CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,889 vulnerabilities with CWE-89
CVE-2017-20254 HIGH
Joomla! Component User Bench 1.0 SQL Injection via userid
CVSS 8.2
CVE-2017-20253 HIGH
Joomla! Component My Projects 2.0 SQL Injection
CVSS 8.2
CVE-2017-20252 HIGH
Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter
CVSS 8.2
CVE-2017-20249 HIGH
WordPress Plugin Apptha Slider Gallery 1.0 SQL Injection
CVSS 8.2
CVE-2017-20247 HIGH
WordPress Plugin PICA Photo Gallery 1.0 SQL Injection
CVSS 8.2
CVE-2017-20246 HIGH
KittyCatfish 2.2 Plugin for WordPress SQL Injection
CVSS 8.2
CVE-2017-20245 HIGH
Wow Viral Signups 2.1 WordPress Plugin SQL Injection
CVSS 8.2
CVE-2017-20244 HIGH
Wow Forms WordPress Plugin 2.1 SQL Injection
CVSS 8.2
CVE-2017-20243 HIGH
WordPress Car Park Booking Plugin SQL Injection via space_id
CVSS 8.2
CVE-2017-20197 HIGH
propanetank Roommate-Bill-Tracking - SQL Injection in /includes/login.php
CVSS 7.3
CVE-2017-20196 MEDIUM
Itechscripts School Management Software 2.75 - SQL Injection
CVSS 6.3
CVE-2017-20195 MEDIUM
LUNAD3v AreaLoad - SQL Injection via Phone Parameter in request.php
CVSS 5.5
CVE-2017-20173 MEDIUM
contentmap < 2017-03-08 - SQL Injection via contentid Argument in Load Function
CVSS 5.5
CVE-2017-20172 MEDIUM
soundslike < 2017-03-17 - SQL Injection in get_song_relations Function
CVSS 5.5
CVE-2017-20171 MEDIUM
apersistence < 2017-04-10 - SQL Injection in db/sql/mysqlUtils.js
CVSS 5.5
CVE-2017-20170 MEDIUM
parontalli < 2017-01-21 - SQL Injection via 's' Parameter in index.php
CVSS 5.5
CVE-2017-20169 MEDIUM
GGGGGGGG ToN-MasterServer - SQL Injection
CVSS 5.5
CVE-2017-20168 MEDIUM
piwallet < 2017-03-26 - SQL Injection via api.php Key Parameter
CVSS 5.5
CVE-2017-20163 MEDIUM
nview < 2017-04-28 - SQL Injection via Session Parameter in mutate Function
CVSS 5.5
CVE-2017-20150 MEDIUM
challenge_website < 2017-01-24 - SQL Injection
CVSS 5.5
CVE-2017-20143 MEDIUM
Itech Movie Portal Script 7.36 - SQL Injection
CVSS 6.3
CVE-2017-20142 MEDIUM
Itech Movie Portal Script 7.36 - SQL Injection
CVSS 6.3
CVE-2017-20141 MEDIUM
Itech Movie Portal Script 7.36 - SQL Injection
CVSS 6.3
CVE-2017-20139 MEDIUM
Itech Movie Portal Script 7.36 - SQL Injection
CVSS 6.3
CVE-2017-20138 MEDIUM
Itech Auction Script 6.49 - SQL Injection
CVSS 6.3
Details
Vulnerabilities 19,889
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits