CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- amans2k funnelkit automations – email marketing automation and crm for wordpress & woocommerceFunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter7.5 High
- mqttsnet thinglinksThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection9.1 Critical
- seancorfield honeysqlHoneySQL unchecked entity names can lead to SQL injection results9.8 Critical
- intinitum form transliteratorWordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability9.3 Critical
- ahmadmj majestic support – the leading-edge help desk & customer support pluginMajestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter6.5 Medium
- 37954679 cak-filemanagement-system37954679 cak-filemanagement-system save_student.php mysqli_query sql injection6.9 Medium
- coreshopCoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList8.7 High
- coreshopCoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList8.7 High
- dell openmanage enterpriseDell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of...7.1 High
- arketeam bdf, protectelmaj +1 moreSQL Injection in Protectel8.4 High
- arketeam bdf, protectelmaj +1 moreSQL Injection in Protectel8.4 High
- phpmyadminphpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute2.3 Low
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber6.0 Medium
- phpmyadminphpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting2.3 Low
- cakephpCakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation9.2 Critical
- cakephpCakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()9.2 Critical
- apache fineractApache Fineract: SQL injection vulnerability in Search API9.8 Critical
- apache fineractApache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints8.8 High
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter4.1 Medium
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute6.5 Medium
- lightdashLightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key8.3 High
- centreonAuthenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.07.2 High
- favethemes mls on the flyWordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability8.5 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability8.5 High
- open-emr openemrOpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]8.7 High
- blazethemes newsmaticNewsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter7.5 High
- stylemixthemes motorsWordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability9.3 Critical
- buddypressWordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability8.5 High
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute6.5 Medium
- radius synergies xenia m2m platformSQL Injection Vulnerability in Radius Xenia M2M Platform9.3 Critical
- unknown vtablesvTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter8.6 High
- dejanmarkovic social web suite – social media auto post, social media auto publishSocial Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter7.5 High
- brewlabs sendpress newslettersSendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter7.5 High
- wwbn avideo-encoderAVideo-Encoder: pre-authentication streamer-login SQL injection7.5 High
- opencatsOpenCATS: Authenticated SQL injection in activity DataGrid date filters7.6 High
- advanced ads gmbh ads – trackingWordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability8.5 High
- buddypressWordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability8.5 High
- aman funnelkit automationsWordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability9.3 Critical
- crowd favorite dxp toolkitWordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability9.3 Critical
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...9.6 Critical
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...4.3 Medium
- futurum software user authentication moduleSQL injection (SQLi) in the user authentication module of Futurum Software9.1 Critical
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...2.7 Low
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...2.7 Low
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...2.7 Low
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...2.7 Low
- chuck1982 wp inventory manager, wp inventory manager +1 moreWP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute6.5 Medium
- e4jvikwp vikrentcar car rental management systemVikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute6.5 Medium
- osamaesh wp visitor statistics (real time traffic)WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute6.5 Medium
- unknown recipe card blocks liteRecipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute6.8 Medium
- Show moreLoading…