CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,911 vulnerabilities with CWE-89
CVE-2017-14507 CRITICAL
Content Timeline plugin 4.4.2 - SQL Injection
CVSS 9.8
CVE-2017-14847 HIGH
Dasinfomedia Mojoomla WPAMS Apartment Management System for WordPress - SQL Injection
CVSS 8.8
CVE-2017-14846 HIGH
Mojoomla Hospital Management System for WordPress - SQL Injection
CVSS 8.8
CVE-2017-14845 HIGH
Mojoomla WPCHURCH < - SQL Injection
CVSS 8.8
CVE-2017-14844 HIGH
Mojoomla WPGYM <WordPress> - SQL Injection
CVSS 8.8
CVE-2017-14843 HIGH
Mojoomla School Mgmt - SQL Injection
CVSS 8.8
CVE-2017-14842 HIGH
smsmaster_multipurpose_sms_gateway - SQL Injection via id Parameter
CVSS 8.8
CVE-2017-14760 CRITICAL
Event Espresso Lite <3.1.37.12.L - SQL Injection
CVSS 9.8
CVE-2017-14703 CRITICAL
Cash Back Comparison Script 1.0 - SQL Injection
CVSS 9.8
CVE-2017-14743 HIGH
Faleemi FSC-880 00.01.01.0048P2 - Unauthenticated SQL Injection via Username Element in ONVIF Device Service
CVSS 8.1
CVE-2017-7973 CRITICAL
Schneider Electric U.motion Builder <= 1.2.1 - Unauthenticated SQL Injection
CVSS 9.8
CVE-2017-14125 CRITICAL
Responsive Image Gallery <1.2.1 - SQL Injection
CVSS 9.8
CVE-2017-14723 CRITICAL
WordPress < 4.8.2 - SQL Injection via $wpdb->prepare Placeholder Mishandling
CVSS 9.8
CVE-2017-14078 CRITICAL
Trend Micro Mobile Security <9.7.3 - RCE
CVSS 9.8
CVE-2017-14652 CRITICAL
Tapatalk < 4.5.7 - Unauthenticated SQL Injection via XML-RPC User Registration
CVSS 9.8
CVE-2017-12930 CRITICAL
TecnoVISION DLX Spot Player4 >1.5.10 - Unauthenticated SQL Injection via Admin Interface
CVSS 9.8
CVE-2017-14601 MEDIUM
Pragyan CMS 3.0 - SQL Injection via $_GET['forwhat']
CVSS 4.9
CVE-2017-14600 MEDIUM
Pragyan CMS v3.0 - Error-Based SQL Injection via del_black Parameter
CVSS 4.9
CVE-2017-14512 CRITICAL
NexusPHP <1.5.beta5.20120707 - SQL Injection
CVSS 9.8
CVE-2017-14508 HIGH
SugarCRM < 7.7.2.3, 7.8.x < 7.8.2.2, 7.9.x < 7.9.2.0 - Authenticated SQL Injection via Emails Module
CVSS 8.8
CVE-2017-1002028 CRITICAL
WordPress Gallery Transformation <1.0 - SQL Injection
CVSS 9.8
CVE-2017-1002027 CRITICAL
WordPress Plugin RK-Responsive-Contact-Form v1.0 - SQL Injection
CVSS 9.8
CVE-2017-1002026 HIGH
WordPress Plugin Event Expresso Free <3.1.37.11.L - SQL Injection
CVSS 8.8
CVE-2017-1002025 HIGH
WordPress Plugin <v1.0 - SQL Injection
CVSS 7.2
CVE-2017-1002023 CRITICAL
WordPress Plugin Easy Team Manager <1.3.2 - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,911
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits