CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,816 vulnerabilities with CWE-89
CVE-2022-28000 HIGH
Car Rental System 1.0 - SQL Injection via Booking ID Parameter
CVSS 8.8
CVE-2022-27992 HIGH
Zoo Management System 1.0 - SQL Injection via class_id Parameter
CVSS 8.8
CVE-2022-27991 MEDIUM
Online Banking System in PHP v1 - SQL Injection via Staff ID and Staff Password Parameters
CVSS 6.5
CVE-2022-1219 HIGH
pimcore < 10.3.5 - SQL Injection in RecyclebinController.php
CVSS 7.5
CVE-2022-23972 HIGH
ASUS RT-AX56U Firmware - Unauthenticated SQL Injection
CVSS 8.8
CVE-2022-26613 CRITICAL
PHP-CMS v1.0 - SQL Injection via Category Parameter
CVSS 9.8
CVE-2022-28468 CRITICAL
Payroll Management System v1.0 - SQL Injection
CVSS 9.8
CVE-2022-28467 CRITICAL
Online Student Admission v1.0 - SQL Injection
CVSS 9.8
CVE-2022-28116 CRITICAL
Online Banking System 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2022-28115 CRITICAL
Online Sports Complex Booking 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2022-27304 CRITICAL
Student Grading System 1.0 - SQL Injection via User Parameter
CVSS 9.8
CVE-2022-27124 CRITICAL
Insurance Management System 1.0 - SQL Injection via Username Parameter
CVSS 9.8
CVE-2022-27123 CRITICAL
Employee Performance Evaluation v1.0 - SQL Injection via Email Parameter
CVSS 9.8
CVE-2022-26628 CRITICAL
Matrimony 1.0 - SQL Injection via Password Parameter
CVSS 9.8
CVE-2022-26986 HIGH
ImpressCMS < 1.4.3 - SQL Injection
CVSS 7.2
CVE-2022-24231 CRITICAL
Simple Student Information System v1.0 - SQL Injection
CVSS 9.8
CVE-2022-26585 CRITICAL
Mingsoft MCMS <5.2.7 - SQL Injection
CVSS 9.8
CVE-2022-0887 HIGH
Easy Social Icons < 3.1.4 - SQL Injection via selected_icons Attribute
CVSS 7.2
CVE-2022-23797 CRITICAL
Joomla! 3.0.0-3.10.6 - SQL Injection via Inadequate Filtering on Selected IDs
CVSS 9.8
CVE-2022-27175 CRITICAL
Delta Electronics DIAEnergie < 1.8.02.004 - SQL Injection via GetCalcTagList
CVSS 9.8
CVE-2022-26887 CRITICAL
Delta Electronics DIAEnergie <1.8.02.004 - SQL Injection
CVSS 9.8
CVE-2022-26836 CRITICAL
Delta Electronics DIAEnergie <1.8.02.004 - SQL Injection
CVSS 9.8
CVE-2022-26667 CRITICAL
Delta Electronics DIAEnergie <1.8.02.004 - SQL Injection
CVSS 9.8
CVE-2022-26666 CRITICAL
Delta Electronics DIAEnergie <1.8.02.004 - SQL Injection
CVSS 9.8
CVE-2022-26514 CRITICAL
Delta Electronics DIAEnergie <1.8.02.004 - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,816
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits