CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,913 vulnerabilities with CWE-89
CVE-2017-10682 CRITICAL
Piwigo < 2.9.1 - SQL Injection via cat_false or cat_true Parameter
CVSS 9.8
CVE-2017-9848 CRITICAL
Easysite 7.0 - SQL Injection via GetArticleHitsArray XML ArticleIDs Element
CVSS 9.8
CVE-2017-1347 HIGH
IBM Sterling B2B Integrator Standard Edition 5.2 - SQL Injection
CVSS 8.8
CVE-2017-6050 CRITICAL
Ecava IntegraXor < 5.2.1231.0 - Unauthenticated SQL Injection
CVSS 9.8
CVE-2017-9759 HIGH
Zenbership 1.0.8 - Authenticated SQL Injection via Admin Filters Array Parameter
CVSS 8.8
CVE-2017-9730 CRITICAL
nuevomailer < 6.0 - SQL Injection via r Parameter
CVSS 9.8
CVE-2017-9463 MEDIUM
Piwigo < 2.9.0 - Authenticated SQL Injection via iDisplayStart and iDisplayLength Parameters
CVSS 6.5
CVE-2017-9603 HIGH
WP Jobs < 1.4 - Authenticated SQL Injection via jobid Parameter
CVSS 8.8
CVE-2017-9429 HIGH
WordPress Event List <0.7.8 - SQL Injection
CVSS 8.8
CVE-2017-9246 CRITICAL
New Relic .NET Agent <6.3.123.0 - SQL Injection
CVSS 9.8
CVE-2017-6668 MEDIUM
Cisco Unified Communications Domain Manager 8.1(7)ER1 - Authenticated SQL Injection
CVSS 4.9
CVE-2017-4974 MEDIUM
Cloud Foundry Foundation cf-release <v258 - SQL Injection
CVSS 6.5
CVE-2017-4972 HIGH
Cloud Foundry Foundation cf-release <v257 - SQL Injection
CVSS 7.5
CVE-2017-9418 HIGH
WP-Testimonials 3.4.1 - SQL Injection
CVSS 8.8
CVE-2017-2195 HIGH
Multi Feed Reader <2.2.4 - SQL Injection
CVSS 8.8
CVE-2017-9449 HIGH
BigTree CMS <4.2.18 - SQL Injection
CVSS 8.8
CVE-2017-9443 HIGH
BigTree CMS <4.2.18 - SQL Injection
CVSS 8.8
CVE-2017-9437 HIGH
Openbravo Business Suite 3.0 - SQL Injection
CVSS 8.8
CVE-2017-9436 CRITICAL
TeamPass < 2.1.27.4 - SQL Injection in users.queries.php
CVSS 9.8
CVE-2017-9435 CRITICAL
Dolibarr ERP/CRM <5.0.3 - SQL Injection
CVSS 9.8
CVE-2017-8835 CRITICAL
Peplink Balance 305, 380, 580, 710, 1350, and 2500 Firmware < 7.0.1-build2093 - SQL Injection via bauth Cookie
CVSS 9.8
CVE-2017-9427 HIGH
BigTree CMS <4.2.18 - SQL Injection
CVSS 8.8
CVE-2017-9360 CRITICAL
WebsiteBaker v2.10.0 - SQL Injection
CVSS 9.8
CVE-2017-7236 HIGH
NetApp OnCommand Unified Manager Core Package <5.2.2P1 - SQL Injection
CVSS 7.5
CVE-2017-6195 CRITICAL
Ipswitch MOVEit DMZ < 8.1 - Unauthenticated Blind SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,913
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits