CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,913 vulnerabilities with CWE-89
CVE-2016-6233 CRITICAL
Zend Framework <1.12.19 - SQL Injection
CVSS 9.8
CVE-2016-4861 CRITICAL
Fedora < 1.12.19 - SQL Injection
CVSS 9.8
CVE-2016-10134 CRITICAL
Zabbix <2.2.14, <3.0.4 - SQL Injection
CVSS 9.8
CVE-2016-3694 CRITICAL
modified eCommerce Shopsoftware 2.0.0.0 - SQL Injection
CVSS 9.8
CVE-2016-9333 CRITICAL
Moxa SoftCMS < 1.6 - SQL Injection
CVSS 9.8
CVE-2016-8341 CRITICAL
Ecava IntegraXor <5.0.413.0 - SQL Injection
CVSS 9.8
CVE-2016-7400 CRITICAL
Exponent CMS < 2.3.9 - SQL Injection via id, title, or content_id Parameter
CVSS 9.8
CVE-2016-8930 HIGH
IBM Kenexa LMS on Cloud - SQL Injection
CVSS 7.6
CVE-2016-8929 MEDIUM
IBM Kenexa LMS on Cloud - SQL Injection
CVSS 5.4
CVE-2016-8928 HIGH
IBM Kenexa LMS on Cloud - SQL Injection
CVSS 7.6
CVE-2016-5952 HIGH
IBM Kenexa LCMS Premier - SQL Injection
CVSS 8.8
CVE-2016-5939 MEDIUM
IBM Kenexa LMS on Cloud - SQL Injection
CVSS 6.3
CVE-2016-3046 LOW
IBM Security Access Manager for Web 8.0 Firmware - SQL Injection
CVSS 2.7
CVE-2016-9416 CRITICAL
MyBB and MyBB Merge System < 1.8.8 - SQL Injection
CVSS 9.8
CVE-2016-9402 CRITICAL
MyBB and MyBB Merge System < 1.8.7 - SQL Injection
CVSS 9.8
CVE-2016-5742 CRITICAL
Movable Type <6.1.3, <6.2.6 - SQL Injection
CVSS 9.8
CVE-2016-4338 HIGH
Zabbix <2.0.18, <2.2.13, <3.0.3 - Code Injection
CVSS 8.1
CVE-2016-0769 HIGH
WordPress eShop <6.3.14 - SQL Injection
CVSS 8.8
CVE-2016-10114 CRITICAL
aWeb Cart Watching System <2.6.1 - SQL Injection
CVSS 9.8
CVE-2016-10096 HIGH
GeniXCMS < 1.0.0 - SQL Injection via Register Activation Parameter
CVSS 7.3
CVE-2016-2355 CRITICAL
dotcms < 3.3.1 - SQL Injection via REST API stName Parameter
CVSS 9.8
CVE-2016-9864 HIGH
phpMyAdmin < 4.6.5, < 4.4.15.9, < 4.0.10.18 - SQL Injection via Tracking Functionality
CVSS 7.5
CVE-2016-6619 HIGH
phpMyAdmin <4.6.4, <4.4.15.8, <4.0.10.17 - SQL Injection
CVSS 8.8
CVE-2016-6617 HIGH
phpMyAdmin 4.6.x < 4.6.4 - SQL Injection via Export Functionality
CVSS 8.1
CVE-2016-6616 HIGH
phpMyAdmin <4.6.4, <4.4.15.8 - SQL Injection
CVSS 7.5
Details
Vulnerabilities 19,913
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits