CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,835 vulnerabilities with CWE-89
CVE-2020-37243 HIGH
WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS
CVSS 8.2
CVE-2020-37242 HIGH
WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx
CVSS 8.2
CVE-2020-37226 HIGH
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby
CVSS 7.1
CVE-2020-37224 HIGH
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby
CVSS 7.1
CVE-2020-37218 HIGH
Joomla com_hdwplayer 4.2 SQL Injection via search.php
CVSS 8.2
CVE-2020-37163 HIGH
QuickDate 1.3.2 - SQL Injection via _located Parameter
CVSS 8.2
CVE-2020-37154 HIGH
eLection 2.0 - Authenticated SQL Injection
CVSS 7.1
CVE-2020-37147 HIGH
ATutor 2.2.4 - Authenticated SQL Injection via Admin User Deletion ID Parameter
CVSS 7.1
CVE-2020-37141 HIGH
AMSS++ 4.31 - SQL Injection via Mail Module id Parameter
CVSS 8.2
CVE-2020-37151 HIGH
phpMyChat Plus 1.98 - SQL Injection
CVSS 8.2
CVE-2020-37089 HIGH
School ERP Pro 1.0 - SQL Injection via es_messagesid Parameter
CVSS 8.2
CVE-2020-37083 HIGH
PHP AddressBook 9.0.0.1 - SQL Injection
CVSS 8.2
CVE-2020-37081 HIGH
Fishing Reservation System 7.5 - SQL Injection
CVSS 7.1
CVE-2020-37076 HIGH
Victor CMS 1.0 - SQL Injection via Post Parameter
CVSS 8.2
CVE-2020-37112 HIGH
GUnet OpenEclass 1.7.3 - SQL Injection
CVSS 7.1
CVE-2020-37110 HIGH
60CycleCMS 2.5.2 - SQL Injection via News Title Parameter
CVSS 8.2
CVE-2020-37108 HIGH
PhpIX 2012 Professional - SQL Injection
CVSS 7.1
CVE-2020-37105 HIGH
PMB 5.6 - Authenticated SQL Injection via logid Parameter
CVSS 7.1
CVE-2020-37057 HIGH
Online-Exam-System 2015 - SQL Injection
CVSS 8.2
CVE-2020-37053 HIGH
Navigate CMS 2.8.7 - Authenticated SQL Injection
CVSS 7.1
CVE-2020-37051 HIGH
Online-Exam-System 2015 - SQL Injection
CVSS 8.2
CVE-2020-37035 HIGH
e-Learning PHP Script 0.1.0 - SQL Injection
CVSS 8.2
CVE-2020-37033 HIGH
Infor Storefront B2B 1.0 - SQL Injection
CVSS 8.2
CVE-2020-37006 HIGH
berliCRM 1.0.24 - SQL Injection via src_record Parameter
CVSS 8.2
CVE-2020-37005 HIGH
TimeClock Software 1.01 - Authenticated SQL Injection
CVSS 7.1
Details
Vulnerabilities 19,835
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits