CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,913 vulnerabilities with CWE-89
CVE-2016-10839 HIGH
cPanel 11.48.0.5-11.48.5.2 - SQL Injection via bin/horde_update_usernames
CVSS 8.1
CVE-2016-10755 HIGH
AbanteCart 1.2.8 - SQL Injection via source_language Parameter or Backup POST Data
CVSS 8.8
CVE-2016-10754 HIGH
vtiger CRM 6.5.0 - SQL Injection via contactidlist Parameter
CVSS 8.8
CVE-2016-8898 CRITICAL
Exponent CMS <2.3.9 - SQL Injection
CVSS 9.8
CVE-2016-8897 CRITICAL
Exponent CMS <2.3.9 - SQL Injection
CVSS 9.8
CVE-2016-1000271 CRITICAL
DT Register <3.1.12/2.8.18 - SQL Injection
CVSS 9.8
CVE-2016-10731 CRITICAL
ProjectSend r582 - SQL Injection via Multiple Request Parameters
CVSS 9.8
CVE-2016-9048 HIGH
ProcessMaker Enterprise Core 3.0.1.7-community - SQL Injection
CVSS 7.4
CVE-2016-8640 CRITICAL
pycsw <2.0.2, 1.10.5, 1.8.6 - SQL Injection
CVSS 9.1
CVE-2016-6566 CRITICAL
Sungard eTRAKiT3 <3.2.1.17 - SQL Injection
CVSS 9.8
CVE-2016-9488 CRITICAL
ManageEngine Applications Manager 12-13 < 13200 - Unauthenticated SQL Injection via MenuHandlerServlet
CVSS 9.8
CVE-2016-10554 CRITICAL
sequelize < 1.7.0-alpha3 - SQL Injection via SQLite MySQL Backslash Escaping
CVSS 9.8
CVE-2016-10553 CRITICAL
sequelize < 2.1.3 - SQL Injection
CVSS 9.8
CVE-2016-10550 CRITICAL
sequelize < 3.16.0 - SQL Injection via Limit or Order Parameters
CVSS 9.8
CVE-2016-10556 HIGH
sequelize < 3.19.3 - SQL Injection via Array Parameter Handling
CVSS 7.5
CVE-2016-10551 CRITICAL
waterline-sequel < 0.5.1 - SQL Injection via Like/Contains/StartsWith/EndsWith Input
CVSS 9.8
CVE-2016-10008 HIGH
dotCMS <4.1.1 - Authenticated SQL Injection
CVSS 7.2
CVE-2016-10007 HIGH
dotCMS <4.1.1 - Authenticated SQL Injection
CVSS 7.2
CVE-2016-10509 HIGH
OpenCart < 2.3.0.0 - Authenticated SQL Injection via Amazon Order Tracking Update
CVSS 7.2
CVE-2016-7508 HIGH
GLPI 0.90.4 - Authenticated SQL Injection via Big5 Encoding Character
CVSS 7.5
CVE-2016-7803 HIGH
Cybozu Garoon 3.0.0-4.2.2 - Authenticated SQL Injection via MultiReport Function
CVSS 8.8
CVE-2016-2034 CRITICAL
ClearPass Policy Manager <6.6.0 - SQL Injection
CVSS 9.8
CVE-2016-10379 HIGH
VirtueMart 3.0.14 - SQL Injection via Payment/Shipment Method ID Parameters
CVSS 7.2
CVE-2016-10378 HIGH
e107 2.1.1 - Authenticated SQL Injection via pagelist Parameter
CVSS 7.2
CVE-2016-4905 CRITICAL
WP-OliveCart < 3.1.3 and WP-OliveCartPro < 3.1.8 - Authenticated SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,913
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits