CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,910 vulnerabilities with CWE-89
CVE-2017-17916 HIGH
Ruby on Rails < 5.1.4 - SQL Injection via 'find_by' Method
CVSS 8.1
CVE-2017-17959 CRITICAL
PHP Multivendor Ecommerce - SQL Injection via seller-view.php usid Parameter
CVSS 9.8
CVE-2017-17957 CRITICAL
PHP Multivendor Ecommerce - SQL Injection via my_wishlist.php fid Parameter
CVSS 9.8
CVE-2017-17951 CRITICAL
PHP Multivendor Ecommerce - SQL Injection via shopping-cart.php cusid Parameter
CVSS 9.8
CVE-2017-17950 HIGH
Cells Blog 3.5 - SQL Injection via pub_readpost.php ptid Parameter
CVSS 8.8
CVE-2017-17941 HIGH
Single Theater Booking Script - SQL Injection via admin/movieview.php movieid Parameter
CVSS 7.2
CVE-2017-17931 CRITICAL
PHP Scripts Mall Resume Clone Script - SQL Injection via Forget Password Username Parameter
CVSS 9.8
CVE-2017-17928 CRITICAL
Professional Service Script - SQL Injection via admin/review.php id Parameter
CVSS 9.8
CVE-2017-17906 CRITICAL
Car Rental Script - SQL Injection via admin/carlistedit.php carid Parameter
CVSS 9.8
CVE-2017-17900 CRITICAL
Dolibarr ERP/CRM < 6.0.5 - SQL Injection via fourn/index.php socid Parameter
CVSS 9.8
CVE-2017-17899 CRITICAL
Dolibarr ERP/CRM 6.0.4 - SQL Injection via adherents/subscription/info.php rowid Parameter
CVSS 9.8
CVE-2017-17897 CRITICAL
Dolibarr ERP/CRM 6.0.4 - SQL Injection via comm/multiprix.php id Parameter
CVSS 9.8
CVE-2017-17895 CRITICAL
Readymade Job Site Script - SQL Injection via location_name Array Parameter
CVSS 9.8
CVE-2017-17892 CRITICAL
readymade_video_sharing_script - SQL Injection via chnlid or search Parameter
CVSS 9.8
CVE-2017-17875 CRITICAL
JEXTN FAQ Pro 4.0.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2017-17873 CRITICAL
Vanguard Marketplace Digital Products PHP 1.4 - SQL Injection via PATH_INFO to /p URI
CVSS 9.8
CVE-2017-17872 CRITICAL
JEXTN Video Gallery 3.0.5 - SQL Injection via id Parameter
CVSS 9.8
CVE-2017-17871 CRITICAL
JEXTN Question And Answer 3.1.0 - SQL Injection via an or ques-srch Parameter
CVSS 9.8
CVE-2017-17870 CRITICAL
JBuildozer 1.4.1 - SQL Injection via appid Parameter
CVSS 9.8
CVE-2017-0304 MEDIUM
BIG-IP AFM 12.0.0, 12.1.0-12.1.2, 13.0.0 - SQL Injection in Management UI
CVSS 5.4
CVE-2017-17829 HIGH
Bus Booking Script - SQL Injection via sp_id or memid Parameter
CVSS 7.2
CVE-2017-17824 MEDIUM
Piwigo 2.9.2 - SQL Injection via Batch Manager Unit Mode element_ids Parameter
CVSS 4.9
CVE-2017-17823 MEDIUM
Piwigo 2.9.2 - SQL Injection via Configuration Order By Parameter
CVSS 4.9
CVE-2017-17822 MEDIUM
Piwigo 2.9.2 - SQL Injection via List Users API sSortDir_0 Parameter
CVSS 4.9
CVE-2017-16735 MEDIUM
Ecava IntegraXor <6.1.1030.1 - SQL Injection
CVSS 5.3
Details
Vulnerabilities 19,910
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits