CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,889 vulnerabilities with CWE-89
CVE-2018-10736 HIGH
Nagios XI 5.2.0-5.2.9 - SQL Injection via admin/info.php key1 Parameter
CVSS 7.2
CVE-2018-10735 HIGH
Nagios XI < 5.2.9 - SQL Injection via admin/commandline.php cname Parameter
CVSS 7.2
CVE-2018-7501 HIGH
Advantech WebAccess < 8.2_20170817, Dashboard < 2.0.15, SCADA < 8.3.1, NMS < 2.0.3 - SQL Injection
CVSS 7.5
CVE-2018-11032 CRITICAL
PHPRAP 1.0.4-1.0.8 - SQL Injection via Project Search Function
CVSS 9.8
CVE-2018-1280 HIGH
Greenplum Command Center 2.0.0-2.5.0 - Unauthenticated Blind SQL Injection
CVSS 7.5
CVE-2018-8914 HIGH
Synology Media Server < 1.4-2654 - SQL Injection via UPnP DMA ObjectID Parameter
CVSS 7.3
CVE-2018-8824 CRITICAL
Responsive Mega Menu <1.7.2.5 - SQL Injection
CVSS 9.8
CVE-2018-10757 CRITICAL
CSP MySQL User Manager 2.3.1 - SQL Injection and Authentication Bypass via Login Username
CVSS 9.8
CVE-2018-10256 HIGH
HRSALE The Ultimate HRM <1.0.2 - SQL Injection
CVSS 8.8
CVE-2018-9102 MEDIUM
Mitel MiVoice Connect < 21.84.5535.0 and ST 14.2 < 19.49.5200.0 - Unauthenticated SQL Injection via Signin Interface
CVSS 6.5
CVE-2018-9245 CRITICAL
Ericsson-LG iPECS NMS A.1Ac - SQL Injection via Login Portal User ID and Password Fields
CVSS 9.8
CVE-2018-10284 CRITICAL
Adaltech G-Ticket v70 EME104 - SQL Injection
CVSS 9.8
CVE-2018-10283 CRITICAL
CliqueMania loja virtual 14 - SQL Injection
CVSS 9.8
CVE-2018-1292 HIGH
Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating - SQL Injection via Report Name Parameter
CVSS 8.1
CVE-2018-1291 HIGH
Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating - SQL Injection via OrderBy Query Parameter
CVSS 8.1
CVE-2018-1290 CRITICAL
Apache Fineract - SQL Injection via Single Quotation Escape in Audit and Makerchecker API Methods
CVSS 9.8
CVE-2018-1289 HIGH
Apache Fineract SQL Injection via orderBy/sortOrder Parameters
CVSS 8.8
CVE-2018-10225 CRITICAL
thinkphp 3.1.3 - SQL Injection via index.php s Parameter
CVSS 9.8
CVE-2018-8734 CRITICAL
Nagios XI 5.2.0-5.4.12 - SQL Injection via selInfoKey1 Parameter
CVSS 9.8
CVE-2018-8733 CRITICAL
Nagios XI 5.2.0-5.4.12 - Unauthenticated SQL Injection via Core Config Manager
CVSS 9.8
CVE-2018-0530 HIGH
Cybozu Garoon 3.5.0-4.2.6 - Authenticated SQL Injection
CVSS 8.8
CVE-2018-10050 HIGH
iScripts eSwap v2.4 - SQL Injection
CVSS 7.2
CVE-2018-8953 HIGH
CA Workload Automation AE < r11.3.6 SP7 - SQL Injection via Crafted HTTP Request
CVSS 8.8
CVE-2018-9924 CRITICAL
iCMS < 7.0.7 - SQL Injection via admincp.php pid Array Parameter
CVSS 9.8
CVE-2018-1096 MEDIUM
Foreman < 1.16.1 - SQL Injection via Dashboard Controller ID Field
CVSS 6.5
Details
Vulnerabilities 19,889
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits