CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,823 vulnerabilities with CWE-89
CVE-2021-24151 HIGH
WP Editor < 1.2.7 - Authenticated Blind SQL Injection via Settings Save Request
CVSS 7.2
CVE-2021-35437 CRITICAL
lmxcms 1.4 - SQL Injection via TagsAction.class
CVSS 9.8
CVE-2021-43609 CRITICAL
Spiceworks Help Desk Server <1.3.3 - Blind Boolean SQL Injection
CVSS 9.9
CVE-2021-26837 CRITICAL
Fortra DeliverNow < 1.2.18 - SQL Injection via SearchTextBox Parameter
CVSS 9.8
CVE-2021-45811 MEDIUM
osTicket 1.15-1.15.8 - Authenticated SQL Injection via Search Keywords and Topic ID Parameters
CVSS 6.5
CVE-2021-3262 CRITICAL
TripSpark VEO Transportation <2.2.x - SQL Injection
CVSS 9.8
CVE-2021-29378 HIGH
pear_admin_think 2.1.2 - SQL Injection via Crud.php GET Request
CVSS 8.8
CVE-2021-37522 CRITICAL
Locke-Bot 2.0.2 - SQL Injection via Crafted String to db.js mute.js or messageDelete.js
CVSS 9.8
CVE-2021-4340 CRITICAL
uListing plugin <1.6.6 - SQL Injection
CVSS 9.8
CVE-2021-31233 HIGH
Fighting Cock Information System 1.0 - SQL Injection via edit_breed.php Parameter
CVSS 7.5
CVE-2021-4336 MEDIUM
ITRS Group monitor-ninja <2021.11.1 - SQL Injection
CVSS 5.5
CVE-2021-28999 HIGH
CMS Made Simple <= 2.2.15 - SQL Injection via m1_sortby Parameter
CVSS 8.8
CVE-2021-36520 HIGH
I-Tech Trainsmart r1044 - SQL Injection
CVSS 7.5
CVE-2021-36393 CRITICAL
Moodle <3.9.8 and 3.11.0-beta-3.11.1 - SQL Injection
CVSS 9.8
CVE-2021-36392 CRITICAL
Moodle < 3.9.8 and 3.11.0-beta-3.11.1 - SQL Injection
CVSS 9.8
CVE-2021-4328 MEDIUM
lionfish_cms - SQL Injection via goods_id Parameter in goods_detail Function
CVSS 6.3
CVE-2021-3854 CRITICAL
Glox Technology Useroam Hotspot <5.1.0.15 - SQL Injection
CVSS 9.8
CVE-2021-34249 HIGH
Online Book Store 1.0 - SQL Injection via ID Parameter
CVSS 7.5
CVE-2021-33948 CRITICAL
hotels_server v1.0 - SQL Injection via Username Parameter
CVSS 9.8
CVE-2021-32441 HIGH
Exponent CMS 2.6.0-2.6.9 - SQL Injection via expConfig selectValue Function
CVSS 7.5
CVE-2021-38239 HIGH
dataease < 1.2.0 - SQL Injection via Orders Parameter
CVSS 7.5
CVE-2021-34117 HIGH
SEO Panel 4.9.0 - SQL Injection via Username Parameter in getUserName Function
CVSS 7.5
CVE-2021-33925 CRITICAL
cms-corephp < 2021-05-19 - Unauthenticated SQL Injection via Crafted Login
CVSS 9.8
CVE-2021-37497 CRITICAL
PbootCMS 3.0.5 - SQL Injection via GET Request
CVSS 9.8
CVE-2021-37316 HIGH
ASUS RT-AC68U Firmware < 3.0.0.4.386.41634 - SQL Injection via Cloud Disk
CVSS 7.5
Details
Vulnerabilities 19,823
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits