CWE-89
High likelihoodImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
19,913 vulnerabilities with CWE-89
CVE-2016-15016
MEDIUM
mrtnmtth joomla_mod_einsatz_stats <0.3 - SQL Injection
CVSS 5.5
CVE-2016-15013
MEDIUM
ForumHulp search_results < 2016-10-25 - SQL Injection via list_keywords Function
CVSS 5.5
CVE-2016-15012
MEDIUM
forcedotcom SalesforceMobileSDK-Windows < 5.0.0 - SQL Injection
CVSS 5.5
CVE-2016-20018
HIGH
knexjs/knex < 2.3.0 - SQL Injection via WHERE Clause Bypass
CVSS 7.5
CVE-2016-11024
CRITICAL
odata4j 0.7.0 - SQL Injection via ExecuteJPQLQueryCommand
CVSS 9.8
CVE-2016-11023
CRITICAL
odata4j 0.7.0 - SQL Injection via ExecuteCountQueryCommand
CVSS 9.8
CVE-2016-11018
CRITICAL
Huge-IT Image Gallery < 1.9.0 - Unauthenticated SQL Injection via Client-Ip and X-Forwarded-For Headers
CVSS 9.8
CVE-2016-11000
CRITICAL
smackcoders ultimate_exporter < 1.1 - SQL Injection via export_type_name Parameter
CVSS 9.8
CVE-2016-10951
HIGH
fs-shopping-cart 2.07.02 - SQL Injection via pid Parameter
CVSS 7.2
CVE-2016-10950
HIGH
sirv < 1.3.2 - SQL Injection via id Parameter
CVSS 8.8
CVE-2016-10949
HIGH
Relevanssi < 1.14.6.1 - SQL Injection and Unsafe Unserialization
CVSS 8.8
CVE-2016-10947
HIGH
Post Indexer < 3.0.6.2 - Authenticated SQL Injection via Period Parameter
CVSS 7.2
CVE-2016-10943
HIGH
zx-csv-upload 1 - SQL Injection via id Parameter
CVSS 7.2
CVE-2016-10942
CRITICAL
podlove_podcast_publisher < 2.3.16 - SQL Injection via insert_id Parameter
CVSS 9.8
CVE-2016-10940
HIGH
zm-gallery 1.0 - SQL Injection via Order Parameter
CVSS 7.2
CVE-2016-10939
HIGH
xtremelocator 1.5 - SQL Injection via id Parameter
CVSS 7.2
CVE-2016-10921
CRITICAL
Photo Gallery < 1.0.1 - SQL Injection
CVSS 9.8
CVE-2016-10917
CRITICAL
search_everything < 8.1.6 - SQL Injection via Empty Search String
CVSS 9.8
CVE-2016-10916
CRITICAL
Appointment Booking Calendar < 1.1.24 - SQL Injection
CVSS 9.8
CVE-2016-10909
CRITICAL
Booking Calendar Contact Form < 1.0.24 - SQL Injection
CVSS 9.8
CVE-2016-10904
CRITICAL
olimometer < 2.57 - SQL Injection
CVSS 9.8
CVE-2016-10888
CRITICAL
All In One WP Security & Firewall < 4.0.7 - SQL Injection
CVSS 9.8
CVE-2016-10887
CRITICAL
All In One WP Security & Firewall < 4.0.9 - SQL Injection
CVSS 9.8
CVE-2016-10889
CRITICAL
NextGEN Gallery < 2.1.57 - SQL Injection via Gallery Name
CVSS 9.8
CVE-2016-10817
CRITICAL
cPanel 11.50.0.4-11.50.6.2 - SQL Injection via ModSecurity TailWatch Log File
CVSS 9.8
Details
Vulnerabilities
19,913
Exploit Likelihood
High