CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,824 vulnerabilities with CWE-89
CVE-2021-40493 CRITICAL
Zoho ManageEngine OpManager <125437 - SQL Injection
CVSS 9.8
CVE-2021-42224 CRITICAL
IFSC Code Finder Project 1.0 - SQL Injection via searchifsccode Parameter
CVSS 9.8
CVE-2021-40842 CRITICAL
Proofpoint Insider Threat Management Server <7.11.2 - SQL Injection
CVSS 9.8
CVE-2021-42325 CRITICAL
froxlor < 0.10.30 - SQL Injection via Custom DB Name
CVSS 9.8
CVE-2021-40618 CRITICAL
openSIS Classic 8.0 - SQL Injection
CVSS 9.8
CVE-2021-33736 HIGH
SINEC NMS <V1.0 SP2 Update 1 - Command Injection
CVSS 7.2
CVE-2021-33735 HIGH
SINEC NMS <V1.0 SP2 Update 1 - Command Injection
CVSS 7.2
CVE-2021-33734 HIGH
SINEC NMS <V1.0 SP2 Update 1 - Command Injection
CVSS 7.2
CVE-2021-33733 HIGH
SINEC NMS <V1.0 SP2 Update 1 - Command Injection
CVSS 7.2
CVE-2021-33732 HIGH
SINEC NMS <V1.0 SP2 Update 1 - Command Injection
CVSS 7.2
CVE-2021-33731 HIGH
SINEC NMS <V1.0 SP2 Update 1 - Command Injection
CVSS 7.2
CVE-2021-33730 HIGH
SINEC NMS <V1.0 SP2 Update 1 - Command Injection
CVSS 7.2
CVE-2021-33729 HIGH
SINEC NMS <V1.0 SP2 Update 1 - Command Injection
CVSS 8.8
CVE-2021-40617 CRITICAL
openSIS 8.0 - SQL Injection via ForgotPassUserName.php
CVSS 9.8
CVE-2021-40543 CRITICAL
Opensis-Classic <8.0 - SQL Injection
CVSS 9.8
CVE-2021-29004 HIGH
rConfig 3.9.6 - Authenticated SQL Injection
CVSS 8.8
CVE-2021-24651 HIGH
Poll Maker WordPress Plugin < 3.4.2 - Unauthenticated SQL Injection via ays_finish_poll AJAX Action
CVSS 7.5
CVE-2021-41920 HIGH
webtareas < 2.4 - SQL Injection via sor_cible, sor_champs, sor_ordre
CVSS 7.5
CVE-2021-41947 HIGH
Subrion CMS 4.2.1 - SQL Injection in Visual Mode
CVSS 7.2
CVE-2021-25482 MEDIUM
CMFA <SMR Oct-2021 Release 1 - SQL Injection
CVSS 5.9
CVE-2021-29903 CRITICAL
IBM Sterling B2B Integrator 5.2.6.0-6.1.1.0 - SQL Injection
CVSS 9.8
CVE-2021-29798 CRITICAL
IBM Sterling B2B Integrator 6.0.0.0-6.1.1.0 - SQL Injection
CVSS 9.8
CVE-2021-39351 MEDIUM
WP Bannerize 2.0.0-4.0.2 - Authenticated SQL Injection via id Parameter
CVSS 6.5
CVE-2021-41651 HIGH
Hotel Management System - Blind SQL Injection via cid Parameter in process_update_profile.php
CVSS 7.5
CVE-2021-41511 CRITICAL
Lodging Reservation Management System 1.0 - SQL Injection via Login Username/Password Fields
CVSS 9.8
Details
Vulnerabilities 19,824
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits