CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,841 vulnerabilities with CWE-89
CVE-2020-36648 MEDIUM
pouetnet pouet <2.0 - SQL Injection
CVSS 5.5
CVE-2020-36645 MEDIUM
Square Squalor < 0.0.0 - SQL Injection
CVSS 5.5
CVE-2020-24600 CRITICAL
Shilpi CAPExWeb 1.1 - SQL Injection
CVSS 9.8
CVE-2020-36631 MEDIUM
barronwaffles dwc_network_server_emulator - SQL Injection
CVSS 6.3
CVE-2020-36630 MEDIUM
FreePBX cdr <14.0.5.21 - SQL Injection
CVSS 5.5
CVE-2020-12507 HIGH
s::can moni::tools <4.2 - SQL Injection
CVSS 8.8
CVE-2020-22820 CRITICAL
MKCMS V6.2 - SQL Injection via Ucenter Repass Name Parameter
CVSS 9.8
CVE-2020-22819 CRITICAL
mkcms V6.2 - SQL Injection via UCenter Active Verify Parameter
CVSS 9.8
CVE-2020-22818 CRITICAL
mkcms V6.2 - SQL Injection via Ucenter Registration Name Parameter
CVSS 9.8
CVE-2020-35674 CRITICAL
BigProf Online Invoicing System < 2.9 - Unauthenticated SQL Injection via Password Reset Endpoint
CVSS 9.8
CVE-2020-15333 MEDIUM
Zyxel CloudCNM SecuManager <3.1.1 - Info Disclosure
CVSS 5.3
CVE-2020-22669 CRITICAL
Modsecurity owasp-modsecurity-crs 3.2.0 - SQL Injection
CVSS 9.8
CVE-2020-35597 HIGH
Victor CMS 1.0 - SQL Injection via c_id, p_id, u_id, and edit Parameters
CVSS 8.8
CVE-2020-36543 MEDIUM
SialWeb CMS - SQL Injection via /about.php Id Parameter
CVSS 6.3
CVE-2020-36541 HIGH
demokratian - SQL Injection via id_provincia Parameter in basicos_php/genera_select.php
CVSS 7.3
CVE-2020-36540 MEDIUM
Neetai Tech - SQL Injection via /product.php
CVSS 6.3
CVE-2020-36539 MEDIUM
Lgico y Creativo 1.0 - SQL Injection via id Parameter
CVSS 6.3
CVE-2020-36538 MEDIUM
Eatan CMS - SQL Injection
CVSS 6.3
CVE-2020-36537 MEDIUM
Everywhere CMS - SQL Injection via id Parameter
CVSS 6.3
CVE-2020-36536 MEDIUM
Brandbugle - SQL Injection via /main.php
CVSS 6.3
CVE-2020-36535 MEDIUM
MINMAX - SQL Injection via /newsDia.php id Parameter
CVSS 6.3
CVE-2020-36530 MEDIUM
SevOne Network Performance Management 5.7.2.0-5.7.2.22 - SQL Injection in Alert Summary
CVSS 6.3
CVE-2020-19217 HIGH
piwigo v2.9.5 - SQL Injection via filter_category Parameter
CVSS 8.8
CVE-2020-19216 HIGH
piwigo v2.9.5 - SQL Injection via cat_false Parameter
CVSS 8.8
CVE-2020-19215 HIGH
piwigo 2.9.5 - SQL Injection via cat_false Parameter
CVSS 8.8
Details
Vulnerabilities 19,841
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits