CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,889 vulnerabilities with CWE-89
CVE-2017-20137 MEDIUM
Itech B2B Script 4.28 - SQL Injection
CVSS 6.3
CVE-2017-20136 MEDIUM
Itech Classifieds Script 7.27 - SQL Injection
CVSS 6.3
CVE-2017-20135 MEDIUM
Itech Dating Script 3.26 - SQL Injection
CVSS 6.3
CVE-2017-20134 MEDIUM
Itech Freelancer Script 5.13 - SQL Injection
CVSS 6.3
CVE-2017-20132 MEDIUM
Itech Multi Vendor Script 6.49 - SQL Injection
CVSS 6.3
CVE-2017-20131 MEDIUM
Itech News Portal 6.28 - SQL Injection
CVSS 6.3
CVE-2017-20130 MEDIUM
Itech Real Estate Script 3.12 - SQL Injection
CVSS 6.3
CVE-2017-20129 MEDIUM
logostore - SQL Injection via search.php query Parameter
CVSS 6.3
CVE-2017-20128 HIGH
KB Messages PHP Script 1.0 - SQL Injection
CVSS 7.3
CVE-2017-20127 HIGH
KB Login Authentication Script 1.1 - SQL Injection
CVSS 7.3
CVE-2017-20126 HIGH
KB Affiliate Referral Script 1.0 - SQL Injection
CVSS 7.3
CVE-2017-20125 MEDIUM
Online Hotel Booking System Pro 1.2 - SQL Injection
CVSS 6.3
CVE-2017-20124 MEDIUM
Online Hotel Booking System Pro Plugin 1.0 - SQL Injection
CVSS 6.3
CVE-2017-20104 HIGH
Simplessus 3.7.7 - SQL Injection via UWA_SID Cookie Parameter
CVSS 7.3
CVE-2017-20103 MEDIUM
Kama Click Counter Plugin <3.4.8 - SQL Injection
CVSS 6.3
CVE-2017-20067 HIGH
Hindu Matrimonial Script - SQL Injection
CVSS 7.3
CVE-2017-20042 MEDIUM
Navetti PricePoint <4.6.0.0 - SQL Injection
CVSS 6.3
CVE-2017-20032 MEDIUM
phplist 3.2.6 - SQL Injection in Subscription Component
CVSS 6.3
CVE-2017-20030 MEDIUM
PHPList 3.2.6 - SQL Injection in Sending Campaign Component
CVSS 4.7
CVE-2017-20029 HIGH
phplist 3.2.6 - SQL Injection in Edit Subscription Component
CVSS 7.3
CVE-2017-20017 MEDIUM
The Next Generation of Genealogy Sitebuilding <11.1.0 - SQL Injection
CVSS 6.3
CVE-2017-18888 CRITICAL
Mattermost Server <4.3.0-4.1.2 - SQL Injection
CVSS 9.8
CVE-2017-14807 HIGH
SUSE Studio onsite <1.3.17-56.6.3 - SQL Injection
CVSS 8.1
CVE-2017-18614 HIGH
WordPress kama-clic-counter <3.4.9 - SQL Injection
CVSS 8.1
CVE-2017-18602 HIGH
WordPress Examapp Plugin 1.0 - SQL Injection
CVSS 8.8
Details
Vulnerabilities 19,889
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits