CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,802 vulnerabilities with CWE-89
CVE-2022-35864 MEDIUM
BMC Track-It! 20.21.02.109 - Info Disclosure
CVSS 6.5
CVE-2022-34872 MEDIUM
Centreon - Authenticated SQL Injection via Virtual Metrics Processing
CVSS 6.5
CVE-2022-34871 HIGH
Centreon - Authenticated SQL Injection in Poller Resource Configuration
CVSS 7.2
CVE-2022-2272 CRITICAL
Sante PACS Server 3.0.4 - Unauthenticated SQL Injection via Login Endpoint Username Parameter
CVSS 9.8
CVE-2022-34968 HIGH
Percona Server for MySQL v8.0.28-19 - Denial of Service via SQL Query
CVSS 7.5
CVE-2022-34928 HIGH
JFinal CMS 5.1.0 - SQL Injection via /system/user
CVSS 8.8
CVE-2022-29807 CRITICAL
Quest KACE Systems Management Appliance < 12.1.168 - SQL Injection via download_agent_installer.php
CVSS 9.8
CVE-2022-35422 CRITICAL
Web Based Quiz System 1.0 - SQL Injection via qid Parameter
CVSS 9.8
CVE-2022-35421 HIGH
Online Tours And Travels Management System v1.0 - SQL Injection via pname Parameter
CVSS 7.2
CVE-2022-34956 CRITICAL
Pligg CMS v2.0.2 - Time-Based SQL Injection via Page Size Parameter
CVSS 9.8
CVE-2022-34955 CRITICAL
Pligg CMS v2.0.2 - Time-Based SQL Injection via page_size Parameter
CVSS 9.8
CVE-2022-34954 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via invoiceprint.php id Parameter
CVSS 9.8
CVE-2022-34953 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via startDate Parameter
CVSS 9.8
CVE-2022-34952 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via edituser.php id Parameter
CVSS 9.8
CVE-2022-34951 CRITICAL
Pharmacy Management System v1.0 - SQL Injection via startDate Parameter
CVSS 9.8
CVE-2022-34950 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via editproduct.php id Parameter
CVSS 9.8
CVE-2022-34949 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via Login Email or Password Parameter
CVSS 9.8
CVE-2022-34948 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via editbrand.php id Parameter
CVSS 9.8
CVE-2022-34947 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via editcategory.php id Parameter
CVSS 9.8
CVE-2022-34946 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via startDate Parameter
CVSS 9.8
CVE-2022-34945 CRITICAL
Pharmacy Management System 1.0 - SQL Injection via startDate Parameter
CVSS 9.8
CVE-2022-31181 CRITICAL
PrestaShop <1.7.8.7 - SQL Injection
CVSS 9.8
CVE-2022-1950 CRITICAL
Youzify WordPress <1.2.0 - SQL Injection
CVSS 9.8
CVE-2022-22280 CRITICAL
SonicWall GMS <9.3.1-SP2-Hotfix1 - SQL Injection
CVSS 9.8
CVE-2022-2577 MEDIUM
SourceCodester Garage Management System 1.0 - SQL Injection
CVSS 6.3
Details
Vulnerabilities 19,802
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits