CWE-89: SQL Injection
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Also known as Improper Neutralization of Special Elements used in an SQL Command, SQLi.
A kind of CWE-943 NoSQL Injection, NoSQLi.
From the CWE List. © The MITRE Corporation.
Newest
- suitecrmSuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api8.8 High
- suitecrmSuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller8.3 High
- trellix dlp on-prem extensionsSQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote...7.1 High
- apache software foundation ofbizApache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB9.8 Critical
- itsourcecode online book storeitsourcecode Online Book Store admin_edit.php sql injection6.9 Medium
- kobikom telecommunications and informatics services inc. kobikomSQL Injection in Kobikom Telecommunications' Kobikom7.5 High
- catfoldersCatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting6.8 Medium
- unknown ivpay paymentsIVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter9.3 Critical
- itsourcecode airline reservation systemitsourcecode Airline Reservation System manage_booked.php sql injection5.3 Medium
- campcodes complete sales and inventory system with credit managementCampcodes Complete Sales and Inventory System with Credit Management login.php sql injection6.9 Medium
- campcodes division regional athletic meet game result matrix systemCampcodes Division Regional Athletic Meet Game Result Matrix System check-user.php sql injection6.9 Medium
- krupalshah employeerecruitmentsystemkrupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection6.9 Medium
- glpi-project glpiGLPI: Blind Time based SQLI in dropdowns8.7 High
- vtenextvtenext before 25.02.2 SQL Injection via fieldname in Fax EditView8.6 High
- sonatype nexus repository 3Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task7.7 High
- unknown duplicator, duplicator-pro +1 moreDuplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore4.8 Medium
- No product listedfunadmin Frontend List Endpoint index selectList sql injection6.9 Medium
- spipSPIP before 4.4.29 Authenticated SQL Injection via where Parameter7.1 High
libsql-abstract-perlDebian,perl-sql-abstractAlpine +1 moreSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func7.3 Highlibsql-abstract-perlDebian,perl-sql-abstractAlpine +1 moreSQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position7.3 High- francoisjacquet rosariosisRosarioSIS before 12.9 SQL Injection via period_id in Attendance Absence Report8.7 High
- projectsandprograms school-management-systemsumiie24 School-Management-System Public Search Feature parent_Login.php sql injection6.9 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project facultydetails.php sql injection6.9 Medium
- chamilo chamilo-lmsChamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated7.2 High
- hewlett packard enterprise (hpe) fabric composerUnauthenticated Adjacent SQL Injection Vulnerability in HPE Networking Fabric Composer7.5 High
- enspirit eloElo: Code injection in Elo backends via unvalidated emission of programmatic AST fields7.4 High
- sonicwall global management system (gms)Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL...6.8 Medium
- nvidia slurmNVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that...6.3 Medium
- runzero platformrunZero search SQL injection6.5 Medium
- amirhelzer wpml multilingual & multicurrency for woocommerceWPML Multilingual & Multicurrency for WooCommerce <= 5.5.7 - Authenticated (Shop Manager+) SQL Injection via Exchange Rate Field4.9 Medium
- zorem advanced shipment tracking for woocommerceAdvanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter7.2 High
- postgresql psqlodbcpsqlODBC does not escape a server-supplied column name in its updatable-cursor queries7.1 High
- postgresql psqlodbcpsqlODBC SQL injection through SQLSpecialColumns table and schema names7.5 High
- dj-extensions.com dj-classifieds extension for joomlaJoomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.39.3 Critical
- aws aws-sdk-pandasImproper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas5.0 Medium
- control web panel web panelControl Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter6.8 Medium
- control web panel web panelControl Web Panel (CWP) < 1.16 SQL Injection via access_token() API8.4 High
- owntone serverOwnTone Server through 29.3 SQL Injection via MPD sticker find Command6.9 Medium
- starnet computer and network systems inventory tracking applicationSQL Injection in Starnet Computer Systems' Inventory Tracking Application7.5 High
- apache software foundation syncopeApache Syncope: SQL injection via unsanitized opEvent in Audit Events search9.8 Critical
- wso2 api control plane, api manager, carbon api management implementation +2 more +4 moreSQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption8.7 High
- zte elasticnet rnia r18 ngiSQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product6.5 Medium
- dayrui xunruicmsdayrui XunRuiCMS Member View.php View sql injection6.9 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project viewquery.php sql injection6.9 Medium
- liquid web / stellarwp bookitWordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability9.3 Critical
- google androidIn multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access...6.2 Medium
- shamalli web 2.0 directory plugin for wordpressWeb 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' Parameter6.5 Medium
- wpdirectorykit wp directory kitWP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter7.5 High
- contrid newslettersNewsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter5.3 Medium
- tobias conrad wp2leads | wordpress und klicktipp einfach verbinden – woocommerce und klicktipp einfach verbindenWP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter6.5 Medium
- Show moreLoading…