CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- tagdiv opt-in builderWordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability9.3 Critical
- tagdiv opt-in builderWordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability8.5 High
- jegtheme jnews - pay writerWordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability9.3 Critical
- taskbuilderWordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability8.5 High
- vibethemes wplmsWordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability9.3 Critical
- vibethemes wplmsWordPress WPLMS theme <= 4.973 - SQL Injection vulnerability8.5 High
- upsolution coreWordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability8.5 High
- codesnippetspro code snippetsCode Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)6.8 Medium
- banq jivejdonJivejdon through 5.0 SQL Injection via username in userListAction6.9 Medium
- ibm guardium data protectionMultiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection9.8 Critical
- ibm guardium data protectionMultiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection8.6 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.1 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access5.4 Medium
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES7.4 High
- mariadb-corporation mariadb-connector-nodejsMariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)8.1 High
- jhipster generator-jhipsterJHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort8.8 High
- appsbd viteposWordPress Vitepos plugin <= 3.6.1 - SQL Injection vulnerability7.6 High
- netboard crm demo platformSQL injection in the NetBoard CRM demo platform10.0 Critical
- broadcom brocade sannav, brocade sannav +1 moreIn Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API...6.1 Medium
- splunk, splunk enterprise +1 moreStructured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise6.5 Medium
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability9.3 Critical
- cisco license on-premCisco Smart Software Manager On-Prem SQL Injection Vulnerability4.9 Medium
- sipcapture homerHomer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query8.1 High
- af themes wp post authorWordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability7.6 High
- 10web slider by 10webWordPress Slider by 10Web plugin <= 1.2.63 - SQL Injection vulnerability7.6 High
- gopiplus post title marquee scrollWordPress Post title marquee scroll plugin <= 9.9 - SQL Injection vulnerability7.6 High
- piggly dev pix por piggly (para woocommerce)WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability7.6 High
- six apart ltd. movable type, movable type cloud edition, movable type premium +1 more +3 moreAn SQL Injection vulnerability exists in the Site Search function of Movable Type, which may...8.8 High
- sarah giles dynamic user directoryWordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability7.6 High
- servit software solutions affiliate-toolkitWordPress affiliate-toolkit plugin <= 3.9.1 - SQL Injection vulnerability7.6 High
- manacle technologies multi-tenant erp systemSQL Injection Vulnerability in Manacle Technologies ERP System9.3 Critical
- ordasoft.com ordasoft simple membership extension for joomlaJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.09.3 Critical
- themeisle mpgMPG < 4.2.3 - Editor+ SQLi via Project Import6.8 Medium
- sk. abul hasan animated number countersAnimated Number Counters < 3.1 - Editor+ Second-Order SQLi via Counter Order6.8 Medium
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authenticated SQL Injection allows Remote Code Execution in ClearPass Policy Manager API7.2 High
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface9.9 Critical
- hewlett packard enterprise (hpe) clearpass policy manager (cppm)Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface9.1 Critical
- payload cmsSQL Injection in Payload CMS8.7 High
- payloadcms payload, @payloadcms db-d1-sqlite, db-postgres +2 more +4 morePayload: SQL injection in SQLite/Postgres8.6 High
- sourcecodester performance indicator systemSourceCodester Performance Indicator System view_product.php sql injection5.3 Medium
- payloadcms payloadPayload: SQL Injection in SQLite and Postgres9.8 Critical
- kusalkasilva learning-management-systemKusalkasilva Learning-Management-System search_class.php sql injection5.3 Medium
- kusalkasilva learning-management-systemKusalkasilva Learning-Management-System Student Registration Endpoint student_signup.php sql injection6.9 Medium
- kusalkasilva learning-management-systemKusalkasilva Learning-Management-System Administrator Login Endpoint login.php mysql_query sql injection6.9 Medium
- kusalkasilva learning-management-systemKusalkasilva Learning-Management-System Login Endpoint login.php mysql_error sql injection6.9 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability8.5 High
- repute infosystems armember premiumWordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability9.3 Critical
- andondesign udesign coreWordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability8.5 High
- p-themes porto theme - functionalityWordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability9.3 Critical
- cridiostudio listingproWordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability8.5 High
- Show moreLoading…