CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,852 vulnerabilities with CWE-89
CVE-2019-12680 HIGH
Cisco Secure Firewall Management Center - Authenticated SQL Injection
CVSS 8.8
CVE-2019-12679 HIGH
Cisco Firepower Management Center - Authenticated SQL Injection
CVSS 8.8
CVE-2019-17049 HIGH
NETGEAR SRX5308 4.3.5-3 - SQL Injection
CVSS 7.5
CVE-2019-16999 CRITICAL
idcos cloudboot < 2019-03-08 - SQL Injection via Status Field in JSON Data
CVSS 9.8
CVE-2019-16997 HIGH
Metinfo 7.0.0beta - SQL Injection via appno Parameter
CVSS 7.2
CVE-2019-16996 HIGH
Metinfo 7.0.0beta - SQL Injection via Product Admin ID Parameter
CVSS 7.2
CVE-2019-16745 HIGH
ebrigade < 5.0 - SQL Injection via evenement_choice.php chxCal Parameter
CVSS 8.8
CVE-2019-16744 HIGH
ebrigade < 5.0 - SQL Injection via evenements.php cid Parameter
CVSS 8.8
CVE-2019-16743 HIGH
ebrigade < 5.0 - SQL Injection via evenement_ical.php evenement Parameter
CVSS 8.8
CVE-2019-16894 CRITICAL
inoERP 4.15 - SQL Injection via Insecure Deserialization in download.php
CVSS 9.8
CVE-2019-16194 CRITICAL
Centreon < 19.04.0 and < 18.10.8 - SQL Injection via svc_id Parameter
CVSS 9.8
CVE-2019-16383 CRITICAL
Progress MOVEit Transfer <11.1.1 - SQL Injection
CVSS 9.4
CVE-2019-16696 CRITICAL
phpipam < 1.4 - SQL Injection via Custom Fields Table Parameter
CVSS 9.8
CVE-2019-16695 CRITICAL
phpipam < 1.4 - SQL Injection via Custom Fields Filter Table Parameter
CVSS 9.8
CVE-2019-16694 CRITICAL
phpipam < 1.4 - SQL Injection via Custom Fields Edit Table Parameter
CVSS 9.8
CVE-2019-16693 CRITICAL
phpipam < 1.4 - SQL Injection via Custom Fields Order Table Parameter
CVSS 9.8
CVE-2019-16692 CRITICAL
phpipam < 1.4 - SQL Injection via Custom Fields Filter Table Parameter
CVSS 9.8
CVE-2019-16644 CRITICAL
TuziCMS 2.0.6 - SQL Injection via Zhuanti Controller Group ID Parameter
CVSS 9.8
CVE-2019-16642 CRITICAL
TuziCMS 2.0.6 - SQL Injection via Mobile/Zhuanti/group ID Parameter
CVSS 9.8
CVE-2019-15301 CRITICAL
Terrasoft Bpm'online CRM-System SDK 7.13 - SQL Injection via Column.Const() Method Value Parameter
CVSS 9.8
CVE-2019-14254 CRITICAL
Publisure 2.1.2 - SQL Injection in userAccFunctions.php
CVSS 9.8
CVE-2019-4147 HIGH
IBM Sterling File Gateway 2.2.0.0-6.0.1.0 - SQL Injection
CVSS 7.2
CVE-2019-16264 CRITICAL
Sistema Integrado de Gestion Academica v1 - SQL Injection via Username Parameter
CVSS 9.8
CVE-2019-16309 CRITICAL
FlameCMS 3.3.5 - SQL Injection via accountName Parameter
CVSS 9.8
CVE-2019-12516 HIGH
slickquiz < 1.3.7.1 - Authenticated SQL Injection via URI Parameter
CVSS 8.8
Details
Vulnerabilities 19,852
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits