CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,911 vulnerabilities with CWE-89
CVE-2017-15984 CRITICAL
Creative Management System Lite 1.4 - SQL Injection via S Parameter
CVSS 9.8
CVE-2017-15983 CRITICAL
MyMagazine Magazine & Blog CMS 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2017-15982 CRITICAL
Dynamic News Magazine & Blog CMS 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2017-15981 CRITICAL
Responsive Newspaper Magazine & Blog CMS 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2017-15980 CRITICAL
US Zip Codes Database Script 1.0 - SQL Injection via State Parameter
CVSS 9.8
CVE-2017-15979 CRITICAL
Shareet 1.0 - SQL Injection via Photo Parameter
CVSS 9.8
CVE-2017-15978 CRITICAL
AROX School ERP PHP Script 1.0 - SQL Injection via Office Admin ID Parameter
CVSS 9.8
CVE-2017-15977 CRITICAL
Protected Links - Expiring Download Links 1.0 - SQL Injection via Username Parameter
CVSS 9.8
CVE-2017-16000 HIGH
EyesOfNetwork 5.1-0 - Authenticated SQL Injection via Graph Parameter
CVSS 7.2
CVE-2017-15976 CRITICAL
ZeeBuddy 2x - SQL Injection via admin/editadgroup.php groupid Parameter
CVSS 9.8
CVE-2017-15975 CRITICAL
Vastal I-Tech Dating Zone 0.9.9 - SQL Injection via add_to_cart.php product_id Parameter
CVSS 9.8
CVE-2017-15974 CRITICAL
tPanel 2009 - SQL Injection via login.php Authentication Bypass
CVSS 9.8
CVE-2017-15973 CRITICAL
Sokial Social Network Script 1.0 - SQL Injection via id Parameter
CVSS 9.8
CVE-2017-15972 CRITICAL
SoftDatepro Dating Social Network 1.3 - SQL Injection via viewprofile.php profid Parameter
CVSS 9.8
CVE-2017-15971 CRITICAL
Same Sex Dating Software Pro 1.0 - SQL Injection via viewprofile.php profid Parameter
CVSS 9.8
CVE-2017-15970 CRITICAL
Phpcityportal - SQL Injection
CVSS 9.8
CVE-2017-15969 CRITICAL
Pilotgroup Allsharevideo - SQL Injection
CVSS 9.8
CVE-2017-15968 CRITICAL
Contractorscripts Mybuildersite - SQL Injection
CVSS 9.8
CVE-2017-15967 CRITICAL
Mailing List Manager Pro 3.0 - SQL Injection via Edit Parameter
CVSS 9.8
CVE-2017-15966 CRITICAL
Zh YandexMap 6.1.1.0 - SQL Injection via placemarklistid Parameter
CVSS 9.8
CVE-2017-15965 CRITICAL
NS Download Shop 2.2.6 - SQL Injection via Invoice Create ID Parameter
CVSS 9.8
CVE-2017-15964 CRITICAL
Job Board Script Software - SQL Injection via PATH_INFO to /job-details
CVSS 9.8
CVE-2017-15963 CRITICAL
iTech Gigs Script 1.21 - SQL Injection via sc or ser Parameter
CVSS 9.8
CVE-2017-15961 CRITICAL
iProject Management System 1.0 - SQL Injection via ID Parameter
CVSS 9.8
CVE-2017-15960 CRITICAL
Article Directory Script 3.0 - SQL Injection via id Parameter
CVSS 9.8
Details
Vulnerabilities 19,911
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits