CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,913 vulnerabilities with CWE-89
CVE-2017-3899 MEDIUM
Intel Security ATD <3.6.0 - SQL Injection
CVSS 6.5
CVE-2017-6578 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via Subscriber Email POST Parameter
CVSS 7.2
CVE-2017-6577 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via list_id Parameter
CVSS 7.2
CVE-2017-6576 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via Campaign Delete ID Parameter
CVSS 7.2
CVE-2017-6575 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via member_id Parameter
CVSS 7.2
CVE-2017-6574 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via filter_list Parameter
CVSS 7.2
CVE-2017-6573 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via GET Parameter id
CVSS 7.2
CVE-2017-6572 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via filter_list Parameter
CVSS 7.2
CVE-2017-6571 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via GET Parameter
CVSS 7.2
CVE-2017-6570 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via GET Parameter id
CVSS 7.2
CVE-2017-6492 HIGH
Admidio 3.2.5 - SQL Injection via dat_cat_id POST Parameter
CVSS 7.2
CVE-2017-3835 HIGH
Cisco Identity Services Engine 1.4(0.908) - Authenticated SQL Injection
CVSS 8.8
CVE-2017-6098 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via list_id Parameter
CVSS 7.2
CVE-2017-6097 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via camp_id Parameter
CVSS 7.2
CVE-2017-6096 HIGH
Mail Masta 1.0 - Authenticated SQL Injection via Filter List Parameter
CVSS 7.2
CVE-2017-6095 CRITICAL
Mail Masta 1.0 - Unauthenticated SQL Injection via list_id Parameter
CVSS 9.8
CVE-2017-6065 HIGH
GeniXCMS <= 1.0.2 - Authenticated SQL Injection via Order Parameter
CVSS 8.8
CVE-2017-5344 CRITICAL
dotcms < 3.6.1 - Unauthenticated SQL Injection via categoriesServlet q/inode Parameters
CVSS 9.8
CVE-2017-5154 CRITICAL
Advantech WebAccess 8.1 Post Authentication Credential Collector
CVSS 9.8
CVE-2017-5151 HIGH
VideoInsight Web Client <6.3.5.11 - SQL Injection
CVSS 7.3
CVE-2017-5879 CRITICAL
Exponent CMS 2.4.1 - Unauthenticated Blind SQL Injection via source_selector.php src Parameter
CVSS 9.8
CVE-2017-5218 HIGH
SageCRM < 7.3 SP3 - SQL Injection via AP_DocumentUI.asp Database Parameter
CVSS 8.8
CVE-2017-5611 CRITICAL
WordPress < 4.7.2 - SQL Injection via Crafted Post Type Name
CVSS 9.8
CVE-2017-5609 HIGH
Serendipity 2.0.5 - Authenticated SQL Injection via cat Parameter
CVSS 8.8
CVE-2017-5598 HIGH
eClinicalWorks healow@work 8.0 - Blind SQL Injection via EmployeePortalServlet
CVSS 7.5
Details
Vulnerabilities 19,913
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits