CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,911 vulnerabilities with CWE-89
CVE-2017-15959 CRITICAL
Adultscriptpro - SQL Injection
CVSS 9.8
CVE-2017-15958 CRITICAL
D-Park Pro Domain Parking Script 1.0 - SQL Injection via Admin Login Form Username
CVSS 9.8
CVE-2017-15949 HIGH
Xavier PHP Management Panel 2.4 - SQL Injection via usertoedit or log_id Parameter
CVSS 7.2
CVE-2017-15946 CRITICAL
selfget tag_meta - SQL Injection via Tag Parameter
CVSS 9.8
CVE-2017-15933 HIGH
EyesOfNetwork 5.1-0 - Authenticated SQL Injection via Host Parameter
CVSS 7.2
CVE-2017-15919 CRITICAL
Ultimate Form Builder Lite < 1.3.6 - SQL Injection via admin-ajax.php
CVSS 9.8
CVE-2017-15907 CRITICAL
phpcollab < 2.5.1 - SQL Injection via Newsdesk ID Parameter
CVSS 9.8
CVE-2017-15880 HIGH
EyesOfNetwork 5.1-0 - Authenticated SQL Injection via group_name Parameter
CVSS 7.2
CVE-2017-15081 CRITICAL
PHP Melody CMS 2.6.1 - SQL Injection via Playlist Parameter
CVSS 9.8
CVE-2017-15381 CRITICAL
E-Sic 1.0 - SQL Injection via buscacep.php f Parameter
CVSS 9.8
CVE-2017-15379 CRITICAL
E-Sic 1.0 - Authentication Bypass via SQL Injection
CVSS 9.8
CVE-2017-15378 HIGH
E-Sic 1.0 - SQL Injection via Password Reset Parameter
CVSS 8.8
CVE-2017-2133 HIGH
Panasonic KX-HJB1000 - SQL Injection
CVSS 8.8
CVE-2017-15579 CRITICAL
php_melody < 2.7.3 - SQL Injection via aa_pages_per_page Cookie
CVSS 9.8
CVE-2017-15578 HIGH
PHP Melody < 2.7.3 - SQL Injection via Image Parameter
CVSS 8.8
CVE-2017-15539 CRITICAL
zorovavi/blog < 2017-10-17 - SQL Injection via id Parameter
CVSS 9.8
CVE-2017-15373 CRITICAL
E-Sic 1.0 - SQL Injection via Search Private Area q Parameter
CVSS 9.8
CVE-2017-13068 HIGH
QNAP QTS Helpdesk < 1.1.12 - Unauthenticated SQL Injection
CVSS 7.5
CVE-2017-1000120 HIGH
frappe < 7.1.27 - Authenticated SQL Injection via Share Fields Parameter
CVSS 8.8
CVE-2017-6089 CRITICAL
phpcollab < 2.5.1 - Unauthenticated SQL Injection via project or id Parameters
CVSS 9.8
CVE-2017-14848 HIGH
WPHRM Human Resource Management System for WordPress 1.0 - SQL Injection via employee_id Parameter
CVSS 8.8
CVE-2017-14758 HIGH
OpenText Document Sciences xPression v4.5SP1 Patch 13 - SQL Injection
CVSS 8.8
CVE-2017-14757 HIGH
OpenText Document Sciences xPression <4.5SP1 Patch 13 - SQL Injection
CVSS 8.8
CVE-2017-1311 HIGH
IBM Insights Foundation for Energy 2.0 - SQL Injection
CVSS 8.8
CVE-2017-14738 CRITICAL
FileRun <2017.09.18 - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,911
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits