CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- erzhongxmu jeewmserzhongxmu JEEWMS Search Endpoint WvNoticeController.java WvNoticeController.list sql injection5.3 Medium
- erzhongxmu jeewmserzhongxmu JEEWMS MdBinController.java getbinallagv sql injection5.3 Medium
- erzhongxmu jeewmserzhongxmu JEEWMS WmOmNoticeHController.java docheck sql injection5.3 Medium
- interuse i-bosInteruse i-Bos CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')5.9 Medium
- erzhongxmu jeewmserzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection5.3 Medium
- xinhu rainrock rockoaXinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection6.9 Medium
- furion .net frameworkFurion .NET Framework StringRenderExtensions.cs String.Replace sql injection5.3 Medium
- highwarden super store finderhighwarden Super Store Finder index.php sql injection5.3 Medium
- unknown paymendoPaymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter6.5 Medium
- unknown paymendoPaymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter6.5 Medium
- unknown post voting systemPost Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter8.6 High
- unknown wp verify apiWP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter8.6 High
- unknown loja automáticaLoja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter8.6 High
- unknown aspl product quotationASPL Product Quotation <= 1.1.0 - Unauthenticated SQLi via 'quote_id' Parameter8.6 High
- unknown datalist itDatalist it <= 0.0.3 - Unauthenticated SQLi via dli_fronted_action8.6 High
- unknown wp-partnerWP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter8.6 High
- unknown recordbrowserRecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter8.6 High
- unknown wpcues basic quizWpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission8.6 High
- unknown llavero.ioLlavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter8.6 High
- unknown site setup wizardSite Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists8.6 High
- unknown social web suiteSocial Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret8.6 High
- unknown tcard wpTcard WP <= 1.8.0 - Unauthenticated SQLi via group_id Parameter8.6 High
- mobile builder builder, unknown mobile builder +1 moreMobile Builder <= 1.4.2 - Unauthenticated SQLi via 'vendor_id' Parameter8.6 High
- dmitry v. barcode scanner with inventory & order managerWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability8.5 High
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability9.3 Critical
- smackcoders inc. wp ultimate csv importerWordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability7.6 High
- shabti frontend admin by dynamiappsWordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability7.6 High
- vaultdweller leykaWordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability7.6 High
- qode toursWordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability8.5 High
- marcus events managerWordPress Events Manager plugin <= 7.4.6 - SQL Injection vulnerability8.5 High
- elextensions elex woocommerce advanced bulk edit products, prices & attributesWordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability9.3 Critical
- tickeraWordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability9.3 Critical
- wpdirectorykit wp directory kitWP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)6.5 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter7.5 High
- murgroland wp booking system – booking calendarWP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter6.5 Medium
- unknown ltl freight quotesLTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter8.6 High
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.280 - Admin+ SQLi via 'per_page' Parameter4.1 Medium
- supsysticcom smart popup by supsysticSmart Popup by Supsystic <= 1.13.2 - Authenticated (Administrator+) SQL Injection via 'sidx' Parameter4.9 Medium
- fireplugins firebox – woocommerce popup builder, exit intent popup, email optin & cart abandonmentFireBox <= 3.1.13 - Authenticated (Author+) SQL Injection via FireBox Form Display Condition5.3 Medium
- jetbrains exposedIn JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of...9.8 Critical
- No product listedWordPress Post Author Authenticated SQLi7.1 High
- No product listedWordPress Post Author Authenticated SQLi4.9 Medium
- hotspotbilling phpnuxbillPHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php9.3 Critical
- danielbrendel hortusfox-webHortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter7.1 High
- processmakerProcessMaker has SQL injection in the tasks endpoint through the order_by parameter6.5 Medium
- unknown testimonials by bestwebsoftTestimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter6.8 Medium
- hclsoftware travelerWordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability9.3 Critical
- metagauss profilegridWordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability8.5 High
- chris gårdenberg, multinet interactive ab eduadmin bookingWordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability9.3 Critical
- unknown ajax search proWordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability9.3 Critical
- Show moreLoading…