CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,910 vulnerabilities with CWE-89
CVE-2017-18548 CRITICAL
WordPress Note-Press <0.1.2 - SQL Injection
CVSS 9.8
CVE-2017-18514 CRITICAL
simple-login-log < 1.1.2 - SQL Injection
CVSS 9.8
CVE-2017-18515 CRITICAL
WP Statistics < 12.0.8 - SQL Injection
CVSS 9.8
CVE-2017-18406 HIGH
cPanel < 64.0.40 - SQL Injection via Eximstats Processing
CVSS 7.5
CVE-2017-18346 CRITICAL
CMS Web-Gooroo < 2013-01-19 - SQL Injection via wbg_login Parameter
CVSS 9.8
CVE-2017-14851 CRITICAL
Orpak SiteOmat <2017-09-25 - SQL Injection
CVSS 9.8
CVE-2017-11559 HIGH
ZOHO ManageEngine OpManager <12.2 - SQL Injection
CVSS 7.5
CVE-2017-11738 HIGH
Zoho ManageEngine Application Manager <14.6 - SQL Injection
CVSS 8.1
CVE-2017-12761 HIGH
WebFile Explorer 1.0 - SQL Injection and Arbitrary File Download via download.php id Parameter
CVSS 7.5
CVE-2017-12760 HIGH
Mobiketa 4.0 - SQL Injection via URL Parameter
CVSS 8.8
CVE-2017-12759 CRITICAL
SOA School Management 3.0 - SQL Injection
CVSS 9.8
CVE-2017-12758 CRITICAL
Joomla! Component Appointment 1.1 - SQL Injection
CVSS 9.8
CVE-2017-12757 CRITICAL
Ambit Technologies iTech Scripts - SQL Injection
CVSS 9.8
CVE-2017-16558 CRITICAL
Contao <3.5.30, <4.4.7 - SQL Injection
CVSS 9.8
CVE-2017-18362 CRITICAL KEV
Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution
CVSS 9.8
CVE-2017-10937 HIGH
ZTE ZXIPTV-UCM Firmware < 2.01.05.09 - SQL Injection via opertype Parameter
CVSS 7.5
CVE-2017-10936 HIGH
ZTE ZXCDN-SNS < 4.01.01 - SQL Injection via aoData Parameter
CVSS 7.5
CVE-2017-3181 CRITICAL
TIBCO Spotfire Analyst 7.7.0 - SQL Injection
CVSS 9.8
CVE-2017-11088 CRITICAL
Qualcomm Msm8909w Firmware - SQL Injection
CVSS 9.8
CVE-2017-18291 CRITICAL
PvPGN Stats 2.4.6 - SQL Injection via GET User Parameter
CVSS 9.8
CVE-2017-18290 CRITICAL
PvPGN Stats 2.4.6 - SQL Injection via GET sort_direction Parameter
CVSS 9.8
CVE-2017-18289 CRITICAL
PvPGN Stats 2.4.6 - SQL Injection via GET type Parameter
CVSS 9.8
CVE-2017-18288 CRITICAL
PvPGN Stats 2.4.6 - SQL Injection via GET game parameter
CVSS 9.8
CVE-2017-18287 CRITICAL
PvPGN Stats 2.4.6 - SQL Injection via user_search Parameter
CVSS 9.8
CVE-2017-1722 MEDIUM
IBM QRadar Security Information and Event Manager 7.2-7.3 - SQL Injection
CVSS 6.3
Details
Vulnerabilities 19,910
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits