CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,913 vulnerabilities with CWE-89
CVE-2016-1000122 HIGH
Huge IT Joomla Slider v1.0.9 - XSS,SQL Injection
CVSS 7.2
CVE-2016-1000120 HIGH
Huge IT catalog extension <1.0.4 - SQL Injection, XSS
CVSS 7.2
CVE-2016-1000119 HIGH
Huge IT catalog extension <1.0.4 - SQL Injection, XSS
CVSS 7.2
CVE-2016-1000118 HIGH
HugeIT slideshow v1.0.4 - XSS,SQL Injection
CVSS 7.2
CVE-2016-1000117 HIGH
HugeIT Slideshow v1.0.4 - XSS,SQL Injection
CVSS 7.2
CVE-2016-1000116 HIGH
Huge-IT Portfolio Gallery manager v1.1.0 - SQL Injection, XSS
CVSS 7.2
CVE-2016-1000115 HIGH
Huge-IT Portfolio Gallery manager v1.1.0 - SQL Injection, XSS
CVSS 7.2
CVE-2016-0249 HIGH
IBM Security Guardium <8.2p310, 9.xp700, 10.xp100 - SQL Injection
CVSS 8.6
CVE-2016-8564 MEDIUM
Siemens ALM <5.3 SP3 Update 1 - SQL Injection
CVSS 6.5
CVE-2016-1000217 CRITICAL
Zotpress Plugin for WordPress - SQL Injection
CVSS 9.8
CVE-2016-1000125 CRITICAL
Huge-IT Catalog <1.0.7 - SQL Injection
CVSS 9.8
CVE-2016-1000124 CRITICAL
Huge-IT Portfolio Gallery Plugin <1.0.6 - SQL Injection
CVSS 9.8
CVE-2016-1000123 CRITICAL
Huge-IT Video Gallery v1.0.9 - SQL Injection
CVSS 9.8
CVE-2016-1000113 CRITICAL
huge IT gallery v1.1.5 for Joomla - XSS,SQL Injection
CVSS 9.8
CVE-2016-1000000 HIGH
Ipswitch WhatsUp Gold 16.4.1 - SQL Injection
CVSS 8.8
CVE-2016-6652 MEDIUM
Pivotal Spring Data JPA <1.9.6-1.10.4 - SQL Injection
CVSS 5.6
CVE-2016-6419 HIGH
Cisco Firepower Mgmt Ctr <5.4.0 - SQL Injection
CVSS 7.5
CVE-2016-7405 CRITICAL
ADOdb Library for PHP < 5.20.7 - SQL Injection via PDO Driver qstr Method
CVSS 9.8
CVE-2016-5843 CRITICAL
FAQ package <2.3.6, <4.0.5, <5.0.5 - SQL Injection
CVSS 9.4
CVE-2016-6195 CRITICAL
vBulletin <4.2.2 PL5 & <4.2.3 PL1 - SQL Injection
CVSS 9.8
CVE-2016-5048 CRITICAL
ReadyDesk 9.1 - SQL Injection via User Name Field
CVSS 9.8
CVE-2016-5817 CRITICAL
Cargotec Navis WebAccess <2016-08-10 - SQL Injection
CVSS 9.8
CVE-2016-5792 CRITICAL
Moxa SoftCMS <1.5 - SQL Injection
CVSS 9.8
CVE-2016-4999 CRITICAL
Dashbuilder < 0.6.0.Beta1 - SQL Injection via Data Set Lookup Filter
CVSS 9.8
CVE-2016-4837 CRITICAL
EC-CUBE Seed Coupon Plugin < 1.5 - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,913
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits