CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,910 vulnerabilities with CWE-89
CVE-2017-17580 CRITICAL
FS Linkedin Clone 1.0 - SQL Injection via group.php grid parameter
CVSS 9.8
CVE-2017-17579 CRITICAL
FS Freelancer Clone 1.0 - SQL Injection via Profile Page u Parameter
CVSS 9.8
CVE-2017-17578 CRITICAL
FS Crowdfunding Script 1.0 - SQL Injection via latest_news_details.php id Parameter
CVSS 9.8
CVE-2017-17577 CRITICAL
FS Trademe Clone 1.0 - SQL Injection via Search Parameter
CVSS 9.8
CVE-2017-17576 CRITICAL
FS Gigs Script 1.0 - SQL Injection via browse-category.php cat Parameter
CVSS 9.8
CVE-2017-17575 CRITICAL
FS Groupon Clone 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2017-17574 CRITICAL
FS Care Clone 1.0 - SQL Injection via searchJob.php jobType or jobFrequency Parameter
CVSS 9.8
CVE-2017-17573 CRITICAL
FS Ebay Clone 1.0 - SQL Injection via product.php id or search.php Parameters
CVSS 9.8
CVE-2017-17572 CRITICAL
FS Amazon Clone 1.0 - SQL Injection via PATH_INFO to /VerAyari
CVSS 9.8
CVE-2017-17571 CRITICAL
FS Foodpanda Clone 1.0 - SQL Injection via Keywords Parameter
CVSS 9.8
CVE-2017-17570 CRITICAL
FS Expedia Clone 1.0 - SQL Injection via pages.php/content.php id or show-flight-result.php fl_orig/fl_dest Parameter
CVSS 9.8
CVE-2017-17567 HIGH
Scubez Posty Readymade Classifieds - SQL Injection via ID Parameter
CVSS 7.5
CVE-2017-1606 HIGH
IBM FTM MP <3.0.0.7 - SQL Injection
CVSS 8.8
CVE-2017-17111 CRITICAL
Posty Readymade Classifieds Script 1.0 - SQL Injection
CVSS 9.8
CVE-2017-17110 CRITICAL
Techno Portfolio Management Panel 1.0 - SQL Injection
CVSS 9.8
CVE-2017-1356 HIGH
IBM Atlas eDiscovery Process Management 6.0.3 - SQL Injection
CVSS 8.8
CVE-2017-17103 HIGH
Fiyo CMS 2.0.7 - SQL Injection via sys_user.php POST Parameters
CVSS 8.8
CVE-2017-17102 HIGH
Fiyo CMS 2.0.7 - SQL Injection via $_REQUEST['link']
CVSS 7.5
CVE-2017-16893 MEDIUM
Piwigo < 2.9.2 - Authenticated SQL Injection via tags.php edit_list Parameter
CVSS 6.5
CVE-2017-10899 CRITICAL
A-Reserve < 3.8.6 - SQL Injection
CVSS 9.8
CVE-2017-10898 CRITICAL
A-Member < 3.8.6 - SQL Injection
CVSS 9.8
CVE-2017-12364 MEDIUM
Cisco Prime Service Catalog - SQL Injection
CVSS 6.5
CVE-2017-16961 MEDIUM
BigTree CMS <4.2.19 - SQL Injection
CVSS 6.5
CVE-2017-16955 HIGH
WordPress InLinks <1.1 - SQL Injection
CVSS 8.8
CVE-2017-8198 HIGH
FusionSphere V100R006C00SPC102(NFV) - Authenticated SQL Injection
CVSS 7.2
Details
Vulnerabilities 19,910
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits