CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,817 vulnerabilities with CWE-89
CVE-2022-23305 CRITICAL
Apache Log4j 1.2.x - SQL Injection via JDBCAppender Message Converter
CVSS 9.8
CVE-2022-0258 HIGH
pimcore < 10.2.8 and 10.2.9 - SQL Injection
CVSS 8.8
CVE-2022-0224 CRITICAL
Dolibarr < 15.0.0 - SQL Injection
CVSS 9.8
CVE-2022-22055 CRITICAL
Le-yan Dental Management - SQL Injection
CVSS 9.8
CVE-2022-21666 HIGH
Useful Simple Open-Source CMS < Pb2.4Bfx3 - Authenticated SQL Injection in usersearch.php
CVSS 7.2
CVE-2022-21664 HIGH
WordPress < 5.8.3 - SQL Injection
CVSS 7.4
CVE-2022-21661 HIGH
WordPress 3.7-3.7.36 - SQL Injection via WP_Query
CVSS 8.0
CVE-2022-21644 CRITICAL
useful_simple_open-source_cms < pb2.4bfx2 - Authenticated SQL Injection via usersearch.php
CVSS 9.1
CVE-2022-21643 CRITICAL
useful_simple_open-source_cms < pb2.4bfx2 - SQL Injection via register.php
CVSS 10.0
CVE-2021-47980 HIGH
Fuel CMS 1.4.13 Blind SQL Injection via col Parameter
CVSS 7.1
CVE-2021-47956 HIGH
EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname
CVSS 8.2
CVE-2021-47954 HIGH
LayerBB 1.1.4 SQL Injection via search_query Parameter
CVSS 8.2
CVE-2021-47966 HIGH
PHP Timeclock 1.04 SQL Injection via login.php
CVSS 8.2
CVE-2021-47941 HIGH
WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_params
CVSS 8.2
CVE-2021-47930 HIGH
Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated
CVSS 8.2
CVE-2021-47928 HIGH
Opencart TMD Vendor System 3.x Blind SQL Injection via product route
CVSS 8.2
CVE-2021-36438 MEDIUM
Sourcecodester Online Job Portal 1.0 - SQL Injection
CVSS 6.5
CVE-2021-35484 HIGH
Nokia IMPACT <19.11.2.10 - SQL Injection
CVSS 8.2
CVE-2021-47918 HIGH
Simple CMS 2.1 - SQL Injection via Users Module Input Parameters
CVSS 8.1
CVE-2021-47915 HIGH
PHP Melody 3.0 - Authenticated SQL Injection via Video Edit Module 'vid' Parameter
CVSS 8.1
CVE-2021-47909 HIGH
Mult-E-Cart Ultimate 2.4 - SQL Injection
CVSS 8.1
CVE-2021-47902 HIGH
Testa Online Test Management System <3.4.7 - SQL Injection
CVSS 8.2
CVE-2021-47872 HIGH
SEO Panel < 4.9.0 - Authenticated Blind SQL Injection via order_col Parameter
CVSS 7.1
CVE-2021-47848 HIGH
Blitar Tourism 1.0 - Auth Bypass
CVSS 8.2
CVE-2021-47846 HIGH
Digital Crime Report Management System 1.0 - SQL Injection
CVSS 8.2
Details
Vulnerabilities 19,817
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits