CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- dataeaseDataEase: SQL Injection in datasource metadata identifiers8.7 High
- e107inc e107e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username10.0 Critical
- getredash redashRedash: SQL Injection via Query Results parameterized query substitution8.7 High
- juniper networks junos osJunos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication9.2 Critical
- tenable nessusSQL Injection8.7 High
- progress moveit transferMOVEit Transfer SQL injection in custom reporting7.2 High
- yiuman citrusYiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter7.1 High
- dromara skyeyeDromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter7.1 High
- dell powerscale insightiqDell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of...6.1 Medium
- channel software weballiance ecommerceUnauthenticated SQL Injection in Channel Software WebAlliance eCommerce9.8 Critical
- webnus modern events calendar liteWordPress Modern Events Calendar Lite plugin < 7.37.0 - SQL Injection vulnerability8.5 High
- koha community kohaKoha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters7.2 High
- codepeople cp multi view event calendarWordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability8.5 High
- jtl sw gmbh jtl-wmsSQL Command Injection Vulnerability in JTL-WMS9.4 Critical
- unknown fast courierFast Courier 5.0.0 - 5.2.3 - Unauthenticated SQLi via 'wp_order_id' Parameter8.6 High
- unknown walletdoc payment gateway for woocommerceWalletdoc Payment Gateway for WooCommerce < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery via Webhook8.6 High
- hyyan woocommerce polylang integrationHyyan WooCommerce Polylang Integration <= 1.5.0 - Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter6.5 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builderForm Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter7.5 High
- ntbyk jtl-connector for woocommerceJTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated SQL Injection7.5 High
- pasyuk gmedia photo galleryGmedia Photo Gallery <= 1.25.1 - Unauthenticated SQL Injection via 'gmedia__in' Parameter7.5 High
- tyche softwares abandoned cart pro for woocommerceAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter7.5 High
- tyche softwares abandoned cart pro for woocommerceAbandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value9.8 Critical
- omnispace agora projectOmnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter8.6 High
- omnispace agora projectOmnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter8.6 High
- omnispace agora projectOmnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]8.7 High
- adobe experience manager, experience manager 6.5 +1 moreAdobe Experience Manager | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)7.1 High
- microsoft configuration manager, configuration manager 2503, configuration manager 2509 +1 more +3 moreConfiguration Manager Elevation of Privilege Vulnerability8.8 High
- microsoft configuration manager, configuration manager 2509, configuration manager 2603 +2 moreMicrosoft Configuration Manager Elevation of Privilege Vulnerability8.0 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Elevation of Privilege Vulnerability8.8 High
- fortinet fortianalyzer, fortianalyzer cloud, fortimanager +1 more +3 moreAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...6.5 Medium
- fortinet fortianalyzer, fortianalyzer cloud, fortimanager +2 moreAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...5.9 Medium
- fortinet fortianalyzer, fortimanager +1 moreAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...6.5 Medium
- fortinet fortianalyzer, fortianalyzer cloud +1 moreAn Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...7.9 High
- fortinet fortimailAn improper neutralization of special elements used in an SQL Command ("SQL Injection")...7.7 High
- elated-themes frappeFrappe: Possibility of SQL injection in reportview8.7 High
- code-projects online reviewer systemSourceCodester Online Reviewer System index.php prepare sql injection6.9 Medium
- sourcecodester online exam systemSourceCodester Online Exam System Login Endpoint loginExe.php sql injection6.9 Medium
- phpgurukul art gallery management systemSourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection6.9 Medium
- girishsaraf online-appointment-booking-systemgirishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection6.9 Medium
- girishsaraf online-appointment-booking-systemgirishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection6.9 Medium
- girishsaraf online-appointment-booking-systemgirishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection6.9 Medium
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices...7.7 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices...8.4 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices...8.7 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices...8.7 High
- siemens ruggedcom crossbowA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices...8.7 High
- link whisper inc whisper free, unknown link whisper free +1 moreWordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability7.6 High
- pluginus.net wolfWordPress WOLF plugin <= 1.1.1 - SQL Injection vulnerability7.6 High
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Password Reset forgot3.php sql injection6.9 Medium
- sk. abul hasan animated number countersAnimated Number Counters <= 3.0 - Authenticated (Editor+) SQL Injection via 'counterid' Parameter4.9 Medium
- Show moreLoading…