CWE-89
High likelihoodImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
19,889 vulnerabilities with CWE-89
CVE-2018-15918
MEDIUM
Jorani 0.6.5 - SQL Injection via Startdate or Enddate Parameter
CVSS 5.4
CVE-2018-16436
HIGH
gxlcms 2.0 - Authenticated SQL Injection
CVSS 7.2
CVE-2018-16445
CRITICAL
SeaCMS < 6.61 - SQL Injection via tid Parameter
CVSS 9.8
CVE-2018-16432
CRITICAL
BlueCMS 1.6 - SQL Injection via user_name Parameter
CVSS 9.8
CVE-2018-16410
MEDIUM
Vanilla < 2.6.1 - SQL Injection via InvitationID Array to DeleteInvitation Endpoint
CVSS 6.5
CVE-2018-16385
CRITICAL
ThinkPHP < 5.1.23 - SQL Injection via Query String
CVSS 9.8
CVE-2018-16384
HIGH
OWASP ModSecurity Core Rule Set <= 3.1.0-rc3 - SQL Injection via PL1 Bypass with Special Function Names
CVSS 7.5
CVE-2018-16354
CRITICAL
FHCRM < 2018-02-11 - SQL Injection via User Read Limit Parameter
CVSS 9.8
CVE-2018-16353
CRITICAL
FHCRM < 2018-02-11 - SQL Injection via Customer Read Limit Parameter
CVSS 9.8
CVE-2018-16278
CRITICAL
PhpOpenSourceCMS V3.2.0 - Unauthenticated SQL Injection via ajax_save_draft dir Parameter
CVSS 9.8
CVE-2018-16159
CRITICAL
Gift Vouchers < 2.0.1 - SQL Injection via template_id Parameter
CVSS 9.8
CVE-2018-13824
CRITICAL
Broadcom Project Portfolio Management < 14.3 - SQL Injection
CVSS 9.8
CVE-2018-15873
CRITICAL
Sentrifugo 3.2 - SQL Injection via deptid Parameter
CVSS 9.8
CVE-2018-15904
CRITICAL
A10 ACOS Web Application Firewall 2.7.1-2.7.2-P11, 4.1.0-4.1.0-P10, 4.1.1-4.1.1-P7, 4.1.2-4.1.2-P3 - SQL Injection
CVSS 9.8
CVE-2018-15894
CRITICAL
WUZHI CMS 4.1.0 - SQL Injection via keyValue Parameter
CVSS 9.8
CVE-2018-15893
CRITICAL
WUZHI CMS 4.1.0 - SQL Injection via keywords Parameter
CVSS 9.8
CVE-2018-11065
LOW
RSA Archer 6.1.0.0-6.1.0.3 - SQL Injection in WorkPoint Component
CVSS 2.7
CVE-2018-1699
MEDIUM
IBM Maximo Asset Management <7.6.3 - SQL Injection
CVSS 6.3
CVE-2018-3879
HIGH
Samsung STH-ETH-250 Firmware 0.20.17 - SQL Injection via JSON Payload Parsing
CVSS 8.8
CVE-2018-1000653
CRITICAL
zzcms < 8.3 - SQL Injection in zt/top.php
CVSS 9.8
CVE-2018-1000650
HIGH
LibreHealthIO lh-ehr <REL-2.0.0 - SQL Injection
CVSS 8.8
CVE-2018-14058
MEDIUM
pimcore < 5.3.0 - SQL Injection via REST Web Service API
CVSS 6.5
CVE-2018-3783
CRITICAL
flintcms <= 1.1.9 - Blind MongoDB Injection in Password Reset
CVSS 9.8
CVE-2018-11511
CRITICAL
ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection via Photo Gallery Tree List Album ID or Scope Parameter
CVSS 9.8
CVE-2018-15151
HIGH
OpenEMR < 5.0.1.3 - Authenticated SQL Injection via search_term Parameter
CVSS 8.8
Details
Vulnerabilities
19,889
Exploit Likelihood
High