CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,862 vulnerabilities with CWE-89
CVE-2018-20572 CRITICAL
Wuzhicms - SQL Injection
CVSS 9.8
CVE-2018-20569 CRITICAL
Generic Content Management System < 20180428 - SQL Injection via user/index.php
CVSS 9.8
CVE-2018-20568 CRITICAL
generic_content_management_system < 20180428 - SQL Injection in Administrator/index.php
CVSS 9.8
CVE-2018-1000890 HIGH
FrontAccounting 2.4.5 - SQL Injection
CVSS 7.5
CVE-2018-1000631 CRITICAL
Battelle V2I Hub 3.0 - SQL Injection
CVSS 9.8
CVE-2018-1000630 HIGH
Battelle V2I Hub 2.5.1 - SQL Injection
CVSS 7.2
CVE-2018-20508 CRITICAL
CrashFix 1.0.4 - SQL Injection via User[status] Parameter
CVSS 9.8
CVE-2018-20480 CRITICAL
S-CMS 1.0 - SQL Injection via P_id Parameter
CVSS 9.8
CVE-2018-20479 CRITICAL
S-CMS 1.0 - SQL Injection via S_id Parameter
CVSS 9.8
CVE-2018-20477 CRITICAL
S-CMS 3.0 - SQL Injection via bank/callback1.php P_no Field
CVSS 9.8
CVE-2018-7802 HIGH
EVLink Parking <3.2.0-12_v1 - SQL Injection
CVSS 8.8
CVE-2018-20338 CRITICAL
Zoho ManageEngine OpManager < 12.3.239 - SQL Injection in Alarms Section
CVSS 9.8
CVE-2018-20329 HIGH
Chamilo LMS <1.11.8 - SQL Injection
CVSS 8.1
CVE-2018-18399 CRITICAL
jco KARMA 6.0.0 - SQL Injection via id Parameter in ArchiveNews.aspx
CVSS 9.8
CVE-2018-1000871 CRITICAL
HotelDruid HotelDruid <2.3.0 - SQL Injection
CVSS 9.8
CVE-2018-1000869 CRITICAL
phpipam 1.3.2 - SQL Injection via NAT Item Add Submit
CVSS 9.8
CVE-2018-1000867 HIGH
WeBid < 1.2.2 - SQL Injection via yourauctions Scripts
CVSS 8.8
CVE-2018-20173 CRITICAL
Zoho ManageEngine OpManager <12.3 - SQL Injection
CVSS 9.8
CVE-2018-14623 MEDIUM
Katello - Authenticated SQL Injection via Errata API
CVSS 4.3
CVE-2018-18923 CRITICAL
AbiSoft Ticketly 1.0 - SQL Injection via Multiple Parameters
CVSS 9.8
CVE-2018-20061 HIGH
ERPNext 10.x-11.0.3-beta.29 - SQL Injection
CVSS 7.5
CVE-2018-20018 HIGH
S-CMS V3.0 - SQL Injection via S_id Parameter
CVSS 7.5
CVE-2018-7065 HIGH
Aruba ClearPass Policy Manager < 6.6.10 - Authenticated SQL Injection
CVSS 7.2
CVE-2018-19925 CRITICAL
Sales & Company Management System < 2018-06-06 - SQL Injection via Member Order Type Parameter
CVSS 9.8
CVE-2018-19898 HIGH
ThinkCMF X2.2.2 - Authenticated SQL Injection via Article Edit Post Parameter
CVSS 8.8
Details
Vulnerabilities 19,862
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits