CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,784 vulnerabilities with CWE-89
CVE-2022-40927 HIGH
Online Leave Management System v1.0 - SQL Injection
CVSS 7.2
CVE-2022-40926 HIGH
Online Leave Management System v1.0 - SQL Injection
CVSS 7.2
CVE-2022-40404 HIGH
Wedding Planner 1.0 - SQL Injection via id Parameter
CVSS 8.8
CVE-2022-40403 HIGH
Wedding Planner 1.0 - SQL Injection via id Parameter
CVSS 7.2
CVE-2022-40402 HIGH
Wedding Planner 1.0 - SQL Injection via Booking Parameter
CVSS 8.8
CVE-2022-40122 CRITICAL
Online Banking System 1.0 - SQL Injection via cust_id Parameter
CVSS 9.8
CVE-2022-40121 CRITICAL
Online Banking System v1.0 - SQL Injection via Search Parameter
CVSS 9.8
CVE-2022-40120 CRITICAL
Online Banking System v1.0 - SQL Injection via search_term Parameter
CVSS 9.8
CVE-2022-40119 CRITICAL
Online Banking System 1.0 - SQL Injection via Search Term Parameter
CVSS 9.8
CVE-2022-40118 CRITICAL
Online Banking System 1.0 - SQL Injection via cust_id Parameter
CVSS 9.8
CVE-2022-40117 CRITICAL
Online Banking System v1.0 - SQL Injection via cust_id Parameter
CVSS 9.8
CVE-2022-40116 CRITICAL
Online Banking System v1.0 - SQL Injection via Search Parameter
CVSS 9.8
CVE-2022-40115 CRITICAL
Online Banking System v1.0 - SQL Injection via cust_id Parameter
CVSS 9.8
CVE-2022-40114 CRITICAL
Online Banking System v1.0 - SQL Injection via cust_id Parameter
CVSS 9.8
CVE-2022-40113 CRITICAL
Online Banking System 1.0 - SQL Injection via cust_id Parameter
CVSS 9.8
CVE-2022-32211 HIGH
Rocket.Chat < 3.18.6 - SQL Injection via Password Reset Token Retrieval
CVSS 8.8
CVE-2022-40093 HIGH
Online Tours & Travels Management System 1.0 - SQL Injection via id Parameter
CVSS 7.2
CVE-2022-40092 HIGH
Online Tours & Travels Management System 1.0 - SQL Injection via id Parameter
CVSS 7.2
CVE-2022-40091 HIGH
Online Tours & Travels Management System 1.0 - SQL Injection via id Parameter
CVSS 7.2
CVE-2022-40935 HIGH
Online Pet Shop We App v1.0 - SQL Injection
CVSS 7.2
CVE-2022-40934 HIGH
Online Pet Shop We App v1.0 - SQL Injection
CVSS 7.2
CVE-2022-40933 HIGH
Online Pet Shop We App v1.0 - SQL Injection
CVSS 7.2
CVE-2022-40447 HIGH
ZZCMS 2022 - SQL Injection via keyword Parameter
CVSS 7.2
CVE-2022-40446 HIGH
ZZCMS 2022 - SQL Injection via /admin/sendmailto.php groupid Parameter
CVSS 7.2
CVE-2022-40030 CRITICAL
Simple Task Managing System 1.0 - SQL Injection via bookId Parameter
CVSS 9.8
Details
Vulnerabilities 19,784
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits