CWE-89
High likelihoodImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
19,881 vulnerabilities with CWE-89
CVE-2018-18702
CRITICAL
iCMS v7.0.11 - SQL Injection via Spider Import Rule Deserialization
CVSS 9.8
CVE-2018-18476
CRITICAL
mysql-binuuid-rails < 1.1.0 - SQL Injection via Default String Escaping Removal
CVSS 9.8
CVE-2018-17446
CRITICAL
Citrix NetScaler SD-WAN 9.3.0-9.3.5 and 10.0.0-10.0.3 - SQL Injection
CVSS 9.8
CVE-2018-18550
HIGH
ServersCheck Monitoring Software < 14.3.4 - Authenticated SQL Injection
CVSS 8.8
CVE-2018-18546
CRITICAL
ThinkPHP 3.2.4 - SQL Injection via Order Parameter
CVSS 9.8
CVE-2018-18530
CRITICAL
ThinkPHP 5.1.25 - SQL Injection via Count Parameter
CVSS 9.8
CVE-2018-18529
CRITICAL
ThinkPHP 3.2.4 - SQL Injection via Count Parameter
CVSS 9.8
CVE-2018-18527
CRITICAL
OwnTicket 2018-05-23 - SQL Injection via showTicketId or editTicketStatusId Parameter
CVSS 9.8
CVE-2018-18488
CRITICAL
Gxlcms v2.0 - SQL Injection via ids[] Parameter
CVSS 9.8
CVE-2018-18486
CRITICAL
PHPSHE 1.7 - SQL Injection via admin.php user_id[] Parameter
CVSS 9.8
CVE-2018-18450
CRITICAL
PbootCMS < 1.3.0 - SQL Injection via admin.php/Single/mod/mcode/id Parameter
CVSS 9.8
CVE-2018-18427
CRITICAL
s-cms 3.0 - SQL Injection via member/post.php 0_id Parameter or member/member_login.php POST Data
CVSS 9.8
CVE-2018-15755
MEDIUM
Cloud Foundry CF Networking 2.11.0-2.15.x - Authenticated SQL Injection via Internal API Endpoint
CVSS 6.6
CVE-2018-18242
CRITICAL
youke365 v1.1.5 - SQL Injection via Admin Login
CVSS 9.8
CVE-2018-18211
HIGH
PbootCMS 1.2.1 - SQL Injection via api.php/cms/addform?fcode=1 POST Data
CVSS 8.1
CVE-2018-18200
CRITICAL
REDAXO < 5.6.4 - SQL Injection in Benutzerverwaltung
CVSS 9.8
CVE-2018-18084
CRITICAL
DuomiCMS 3.0 - SQL Injection via ajax.php uid Parameter
CVSS 9.8
CVE-2018-18075
CRITICAL
WikidForum 2.20 - SQL Injection via rpc.php parent_post_id or num_records Parameter
CVSS 9.8
CVE-2018-0404
HIGH
Cisco RV180W and RV220W - Unauthenticated SQL Injection
CVSS 7.5
CVE-2018-1819
MEDIUM
IBM Financial Transaction Manager 3.0.2, 3.0.4, 3.0.6, 3.2.0 - SQL Injection
CVSS 6.3
CVE-2018-12470
CRITICAL
SUSE Linux SMT <3.0.37 - SQL Injection
CVSS 9.8
CVE-2018-17562
HIGH
Multi-Tech FaxFinder <5.1.6 - SQL Injection
CVSS 7.5
CVE-2018-17552
CRITICAL
Naviwebs Navigate CMS 2.8 - SQL Injection
CVSS 9.8
CVE-2018-17428
CRITICAL
OPAC EasyWeb Five <5.7 - SQL Injection
CVSS 9.8
CVE-2018-9493
MEDIUM
Android 7.0-9.0 - SQL Injection in Download Manager Content Provider
CVSS 5.5
Details
Vulnerabilities
19,881
Exploit Likelihood
High