CWE-89
High likelihoodImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
19,867 vulnerabilities with CWE-89
CVE-2018-18822
CRITICAL
Grapixel New Media v2.0 - SQL Injection via pages.aspx pageref Parameter
CVSS 9.8
CVE-2018-18792
CRITICAL
zzcms 8.3 - SQL Injection via pxzs Cookie
CVSS 9.8
CVE-2018-18791
CRITICAL
zzcms 8.3 - SQL Injection via pxzs Cookie
CVSS 9.8
CVE-2018-18790
HIGH
zzcms 8.3 - Authenticated SQL Injection via zxbigclassid Cookie
CVSS 7.2
CVE-2018-18789
CRITICAL
zzcms 8.3 - SQL Injection via Host HTTP Header
CVSS 9.8
CVE-2018-18788
HIGH
zzcms 8.3 - Authenticated SQL Injection via tablename Parameter
CVSS 7.2
CVE-2018-18787
CRITICAL
zzcms 8.3 - SQL Injection via pxzs Cookie
CVSS 9.8
CVE-2018-18786
CRITICAL
zzcms 8.3 - SQL Injection via pxzs Cookie
CVSS 9.8
CVE-2018-18785
CRITICAL
zzcms 8.3 - SQL Injection via zzcmscpid Cookie
CVSS 9.8
CVE-2018-18784
HIGH
zzcms 8.3 - Authenticated SQL Injection via tabletag Parameter
CVSS 7.2
CVE-2018-18705
CRITICAL
PHPTPoint Hospital Management System - SQL Injection via index.php user Parameter or ALIST.php rno Parameter
CVSS 9.8
CVE-2018-18704
CRITICAL
PhpTpoint Pharmacy Management System - SQL Injection via index.php Username Parameter
CVSS 9.8
CVE-2018-18702
CRITICAL
iCMS v7.0.11 - SQL Injection via Spider Import Rule Deserialization
CVSS 9.8
CVE-2018-18476
CRITICAL
mysql-binuuid-rails < 1.1.0 - SQL Injection via Default String Escaping Removal
CVSS 9.8
CVE-2018-17446
CRITICAL
Citrix NetScaler SD-WAN 9.3.0-9.3.5 and 10.0.0-10.0.3 - SQL Injection
CVSS 9.8
CVE-2018-18550
HIGH
ServersCheck Monitoring Software < 14.3.4 - Authenticated SQL Injection
CVSS 8.8
CVE-2018-18546
CRITICAL
ThinkPHP 3.2.4 - SQL Injection via Order Parameter
CVSS 9.8
CVE-2018-18530
CRITICAL
ThinkPHP 5.1.25 - SQL Injection via Count Parameter
CVSS 9.8
CVE-2018-18529
CRITICAL
ThinkPHP 3.2.4 - SQL Injection via Count Parameter
CVSS 9.8
CVE-2018-18527
CRITICAL
OwnTicket 2018-05-23 - SQL Injection via showTicketId or editTicketStatusId Parameter
CVSS 9.8
CVE-2018-18488
CRITICAL
Gxlcms v2.0 - SQL Injection via ids[] Parameter
CVSS 9.8
CVE-2018-18486
CRITICAL
PHPSHE 1.7 - SQL Injection via admin.php user_id[] Parameter
CVSS 9.8
CVE-2018-18450
CRITICAL
PbootCMS < 1.3.0 - SQL Injection via admin.php/Single/mod/mcode/id Parameter
CVSS 9.8
CVE-2018-18427
CRITICAL
s-cms 3.0 - SQL Injection via member/post.php 0_id Parameter or member/member_login.php POST Data
CVSS 9.8
CVE-2018-15755
MEDIUM
Cloud Foundry CF Networking 2.11.0-2.15.x - Authenticated SQL Injection via Internal API Endpoint
CVSS 6.6
Details
Vulnerabilities
19,867
Exploit Likelihood
High