CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,910 vulnerabilities with CWE-89
CVE-2017-17902 CRITICAL
Kliqqi CMS 3.5.2 - SQL Injection via randkey Parameter
CVSS 9.8
CVE-2017-9839 HIGH
Dolibarr ERP/CRM <5.0.4 - SQL Injection
CVSS 8.8
CVE-2017-18260 HIGH
Dolibarr ERP/CRM < 7.0.0 - SQL Injection via comm/propal/list.php Parameters
CVSS 8.8
CVE-2017-11509 HIGH
Firebird 2.5.7 and 3.0.2 - Authenticated Remote Code Execution via Malformed SQL Statement
CVSS 8.8
CVE-2017-0914 HIGH
GitLab 10.1, 10.2, 10.2.4 - SQL Injection in MilestoneFinder
CVSS 7.5
CVE-2017-15367 CRITICAL
Bacula-web < 8.0.0-rc2 - SQL Injection
CVSS 9.8
CVE-2017-9426 CRITICAL
Piwigo Facetag <0.0.3 - SQL Injection
CVSS 9.8
CVE-2017-18194 CRITICAL
HamayeshNegar CMS >= 9.1.3 - SQL Injection via utype Parameter
CVSS 9.8
CVE-2017-5814 CRITICAL
HPE Network Automation 9.1x-10.2x - SQL Injection Authentication Bypass
CVSS 9.8
CVE-2017-5812 HIGH
HPE Network Automation 9.1x-10.2x - SQL Injection
CVSS 7.5
CVE-2017-5810 CRITICAL
HPE Network Automation 9.1x-10.2x - SQL Injection
CVSS 9.8
CVE-2017-15329 HIGH
Huawei UMA V200R001C00 - Authenticated SQL Injection in Operation and Maintenance Module
CVSS 8.8
CVE-2017-17659 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUJobHistory Get Method
CVSS 9.8
CVE-2017-17658 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUJobDefinitions Get Method
CVSS 9.8
CVE-2017-17657 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUBackup TimeRange Method
CVSS 9.8
CVE-2017-17656 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUBackup JobList Method
CVSS 9.8
CVE-2017-17655 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUBackup PluginList Method
CVSS 9.8
CVE-2017-17654 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUBackup ClientList Method
CVSS 9.8
CVE-2017-17653 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUBackupOptionSet Get Method
CVSS 9.8
CVE-2017-17652 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUBackup Count Method
CVSS 9.8
CVE-2017-17425 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUSourceDeviceSet Get Method
CVSS 9.8
CVE-2017-17424 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUScheduleSet Get Method
CVSS 9.8
CVE-2017-17423 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUBackupSegment Get Method
CVSS 9.8
CVE-2017-17422 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUBackup Get Method
CVSS 9.8
CVE-2017-17421 CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUSelectionSet Get Method
CVSS 9.8
Details
Vulnerabilities 19,910
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits