CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,831 vulnerabilities with CWE-89
CVE-2021-37614 HIGH
Progress MOVEit Transfer < 2019.0.7 - Authenticated SQL Injection via Transaction Type Strings
CVSS 8.8
CVE-2021-31869 MEDIUM
Pimcore AdminBundle < 6.9.4 - SQL Injection via specificID Variable
CVSS 6.5
CVE-2021-31867 MEDIUM
Pimcore Customer Data Framework < 3.0.2 - SQL Injection via SegmentAssignmentController $id Parameter
CVSS 6.5
CVE-2021-20028 CRITICAL KEV
SonicWall SRA and SMA Firmware 8.x-9.0.0.9-26sv - SQL Injection
CVSS 9.8
CVE-2021-32590 CRITICAL
FortiPortal 4.2.2-6.0.4 - Authenticated SQL Injection via HTTP Requests
CVSS 9.9
CVE-2021-37558 CRITICAL
Centreon < 20.04.14 - Unauthenticated SQL Injection via host_name and service_description Parameters
CVSS 9.8
CVE-2021-37557 HIGH
Centreon < 20.04.14 - Authenticated SQL Injection via generateImage.php index Parameter
CVSS 8.8
CVE-2021-37556 HIGH
Centreon < 20.04.14 - Authenticated SQL Injection via CSV Export Parameters
CVSS 8.8
CVE-2021-37832 CRITICAL
HotelDruid 3.0.2 - SQL Injection via idappartamenti Parameter
CVSS 9.8
CVE-2021-24492 HIGH
Handsome Testimonials & Reviews < 2.1.1 - Authenticated SQL Injection via hndtst_previewShortcodeInstanceId Parameter
CVSS 8.8
CVE-2021-24484 HIGH
Secure Copy Content Protection and Content Locking < 2.6.7 - SQL Injection via get_reports() orderby Parameter
CVSS 7.2
CVE-2021-24483 HIGH
Poll Maker < 3.2.1 - Authenticated SQL Injection via Orderby Parameter
CVSS 7.2
CVE-2021-24463 HIGH
Image Slider by Ays- Responsive Slider and Carousel < 2.5.0 - Authenticated SQL Injection via Orderby Parameter
CVSS 8.8
CVE-2021-24462 HIGH
Photo Gallery by Ays < 4.4.4 - Authenticated SQL Injection via Orderby Parameter
CVSS 8.8
CVE-2021-24461 HIGH
FAQ Builder AYS WordPress Plugin < 1.3.6 - Authenticated SQL Injection via Orderby Parameter
CVSS 8.8
CVE-2021-24460 HIGH
Popup Like box - Page Plugin < 3.5.3 - Authenticated SQL Injection via Orderby Parameter
CVSS 8.8
CVE-2021-24459 HIGH
Survey Maker < 1.5.6 - Authenticated SQL Injection via Orderby Parameter
CVSS 8.8
CVE-2021-24458 HIGH
Popup box WordPress plugin < 2.3.4 - Authenticated SQL Injection via orderby Parameter
CVSS 8.8
CVE-2021-24457 HIGH
Portfolio Responsive Gallery < 1.1.8 - SQL Injection via Unvalidated orderby Parameter
CVSS 8.8
CVE-2021-24456 HIGH
Quiz Maker WordPress plugin < 6.2.0.9 - Authenticated SQL Injection via Order and Orderby Parameters
CVSS 7.2
CVE-2021-37593 CRITICAL
PEEL Shopping 9.4.0 - Unauthenticated SQL Injection
CVSS 9.1
CVE-2021-36624 CRITICAL
Phone Shop Sales Management System 1.0 - SQL Injection
CVSS 9.8
CVE-2021-36621 HIGH
Online Covid Vaccination Scheduler System 1.0 - SQL Injection via Username Parameter
CVSS 8.1
CVE-2021-35458 CRITICAL
Online Pet Shop We App 1.0 - SQL Injection
CVSS 9.8
CVE-2021-34166 CRITICAL
Simple Food Website 1.0 - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,831
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits