CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,889 vulnerabilities with CWE-89
CVE-2018-3605 HIGH
Trend Micro Control Manager 6.0 SQLi & RCE via TopXXX/ViolationXXX/IncidentXXX
CVSS 8.8
CVE-2018-3604 HIGH
Trend Micro Control Manager 6.0 - SQL Injection via GetXXX Method
CVSS 8.8
CVE-2018-3603 HIGH
Trend Micro Control Manager 6.0 - SQL Injection via CGGIServlet
CVSS 8.8
CVE-2018-3602 HIGH
Trend Micro Control Manager 6.0 - RCE
CVSS 8.8
CVE-2018-0120 MEDIUM
Cisco Unified Communications Manager - Authenticated SQL Injection via Bypassed Protection Filters
CVSS 4.3
CVE-2018-6792 HIGH
Saifor CVMS HUB 1.3.1 - Authenticated SQL Injection via Multiple Parameters
CVSS 8.8
CVE-2018-6609 CRITICAL
jsp_tickets 1.1 - SQL Injection via Ticketcode or ID Parameter
CVSS 9.8
CVE-2018-6605 CRITICAL
Zh BaiduMap 3.0.0.1 - SQL Injection via id Parameter
CVSS 9.8
CVE-2018-6604 CRITICAL
Zh YandexMap 6.2.1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2018-6582 CRITICAL
Zh GoogleMap 8.4.0.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2018-6581 CRITICAL
jms_music 1.1.1 - SQL Injection via Search Parameter
CVSS 9.8
CVE-2018-6579 CRITICAL
JEXTN Reverse Auction 3.1.0 - SQL Injection via view=products&uid= Parameter
CVSS 9.8
CVE-2018-6578 CRITICAL
je_paypervideo 3.0.0 - SQL Injection via usr_plan Parameter
CVSS 9.8
CVE-2018-6577 CRITICAL
JEXTN Membership 3.1.0 - SQL Injection via usr_plan Parameter
CVSS 9.8
CVE-2018-6576 CRITICAL
Event Manager 1.0 - SQL Injection via event.php id or page.php slug Parameter
CVSS 9.8
CVE-2018-6575 CRITICAL
JEXTN Classified 1.0.0 - SQL Injection via view=boutique&sid Parameter
CVSS 9.8
CVE-2018-6376 CRITICAL
Joomla! < 3.8.4 - SQL Injection in Hathor Postinstall Message
CVSS 9.8
CVE-2018-6398 CRITICAL
CP Event Calendar 3.0.1 - SQL Injection via id Parameter
CVSS 9.8
CVE-2018-6395 CRITICAL
Visual Calendar 3.1.3 - SQL Injection via id Parameter
CVSS 9.8
CVE-2018-6382 LOW
MantisBT 2.10.0 - SQL Injection via ADOdb server.php sql Parameter
CVSS 3.3
CVE-2018-6393 HIGH
FreePBX 10.13.66-32bit and 14.0.1.24 - Authenticated SQL Injection via Order Parameter
CVSS 7.2
CVE-2018-6367 CRITICAL
Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 - SQL Injection via chat_window.php or search_events.php
CVSS 9.8
CVE-2018-6365 CRITICAL
TSiteBuilder 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2018-6364 CRITICAL
Multilanguage Real Estate MLM Script <= 3.0 - SQL Injection via srch Parameter
CVSS 9.8
CVE-2018-6363 CRITICAL
Task Rabbit Clone 1.0 - SQL Injection via single_blog.php id Parameter
CVSS 9.8
Details
Vulnerabilities 19,889
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits