CWE-89
High likelihoodImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
19,910 vulnerabilities with CWE-89
CVE-2017-17420
CRITICAL
Quest NetVault Backup 11.3.0.12 - Unauthenticated SQL Injection via NVBUJobCountHistory Get Method
CVSS 9.8
CVE-2017-17419
CRITICAL
Quest NetVault Backup 11.3.0.12 - SQL Injection
CVSS 9.8
CVE-2017-17418
CRITICAL
Quest NetVault Backup 11.3.0.12 - Code Injection
CVSS 9.8
CVE-2017-17417
CRITICAL
Quest NetVault Backup 11.3.0.12 - SQL Injection
CVSS 9.8
CVE-2017-17416
CRITICAL
Quest NetVault Backup 11.3.0.12 - SQL Injection
CVSS 9.8
CVE-2017-17415
CRITICAL
Quest NetVault Backup 11.3.0.12 - SQL Injection
CVSS 9.8
CVE-2017-17414
CRITICAL
Quest NetVault Backup 11.3.0.12 - SQL Injection
CVSS 9.8
CVE-2017-17413
CRITICAL
Quest NetVault Backup 11.3.0.12 - Code Injection
CVSS 9.8
CVE-2017-17412
CRITICAL
Quest NetVault Backup 11.3.0.12 - Code Injection
CVSS 9.8
CVE-2017-7351
HIGH
REDCap 7.0.0-7.0.10 - SQL Injection via SendITController:upload Trailing Substring
CVSS 8.8
CVE-2017-15546
MEDIUM
RSA Authentication Manager < 8.2 - Authenticated Blind SQL Injection
CVSS 4.3
CVE-2017-1000474
CRITICAL
Soyket Chowdhury Vehicle Sales Management System 2017-07-30 - RCE
CVSS 9.8
CVE-2017-17999
CRITICAL
RISE Ultimate Project Manager 1.9 - SQL Injection via Search Parameter
CVSS 9.8
CVE-2017-12729
CRITICAL
Moxa SoftCMS Live Viewer < 1.6 - SQL Injection
CVSS 9.8
CVE-2017-17970
CRITICAL
Muviko 1.1 - SQL Injection via Multiple Parameters
CVSS 9.8
CVE-2017-1670
CRITICAL
IBM Tivoli Key Lifecycle Manager <2.8 - SQL Injection
CVSS 9.8
CVE-2017-7997
CRITICAL
gespage < 7.4.9 - SQL Injection via show_prn or show_month Parameter
CVSS 9.8
CVE-2017-5971
CRITICAL
NewsBee CMS - SQL Injection
CVSS 9.8
CVE-2017-16716
CRITICAL
Advantech WebAccess < 8.3 - SQL Injection
CVSS 9.8
CVE-2017-14960
HIGH
OpenText Document Sciences xPression < 4.5 - SQL Injection in xDashboard
CVSS 7.5
CVE-2017-1000444
CRITICAL
Eleix Openhacker 0.1.47 - SQL Injection in Account Registration and Login
CVSS 9.8
CVE-2017-17983
HIGH
Muslim Matrimonial Script - SQL Injection via View-Profile mem_id Parameter
CVSS 8.8
CVE-2017-17920
HIGH
Ruby on Rails < 5.1.4 - SQL Injection via Reorder Method Name Parameter
CVSS 8.1
CVE-2017-17919
HIGH
Ruby on Rails < 5.1.4 - SQL Injection via Order Method
CVSS 8.1
CVE-2017-17917
HIGH
Ruby on Rails < 5.1.4 - SQL Injection via 'where' Method 'id' Parameter
CVSS 8.1
Details
Vulnerabilities
19,910
Exploit Likelihood
High