CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,857 vulnerabilities with CWE-89
CVE-2018-17414 HIGH
zzcms 8.3 - SQL Injection via jobmanage.php bigclass Parameter
CVSS 8.8
CVE-2018-17412 CRITICAL
zzcms v8.3 - SQL Injection via X-Forwarded-For HTTP Header
CVSS 9.8
CVE-2018-16809 CRITICAL
Dolibarr < 7.0.0 - SQL Injection via expensereport/card.php qty and value_unit Parameters
CVSS 9.8
CVE-2018-17542 MEDIUM
MailSherlock <1.5.235 - SQL Injection
CVSS 4.3
CVE-2018-20779 CRITICAL
traq 3.7.1 - SQL Injection via Tickets Search URI
CVSS 9.8
CVE-2018-20770 CRITICAL
Xerox WorkCentre < R18-05 073.xxx.0487.15000 - Blind SQL Injection
CVSS 9.8
CVE-2018-13792 CRITICAL
ABBYY FlexiCapture < 12.0.2.1194 - SQL Injection via Monitoring HTTP API Parameters
CVSS 9.8
CVE-2018-4056 CRITICAL
coturn < 4.5.0.9 - SQL Injection via Login Username
CVSS 9.8
CVE-2018-20730 HIGH
NeDi < 1.7c - SQL Injection via query.php Component
CVSS 7.5
CVE-2018-20719 HIGH
TikiWiki CMS/Groupware < 17.2 - SQL Injection via User Tasks Show History Parameter
CVSS 8.8
CVE-2018-20716 CRITICAL
CubeCart < 6.1.13 - SQL Injection via Forgot Password Validate Parameter
CVSS 9.8
CVE-2018-20715 CRITICAL
OXID eSales 4.10.6 - SQL Injection via oxConfig::getRequestParameter() Method
CVSS 9.8
CVE-2018-20713 HIGH
Shopware < 5.4.3 - Authenticated SQL Injection
CVSS 8.8
CVE-2018-16803 CRITICAL
CIMTechniques CIMScan <6.2 - SQL Injection
CVSS 9.8
CVE-2018-16188 CRITICAL
RICOH Interactive Whiteboard D2200/D5500/D5510/D5520/D6500/D6510/D7500/D8400 Firmware 1.3-2.2 - SQL Injection
CVSS 9.8
CVE-2018-16175 HIGH
LearnPress < 3.1.0 - Authenticated SQL Injection
CVSS 7.2
CVE-2018-19998 HIGH
Dolibarr 8.0.2 - Authenticated SQL Injection via Employee Parameter
CVSS 8.8
CVE-2018-19994 HIGH
Dolibarr 8.0.2 - Authenticated SQL Injection via desiredstock Parameter
CVSS 8.8
CVE-2018-19415 CRITICAL
Plikli CMS 4.0.0 - SQL Injection via Join Group or Story Comment ID Parameter
CVSS 9.8
CVE-2018-13045 CRITICAL
Yeswiki Cercopitheque < 2018-06-19-1 - SQL Injection via Bazar Page ID Parameter
CVSS 9.8
CVE-2018-20572 CRITICAL
Wuzhicms - SQL Injection
CVSS 9.8
CVE-2018-20569 CRITICAL
Generic Content Management System < 20180428 - SQL Injection via user/index.php
CVSS 9.8
CVE-2018-20568 CRITICAL
generic_content_management_system < 20180428 - SQL Injection in Administrator/index.php
CVSS 9.8
CVE-2018-1000890 HIGH
FrontAccounting 2.4.5 - SQL Injection
CVSS 7.5
CVE-2018-1000631 CRITICAL
Battelle V2I Hub 3.0 - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,857
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits