CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,747 vulnerabilities with CWE-89
CVE-2023-3850 MEDIUM
SourceCodester Lost and Found Information System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-3839 MEDIUM
DedeBIZ 6.2.10 - SQL Injection via /admin/sys_sql_query.php sqlquery Parameter
CVSS 4.1
CVE-2023-3826 MEDIUM
IBOS OA 4.5.5 - SQL Injection via Interview Handler resumeid Parameter
CVSS 6.3
CVE-2023-3820 HIGH
pimcore < 10.6.4 - SQL Injection
CVSS 7.2
CVE-2023-3811 MEDIUM
Hospital Management System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-3810 MEDIUM
Hospital Management System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-3809 MEDIUM
Hospital Management System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-3808 MEDIUM
Hospital Management System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-3807 MEDIUM
Campcodes Beauty Salon Management System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-3801 MEDIUM
IBOS OA 4.5.5 - SQL Injection in Mobile Notification Handler
CVSS 5.5
CVE-2023-3799 MEDIUM
IBOS OA 4.5.5 - SQL Injection via Delete Category Handler
CVSS 6.3
CVE-2023-3795 MEDIUM
Bug Finder ChainCity Real Estate Investment Platform 1.0 - SQL Injection via GET Parameter Handler
CVSS 5.5
CVE-2023-3793 MEDIUM
Weaver e-cology < 10.58.0 - SQL Injection via fileid Parameter in filelFileDownloadForOutDoc.class
CVSS 5.5
CVE-2023-31753 CRITICAL
eNdonesia 8.7 - SQL Injection via diskusi.php rid Parameter
CVSS 9.8
CVE-2023-37165 CRITICAL
Millhouse-Project 1.414 - Remote Code Execution via /add_post_sql.php
CVSS 9.8
CVE-2023-3791 MEDIUM
IBOS OA 4.5.5 - SQL Injection via Personal Office Address Book Export Function
CVSS 6.3
CVE-2023-26217 HIGH
TIBCO EBX Add-ons <4.5.17, <5.6.2, <=6.1.0 - SQL Injection
CVSS 8.8
CVE-2023-25839 HIGH
Esri ArcGIS Insights Desktop 2022.1 - Authenticated SQL Injection
CVSS 7.0
CVE-2023-25838 HIGH
Esri ArcGIS Insights 2022.1 - Authenticated SQL Injection
CVSS 7.5
CVE-2023-3751 MEDIUM
Super Store Finder 3.6 - SQL Injection via POST Parameter Handler
CVSS 6.3
CVE-2023-30153 CRITICAL
Payplug 3.6.0-3.7.1 - SQL Injection via ajax.php Front Controller
CVSS 9.8
CVE-2023-28019 MEDIUM
Bigfix WebUI < 14 - Authenticated SQL Injection via Unparameterized API Query
CVSS 5.5
CVE-2023-23660 HIGH
MainWP Maintenance Extension <= 4.1.1 - Authenticated SQL Injection
CVSS 8.5
CVE-2023-3743 HIGH
Ap Page Builder < 1.7.8.2 - SQL Injection via product_one_img Parameter
CVSS 7.5
CVE-2023-3376 CRITICAL
Digital Strategy Zekiweb <2 - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,747
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits