CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,913 vulnerabilities with CWE-89
CVE-2017-5570 HIGH
eClinicalWorks Patient Portal 7.0 build 13 - Authenticated Blind SQL Injection via messageJson.jsp
CVSS 8.8
CVE-2017-5569 CRITICAL
eClinicalWorks Patient Portal 7.0 build 13 - Unauthenticated Blind SQL Injection via template.jsp
CVSS 9.8
CVE-2017-5575 CRITICAL
GeniXCMS < 0.0.8 - SQL Injection via Modules Parameter
CVSS 9.8
CVE-2017-5574 CRITICAL
GeniXCMS < 0.0.8 - Unauthenticated SQL Injection via Activation Parameter
CVSS 9.8
CVE-2017-5519 CRITICAL
GeniXCMS <= 0.0.8 - SQL Injection via Posts.class.php id Parameter
CVSS 9.8
CVE-2017-5517 CRITICAL
GeniXCMS <= 0.0.8 - SQL Injection via author.control.php type Parameter
CVSS 9.8
CVE-2017-5347 HIGH
GeniXCMS 0.0.8 - Authenticated SQL Injection via Newsletter Recipient Parameter
CVSS 7.2
CVE-2017-5346 HIGH
GeniXCMS 0.0.8 - Authenticated SQL Injection via id Parameter
CVSS 7.2
CVE-2017-5345 HIGH
GeniXCMS 0.0.8 - Authenticated SQL Injection via term Parameter
CVSS 8.8
CVE-2016-20096 CRITICAL
Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp
CVSS 9.8
CVE-2016-20073 HIGH
Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php
CVSS 8.2
CVE-2016-20072 HIGH
BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid
CVSS 8.2
CVE-2016-20071 HIGH
WordPress 404 Redirection Manager Plugin 1.0 SQL Injection
CVSS 8.2
CVE-2016-20069 HIGH
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
CVSS 8.2
CVE-2016-20068 HIGH
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
CVSS 8.2
CVE-2016-20065 HIGH
Product Catalog 8 1.2 Plugin WordPress SQL Injection
CVSS 8.2
CVE-2016-20063 HIGH
Single Personal Message 1.0.3 WordPress Plugin SQL Injection
CVSS 7.1
CVE-2016-20062 HIGH
Simply Poll 1.4.1 Plugin for WordPress SQL Injection
CVSS 8.2
CVE-2016-15050 HIGH
Nagios XI < 5.2.4 - Authenticated SQL Injection in Notification Search
CVSS 8.8
CVE-2016-15040 CRITICAL
Kento Post View Counter <2.8 - SQL Injection
CVSS 9.8
CVE-2016-15034 MEDIUM
Dynacase Webdesk <3.2-20180305 - SQL Injection
CVSS 5.5
CVE-2016-15031 HIGH
PHP-Login 1.0 - SQL Injection via myusername Parameter in checkLogin Function
CVSS 7.3
CVE-2016-15021 MEDIUM
Columbia ALS Data Browser - SQL Injection
CVSS 5.5
CVE-2016-15020 MEDIUM
Liftkit database <2.13.2 - SQL Injection
CVSS 5.5
CVE-2016-15018 MEDIUM
krail-jpa < 0.9.2 - SQL Injection
CVSS 5.5
Details
Vulnerabilities 19,913
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits