CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,779 vulnerabilities with CWE-89
CVE-2023-22491 HIGH
gatsby-transformer-remark <5.25.1 and 6.0.0-6.3.2 - JavaScript Injection via gray-matter Frontmatter Processing
CVSS 8.1
CVE-2023-0283 MEDIUM
SourceCodester Online Flight Booking Management System - SQL Injection
CVSS 6.3
CVE-2023-0281 MEDIUM
SourceCodester Online Flight Booking Management System - SQL Injection
CVSS 6.3
CVE-2023-0256 MEDIUM
SourceCodester Online Food Ordering System 2.0 - SQL Injection
CVSS 6.3
CVE-2023-0254 HIGH
Simple Membership WP <1.8 - SQL Injection
CVSS 7.2
CVE-2023-0245 MEDIUM
SourceCodester Online Flight Booking Management System - SQL Injection
CVSS 6.3
CVE-2023-0244 MEDIUM
TuziCMS 2.0.6 - SQL Injection via KefuController delall Function
CVSS 6.3
CVE-2023-0243 MEDIUM
TuziCMS 2.0.6 - SQL Injection via Article Module id Parameter
CVSS 6.3
CVE-2023-22959 HIGH
WebChess <= 0.9.0 and 1.0.0.rc2 - SQL Injection via txtFirstName and txtLastName Parameters
CVSS 8.8
CVE-2023-0016 CRITICAL
SAP BPC MS 10.0-810 - SQL Injection
CVSS 9.9
CVE-2022-50895 CRITICAL
Aero CMS 0.0.1 - SQL Injection
CVSS 9.8
CVE-2022-50894 MEDIUM
VIAVIWEB Wallpaper Admin 1.0 - SQL Injection
CVSS 6.5
CVE-2022-50892 HIGH
VIAVIWEB Wallpaper Admin 1.0 - SQL Injection
CVSS 8.2
CVE-2022-50805 HIGH
Senayan Library Management System 9.0.0 - SQL Injection
CVSS 8.2
CVE-2022-50694 CRITICAL
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x - SQL Injection
CVSS 9.8
CVE-2022-4984 HIGH
ZenTao <6.5/<3.0/<16.5/<16.5.beta1 - SQL Injection
CVE-2022-50595 HIGH
Advantech iView <5.7.04 build 6425 - Auth Bypass, SQL Injection
CVSS 7.2
CVE-2022-50594 HIGH
Advantech iView <5.7.04 build 6425 - Auth Bypass
CVSS 7.5
CVE-2022-50593 CRITICAL
Advantech iView <5.7.04 build 6425 - Auth Bypass, SQL Injection
CVSS 9.8
CVE-2022-50592 HIGH
Advantech iView <5.7.04 build 6425 - Auth Bypass, SQL Injection
CVSS 7.2
CVE-2022-50591 CRITICAL
Advantech iView <5.7.04 build 6425 - Auth Bypass
CVSS 9.8
CVE-2022-50589 CRITICAL
SuiteCRM < 7.12.6 - Unauthenticated SQL Injection via Export Functionality UID Parameter
CVSS 9.8
CVE-2022-29059 LOW
FortiWeb <7.0.1, <6.4.2, <6.3.20, <6.2.7 - SQL Injection
CVSS 2.7
CVE-2022-38947 CRITICAL
Flipkart-Clone-PHP 1.0 - SQL Injection
CVSS 9.8
CVE-2022-25775 MEDIUM
Mautic 2.14.1-4.4.11 - Authenticated SQL Injection in Reports Bundle
CVSS 6.6
Details
Vulnerabilities 19,779
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits