9 Medium
- codezips pet shop management systemitsourcecode Pet Shop Management System admin_reservefilter.php sql injection5.3 Medium
- codezips pet shop management systemitsourcecode Pet Shop Management System admin_reject_completed.php sql injection5.3 Medium
- macwarrior clipbucket-v5ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter8.6 High
- red hat satellite 6, satellite 6.16 for rhel 8, satellite 6.16 for rhel 9 +3 more +5 moreRubygem-katello: sql injection in registry proxy via labels6.5 Medium
- codeastro leave management systemitsourcecode Leave Management System controller.php sql injection5.3 Medium
- nickboss wordpress file uploadWordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability9.3 Critical
- ultimate member memberWordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability7.6 High
- captivateaudio captivate syncWordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability7.6 High
- villatheme buildkit – product builder for woocommerce – custom pc builderWordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability8.5 High
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability8.5 High
- Show moreLoading…