CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,735 vulnerabilities with CWE-89
CVE-2023-46018 MEDIUM
Code-Projects Blood Bank 1.0 - SQL Injection
CVSS 5.5
CVE-2023-46017 MEDIUM
Code-Projects Blood Bank 1.0 - SQL Injection
CVSS 5.5
CVE-2023-46014 MEDIUM
Code-Projects Blood Bank 1.0 - SQL Injection
CVSS 5.5
CVE-2023-6097 CRITICAL
ICS Business Manager 7.06.0028.7089 - SQL Injection
CVSS 9.4
CVE-2023-6084 MEDIUM
Tongda OA < 11.10 - SQL Injection via VU_ID Parameter in general/vehicle/checkup/delete.php
CVSS 6.3
CVE-2023-47128 CRITICAL
piccolo < 1.1.1 - SQL Injection via Savepoint Name Parameter
CVSS 9.1
CVE-2023-41285 HIGH
QuMagie < 2.1.4 - Authenticated SQL Injection
CVSS 7.4
CVE-2023-41284 HIGH
QuMagie < 2.1.4 - Authenticated SQL Injection
CVSS 7.4
CVE-2023-6074 MEDIUM
PHPGurukul Restaurant Table Booking System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-39796 CRITICAL
WBCE CMS 1.6.0 - Unauthenticated SQL Injection via DB_RECORD_TABLE Parameter
CVSS 9.8
CVE-2023-6054 MEDIUM
Tongda OA < 11.10 - SQL Injection via TERM_ID_STR Parameter
CVSS 5.5
CVE-2023-6053 MEDIUM
Tongda OA < 11.10 - SQL Injection via DELETE_STR Parameter in censor_words Management
CVSS 6.3
CVE-2023-6052 MEDIUM
Tongda OA < 11.10 - SQL Injection via DELETE_STR Parameter in delete.php
CVSS 6.3
CVE-2023-46800 CRITICAL
Online Matrimonial Project v1.0 - SQL Injection
CVSS 9.8
CVE-2023-46793 CRITICAL
Online Matrimonial Project v1.0 - SQL Injection
CVSS 9.8
CVE-2023-46789 CRITICAL
Online Matrimonial Project v1.0 - SQL Injection
CVSS 9.8
CVE-2023-46788 CRITICAL
Online Matrimonial Project v1.0 - SQL Injection
CVSS 9.8
CVE-2023-46787 CRITICAL
Online Matrimonial Project v1.0 - SQL Injection
CVSS 9.8
CVE-2023-46785 CRITICAL
Online Matrimonial Project v1.0 - SQL Injection
CVSS 9.8
CVE-2023-46679 CRITICAL
Online Job Portal v1.0 - SQL Injection
CVSS 9.8
CVE-2023-46677 CRITICAL
Online Job Portal v1.0 - SQL Injection
CVSS 9.8
CVE-2023-33481 CRITICAL
RemoteClinic 2.0 - Time-Based Blind SQL Injection via Patients Index Start Parameter
CVSS 9.8
CVE-2023-33479 CRITICAL
RemoteClinic 2.0 - SQL Injection in /staff/edit.php
CVSS 9.8
CVE-2023-33478 CRITICAL
RemoteClinic 2.0 - SQL Injection via ID Parameter in /medicines/stocks.php
CVSS 9.8
CVE-2023-5709 HIGH
WD WidgetTwitter <= 1.0.9 - Authenticated SQL Injection via Shortcode Parameter
CVSS 8.8
Details
Vulnerabilities 19,735
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits