CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,889 vulnerabilities with CWE-89
CVE-2018-15150 HIGH
OpenEMR < 5.0.1.3 - Authenticated SQL Injection via temporary_files_dir Parameter
CVSS 8.8
CVE-2018-15149 HIGH
OpenEMR < 5.0.1.3 - Authenticated SQL Injection via Encounter Parameter
CVSS 8.8
CVE-2018-15148 HIGH
OpenEMR < 5.0.1.3 - Authenticated SQL Injection via Text Parameter
CVSS 8.8
CVE-2018-15147 HIGH
OpenEMR < 5.0.1.3 - Authenticated SQL Injection via 'id' Parameter
CVSS 8.8
CVE-2018-15146 HIGH
OpenEMR < 5.0.1.3 - Authenticated SQL Injection via search_term Parameter
CVSS 8.8
CVE-2018-2450 HIGH
SAP MaxDB 7.8-7.9 - Authenticated SQL Injection
CVSS 7.2
CVE-2018-2447 MEDIUM
SAP BusinessObjects Business Intelligence 4.2 - SQL Injection via Crafted InfoObject Queries
CVSS 6.5
CVE-2018-15145 CRITICAL
OpenEMR < 5.0.1.4 - SQL Injection via eid userid or pid Parameter
CVSS 9.8
CVE-2018-15144 HIGH
OpenEMR < 5.0.1.4 - Authenticated SQL Injection via search_term Parameter
CVSS 8.8
CVE-2018-15143 CRITICAL
OpenEMR < 5.0.1.4 - SQL Injection via catid or providerid Parameter
CVSS 9.8
CVE-2018-10915 HIGH
Redhat Openstack < 9.3.24 - Information Disclosure
CVSS 8.5
CVE-2018-15168 CRITICAL
Zoho ManageEngine Applications Manager <13 - SQL Injection
CVSS 9.8
CVE-2018-14968 CRITICAL
EMLsoft 5.4.5 - SQL Injection via numPerPage Parameter
CVSS 9.8
CVE-2018-14967 HIGH
EMLsoft 5.4.5 - SQL Injection via numPerPage Parameter
CVSS 8.8
CVE-2018-14961 CRITICAL
zzcms 8.3 - SQL Injection via dl/dl_sendmail.php sql Parameter
CVSS 9.8
CVE-2018-12482 HIGH
OCS Inventory <2.4.1 - SQL Injection
CVSS 8.8
CVE-2018-12942 HIGH
SeedDMS < 5.1.8 - Authenticated SQL Injection in Users Management
CVSS 8.8
CVE-2018-0607 HIGH
Cybozu Garoon 3.5.0-4.6.2 - Authenticated SQL Injection in Notifications Application
CVSS 8.8
CVE-2018-5384 CRITICAL
Navarino Infinity <2.2 - SQL Injection
CVSS 9.8
CVE-2018-14515 CRITICAL
WUZHI CMS 4.1.0 - SQL Injection via Keywords Parameter
CVSS 9.8
CVE-2018-14501 CRITICAL
joyplus-cms 1.6.0 - SQL Injection via POST Data
CVSS 9.8
CVE-2018-14472 HIGH
WUZHI CMS 4.1.0 - SQL Injection
CVSS 7.2
CVE-2018-14418 CRITICAL
msvod_cms v10 - SQL Injection via images/lists cid Parameter
CVSS 9.8
CVE-2018-14440 CRITICAL
cckevincyh SSH CompanyWebsite - SQL Injection
CVSS 9.8
CVE-2018-14389 CRITICAL
joyplus-cms 1.6.0 - SQL Injection via Admin AJAX val Parameter
CVSS 9.8
Details
Vulnerabilities 19,889
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits