CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,719 vulnerabilities with CWE-89
CVE-2024-25902 HIGH
miniorange Malware Scanner <= 4.7.2 - SQL Injection
CVSS 7.6
CVE-2024-24868 HIGH
SP Project & Document Manager <4.69 - SQL Injection
CVSS 8.5
CVE-2024-24772 MEDIUM
Apache Superset <3.0.4, >3.1.0 - SQL Injection
CVSS 4.3
CVE-2024-1514 CRITICAL
WP eCommerce <= 3.15.1 - Unauthenticated Time-Based Blind SQL Injection via cart_contents Parameter
CVSS 9.8
CVE-2024-0786 HIGH
Conversios - Google Analytics 4 (GA4) <= 7.0.7 - Authenticated Time-Based SQL Injection
CVSS 8.8
CVE-2024-24027 HIGH
Likeshop < 2.5.7 - SQL Injection via DistributionMemberLogic::getFansLists
CVSS 7.2
CVE-2024-25843 CRITICAL
Import/Update Bulk Product from any Csv/Excel File Pro < 1.1.29 - Unauthenticated SQL Injection
CVSS 9.8
CVE-2024-24323 HIGH
linlinjava litemall < 1.8.0 - SQL Injection via AdminOrderController Parameters
CVSS 7.2
CVE-2024-1926 MEDIUM
Free and Open Source Inventory Management System 1.0 - SQL Injection via customer Parameter in search_sales_report.php
CVSS 6.3
CVE-2024-1924 MEDIUM
CodeAstro Membership Management System 1.0 - SQL Injection
CVSS 6.3
CVE-2024-25400 CRITICAL
Subrion CMS 4.2.1 - SQL Injection via ia.core.mysqli.php
CVSS 9.8
CVE-2024-1923 MEDIUM
SourceCodester Simple Student Attendance System 1.0 - SQL Injection
CVSS 6.3
CVE-2024-1698 CRITICAL
NotificationX < 2.8.3 - Unauthenticated SQL Injection via Type Parameter
CVSS 9.8
CVE-2024-24100 HIGH
carmelo computer_book_store 1.0 - SQL Injection via PublisherID
CVSS 8.3
CVE-2024-24099 MEDIUM
Code-projects Scholars Tracking System 1.0 - SQL Injection via Employment Status Information Update
CVSS 5.4
CVE-2024-24096 HIGH
Computer Book Store 1.0 - SQL Injection via BookSBIN
CVSS 7.8
CVE-2024-24095 CRITICAL
Code-projects Simple Stock System 1.0 - SQL Injection
CVSS 9.8
CVE-2024-22917 HIGH
Dynamic Lab Management System Project 1.0 - RCE
CVSS 8.6
CVE-2024-25247 CRITICAL
Niushop B2B2C V5 - SQL Injection via Latitude and Longitude Parameters
CVSS 9.8
CVE-2024-25248 CRITICAL
Niushop B2B2C V5 - SQL Injection via orderGoodsDelivery() order_id Parameter
CVSS 9.8
CVE-2024-24401 CRITICAL
Nagios XI 2024R1.01 - SQL Injection via monitoringwizard.php
CVSS 9.8
CVE-2024-1878 MEDIUM
SourceCodester Employee Management System 1.0 - SQL Injection via myprofile.php id Parameter
CVSS 6.3
CVE-2024-1877 MEDIUM
SourceCodester Employee Management System 1.0 - SQL Injection via /cancel.php id Parameter
CVSS 6.3
CVE-2024-1876 HIGH
SourceCodester Employee Management System 1.0 - SQL Injection via /psubmit.php pid Parameter
CVSS 7.3
CVE-2024-25469 HIGH
CRMEB crmeb_java <1.3.4 - SQL Injection
CVSS 7.5
Details
Vulnerabilities 19,719
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits