CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,914 vulnerabilities with CWE-89
CVE-2015-9457 HIGH
Caseproof Prettylinks < 1.6.8 - SQL Injection
CVSS 7.2
CVE-2015-9454 HIGH
smooth_slider < 2.7 - SQL Injection via current_slider_id Parameter
CVSS 8.8
CVE-2015-9452 CRITICAL
nex-forms < 4.6.1 - SQL Injection via nex_forms_Id Parameter
CVSS 9.8
CVE-2015-9451 CRITICAL
plugmatter_optin_feature_box < 2.0.14 - SQL Injection via pmfb_tid Parameter
CVSS 9.8
CVE-2015-9450 CRITICAL
plugmatter_optin_feature_box < 2.0.14 - SQL Injection via pmfb_tid Parameter
CVSS 9.8
CVE-2015-9448 HIGH
SendPress < 1.2 - SQL Injection via listid Parameter
CVSS 8.8
CVE-2015-9446 HIGH
unite_gallery_lite < 1.5 - SQL Injection via data[galleryID] Parameter
CVSS 8.8
CVE-2015-9449 HIGH
microblog-poster < 1.6.2 - SQL Injection via Account ID Parameter
CVSS 7.2
CVE-2015-9400 HIGH
wordpress-meta-robots < 2.1 - SQL Injection via wp-admin/post-new.php Text Parameter
CVSS 8.8
CVE-2015-9399 HIGH
wp-stats-dashboard <= 2.9.4 - SQL Injection via admin/graph_trend.php type Parameter
CVSS 7.2
CVE-2015-9398 HIGH
gocodes < 1.3.5 - SQL Injection via wp-admin/tools.php gcid Parameter
CVSS 8.8
CVE-2015-9395 HIGH
users_ultra_membership < 1.5.64 - SQL Injection via AJAX Action
CVSS 8.8
CVE-2015-9353 HIGH
Gigpress < 2.3.11 - Authenticated SQL Injection
CVSS 7.2
CVE-2015-9352 CRITICAL
wp-polls < 2.72 - SQL Injection
CVSS 9.8
CVE-2015-9344 CRITICAL
perafox link_log < 2.1 - SQL Injection
CVSS 9.8
CVE-2015-9334 CRITICAL
email-newsletter < 20.15 - SQL Injection
CVSS 9.8
CVE-2015-9335 CRITICAL
limit-attempts < 1.1.1 - SQL Injection via IP Address Handling
CVSS 9.8
CVE-2015-9333 CRITICAL
Cformsii < 14.6.10 - SQL Injection
CVSS 9.8
CVE-2015-9330 CRITICAL
WP All Import < 3.2.5 - Blind SQL Injection
CVSS 9.8
CVE-2015-9324 CRITICAL
Easy Digital Downloads < 2.3.3 - SQL Injection
CVSS 9.8
CVE-2015-9323 CRITICAL
404_to_301 < 2.0.3 - SQL Injection
CVSS 9.8
CVE-2015-9326 CRITICAL
wp-business-intelligence-lite < 1.6.3 - SQL Injection
CVSS 9.8
CVE-2015-9325 CRITICAL
visitors-online < 0.4 - SQL Injection
CVSS 9.8
CVE-2015-9310 CRITICAL
All In One WP Security & Firewall < 3.9.1 - SQL Injection
CVSS 9.8
CVE-2015-9316 CRITICAL
WP Fastest Cache < 0.8.4.9 - SQL Injection via poll_id Parameter
CVSS 9.8
Details
Vulnerabilities 19,914
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits