CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,867 vulnerabilities with CWE-89
CVE-2018-19434 HIGH
webERP 4.15 - SQL Injection via BankMatching.php AmtClear_ Parameter
CVSS 7.2
CVE-2018-19349 HIGH
SeaCMS v6.64 - SQL Injection via admin_makehtml.php topic parameter
CVSS 7.2
CVE-2018-19331 HIGH
S-CMS v1.5 - SQL Injection via search.php keyword parameter
CVSS 7.5
CVE-2018-19312 HIGH
Centreon <18.10.0-2.8.24 - SQL Injection
CVSS 8.8
CVE-2018-18806 CRITICAL
School Equipment Monitoring System 1.0 - SQL Injection via Login Screen
CVSS 9.8
CVE-2018-18805 CRITICAL
Pointofsales - SQL Injection
CVSS 9.8
CVE-2018-18804 CRITICAL
Bakeshop Inventory System 1.0 - SQL Injection via Login Screen
CVSS 9.8
CVE-2018-18803 CRITICAL
Curriculum Evaluation System 1.0 - SQL Injection via Login Screen
CVSS 9.8
CVE-2018-18801 CRITICAL
BSEN Ordering Software 1.0 - SQL Injection via ID Parameter
CVSS 9.8
CVE-2018-18796 CRITICAL
Library Management System 1.0 - SQL Injection via Search for Books Screen
CVSS 9.8
CVE-2018-18795 CRITICAL
School Event Management System 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2018-18763 CRITICAL
SaltOS 3.1 r8126 - SQL Injection via action2 Parameter
CVSS 9.8
CVE-2018-18761 CRITICAL
SaltOS 3.1 r8126 - SQL Injection via Login Action Parameter
CVSS 9.8
CVE-2018-18755 CRITICAL
K-iwi Framework 1775 - SQL Injection via user_group_id or user_id Parameter
CVSS 9.8
CVE-2018-0685 HIGH
Denbun POP < 3.3p_r4.0 - Authenticated SQL Injection via Mail Search HTTP Request
CVSS 8.8
CVE-2018-19281 CRITICAL
Centreon 3.4.x - SQL Injection via SNMP Trap Handling
CVSS 9.8
CVE-2018-19271 HIGH
Centreon <18.10.0-2.8.28 - SQL Injection
CVSS 8.8
CVE-2018-16850 CRITICAL
postgresql <11.1, 10.6 - SQL Injection
CVSS 9.8
CVE-2018-19221 CRITICAL
LAOBANCMS 2.0 - SQL Injection via admin/login.php guanliyuan Parameter
CVSS 9.8
CVE-2018-15447 MEDIUM
Cisco Integrated Management Controller - Unauthenticated SQL Injection via Crafted URL
CVSS 6.5
CVE-2018-19061 CRITICAL
DedeCMS 5.7 SP2 - SQL Injection via co_do.php ids Parameter
CVSS 9.8
CVE-2018-18963 CRITICAL
Degraupublicidade - SQL Injection
CVSS 9.8
CVE-2018-18949 CRITICAL
Zoho ManageEngine OpManager < 123222 - SQL Injection via Mail Server Settings
CVSS 9.8
CVE-2018-18887 CRITICAL
S-CMS PHP 1.0 - SQL Injection via Member News Type Parameter
CVSS 9.8
CVE-2018-18832 CRITICAL
DKCMS 9.4 - SQL Injection via ASPSESSIONID Cookie
CVSS 9.8
Details
Vulnerabilities 19,867
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits