CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,889 vulnerabilities with CWE-89
CVE-2018-1000552 HIGH
Trovebox <= 4.0.0-rc6 - SQL Injection
CVSS 8.8
CVE-2018-0606 HIGH
Pixelpost <= 1.7.3 - Authenticated SQL Injection
CVSS 7.2
CVE-2018-11589 CRITICAL
Centreon 3.4.6 and Centreon Web 2.8.23 - SQL Injection via searchU, id, chartId, searchCurve, or host_id Parameters
CVSS 9.8
CVE-2018-12636 HIGH
iThemes Security <7.0.3 - SQL Injection
CVSS 7.2
CVE-2018-12630 CRITICAL
nmark NMCMS 2.1 - SQL Injection via sect_id Parameter
CVSS 9.8
CVE-2018-1132 HIGH
Opendaylight's SDNI - SQL Injection
CVSS 7.5
CVE-2018-9029 CRITICAL
Broadcom Privileged Access Manager 2.x < 3.0.0 - SQL Injection
CVSS 9.8
CVE-2018-12534 CRITICAL
Quick Chat < 4.00 - SQL Injection
CVSS 9.8
CVE-2018-10997 CRITICAL
EtereWeb < 28.1.20 - Unauthenticated Blind SQL Injection via txUserName and txPassword Parameters
CVSS 9.8
CVE-2018-10969 CRITICAL
Pie Register < 3.0.10 - SQL Injection via Invitation Codes Grid
CVSS 9.8
CVE-2018-12498 CRITICAL
iCMS v7.0.8 - SQL Injection via id Parameter in admincp.php
CVSS 9.8
CVE-2018-12254 HIGH
Harmis Ek Rishta <2.10 - SQL Injection
CVSS 8.8
CVE-2018-12110 HIGH
portfolioCMS 1.0.5 - SQL Injection via Admin Portfolio Preview Parameter
CVSS 7.2
CVE-2018-0225 CRITICAL
Cisco AppDynamics App iQ Platform < 4.4.3.10598 - SQL Injection
CVSS 9.8
CVE-2018-12055 CRITICAL
PHP Scripts Mall Schools Alert Mgmt - SQL Injection
CVSS 9.8
CVE-2018-12052 CRITICAL
PHP Scripts Mall Schools Alert Mgt - SQL Injection
CVSS 9.8
CVE-2018-12039 CRITICAL
joyplus-cms 1.6.0 - Remote Code Execution via SQL Injection in Manager Index
CVSS 9.8
CVE-2018-0320 CRITICAL
Cisco Prime Collaboration Provisioning < 12.1 - Unauthenticated SQL Injection via Crafted URL
CVSS 9.8
CVE-2018-1252 HIGH
RSA Web Threat Detection < 6.4 - Authenticated SQL Injection
CVSS 8.8
CVE-2018-11722 CRITICAL
Wuzhicms - SQL Injection
CVSS 9.8
CVE-2018-11140 CRITICAL
Quest KACE System Management Appliance 8.0.318 - SQL Injection via reportID Parameter
CVSS 9.8
CVE-2018-11136 CRITICAL
Quest KACE System Management Appliance 8.0.318 - SQL Injection via orgID Parameter
CVSS 9.8
CVE-2018-10466 CRITICAL
Zoho ManageEngine ADAudit Plus <5.0.0 - SQL Injection
CVSS 9.8
CVE-2018-11535 CRITICAL
SITEMAKIN SLAC 1.0 - SQL Injection via my_item_search Parameter
CVSS 9.8
CVE-2018-11528 CRITICAL
Wuzhicms - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,889
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits