CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,719 vulnerabilities with CWE-89
CVE-2024-2282 HIGH
boyiddha Automated-Mess-Management-System 1.0 - SQL Injection
CVSS 7.3
CVE-2024-25849 CRITICAL
PrestaToolKit <=1.7.1 - Unauthenticated SQL Injection via MakeOffers
CVSS 9.8
CVE-2024-25848 MEDIUM
Ever Ultimate SEO <= 8.1.2 - Unauthenticated SQL Injection
CVSS 5.9
CVE-2024-25845 CRITICAL
CD Custom Fields 4 Orders <= 1.0.0 - Unauthenticated SQL Injection
CVSS 9.8
CVE-2024-2272 MEDIUM
keerti1924 Online-Book-Store-Website 1.0 - SQL Injection
CVSS 6.3
CVE-2024-2271 MEDIUM
keerti1924 Online-Book-Store-Website 1.0 - SQL Injection
CVSS 6.3
CVE-2024-2269 MEDIUM
keerti1924 Online-Book-Store-Website 1.0 - SQL Injection
CVSS 6.3
CVE-2024-2264 HIGH
keerti1924 PHP-MYSQL-User-Login-System 1.0 - SQL Injection
CVSS 7.3
CVE-2024-28094 HIGH
Schoolbox < 23.1.3 - Authenticated Blind SQL Injection in Chat Functionality
CVSS 8.8
CVE-2024-24375 HIGH
jfinalcms 5.0.0 - SQL Injection via Admin Name Parameter
CVSS 7.5
CVE-2024-27304 CRITICAL
pgx <4.18.2, <5.5.4 - SQL Injection
CVSS 9.8
CVE-2024-27289 HIGH
pgx < 4.18.2 - SQL Injection via Simple Protocol Numeric Placeholder
CVSS 8.1
CVE-2024-24098 HIGH
Code-projects Scholars Tracking System 1.0 - SQL Injection via News Feed
CVSS 7.8
CVE-2024-27718 HIGH
Smart s200 Management Platform v.S200 - SQL Injection
CVSS 7.8
CVE-2024-2168 MEDIUM
Online Tours & Travels Management System 1.0 - SQL Injection via Expense Category Status Parameter
CVSS 4.7
CVE-2024-27889 HIGH
Arista NG Firewall < 17.0 - Authenticated SQL Injection
CVSS 8.8
CVE-2024-2156 MEDIUM
SourceCodester Best POS Management System 1.0 - SQL Injection
CVSS 6.3
CVE-2024-2154 MEDIUM
SourceCodester Online Mobile Management Store 1.0 - SQL Injection
CVSS 6.3
CVE-2024-2153 MEDIUM
SourceCodester Online Mobile Management Store 1.0 - SQL Injection
CVSS 6.3
CVE-2024-2152 MEDIUM
SourceCodester Online Mobile Management Store 1.0 - SQL Injection
CVSS 4.7
CVE-2024-2149 MEDIUM
CodeAstro Membership Management System 1.0 - SQL Injection
CVSS 4.7
CVE-2024-2147 HIGH
SourceCodester Online Mobile Management Store 1.0 - SQL Injection
CVSS 7.3
CVE-2024-27746 CRITICAL
Petrol Pump Mangement Software <1.0 - SQL Injection
CVSS 9.8
CVE-2024-2077 MEDIUM
Simple Online Bidding System 1.0 - SQL Injection via index.php category_id Parameter
CVSS 6.3
CVE-2024-2074 MEDIUM
Mini-Tmall <20231017 - SQL Injection
CVSS 6.3
Details
Vulnerabilities 19,719
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits