CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,772 vulnerabilities with CWE-89
CVE-2023-2750 CRITICAL
Cityboss E-municipality < 6.05 - SQL Injection
CVSS 9.8
CVE-2023-2865 MEDIUM
SourceCodester Theme Park Ticketing System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-1508 CRITICAL
Adam Retail Automation Systems Mobilmen Terminal Software <3 - SQL ...
CVSS 9.8
CVE-2023-31752 CRITICAL
Employee and Visitor Gate Pass Logging System 1.0 - SQL Injection via Login.php
CVSS 9.8
CVE-2023-33362 CRITICAL
Piwigo 13.6.0 - SQL Injection via Profile Function
CVSS 9.8
CVE-2023-33361 CRITICAL
Piwigo 13.6.0 - SQL Injection via Permalinks Admin Endpoint
CVSS 9.8
CVE-2023-33338 CRITICAL
Old Age Home Management 1.0 - SQL Injection
CVSS 9.8
CVE-2023-2832 HIGH
unilogies/bumsys <2.2.0 - SQL Injection
CVSS 7.2
CVE-2023-2823 MEDIUM
SourceCodester Class Scheduling System 1.0 - SQL Injection
CVSS 6.3
CVE-2023-2815 MEDIUM
SourceCodester Online Jewelry Store 1.0 - SQL Injection
CVSS 6.3
CVE-2023-31707 CRITICAL
SEMCMS 1.5 - SQL Injection via Ant_Rponse.php
CVSS 9.8
CVE-2023-20110 MEDIUM
Cisco Smart Software Manager On-Prem < 8-202303 - Authenticated SQL Injection
CVSS 6.5
CVE-2023-29985 CRITICAL
Student Study Center Desk Management System 1.0 - SQL Injection via admin/reports/index.php date_from Parameter
CVSS 9.8
CVE-2023-30191 CRITICAL
cdesigner < 3.2.2 - SQL Injection via CdesignerTraitementModuleFrontController::initContent()
CVSS 9.8
CVE-2023-2775 MEDIUM
Bus Dispatch and Information System 1.0 - SQL Injection via adminHome.php reach_city Parameter
CVSS 6.3
CVE-2023-2774 MEDIUM
Bus Dispatch and Information System 1.0 - SQL Injection via view_branch.php branchid Parameter
CVSS 6.3
CVE-2023-27233 HIGH
Piwigo < 13.6.0 - SQL Injection via order[0][dir] Parameter
CVSS 8.8
CVE-2023-2773 MEDIUM
Bus Dispatch and Information System 1.0 - SQL Injection via adminid Parameter
CVSS 6.3
CVE-2023-2772 MEDIUM
SourceCodester Budget and Expense Tracker System 1.0 - SQL Injection via GET Parameter Handler
CVSS 6.3
CVE-2023-2771 MEDIUM
SourceCodester Online Exam System 1.0 - SQL Injection via columns[1][data] Parameter
CVSS 6.3
CVE-2023-2770 MEDIUM
SourceCodester Online Exam System 1.0 - SQL Injection via /kelasdosen/data columns[1][data] Parameter
CVSS 6.3
CVE-2023-2769 MEDIUM
Service Provider Management System 1.0 - SQL Injection via Master.php id Parameter
CVSS 6.3
CVE-2023-31702 HIGH
MicroWorld eScan Management Console <14.0.1400.2281 - SQL Injection
CVSS 7.2
CVE-2023-2756 HIGH
pimcore customer_management_framework < 3.3.10 - SQL Injection
CVSS 7.2
CVE-2023-30189 CRITICAL
posstaticblocks <= 1.0.0 - SQL Injection via posstaticblocks::getPosCurrentHook()
CVSS 9.8
Details
Vulnerabilities 19,772
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits