CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,914 vulnerabilities with CWE-89
CVE-2015-9315 CRITICAL
newstatpress < 1.0.1 - SQL Injection
CVSS 9.8
CVE-2015-9313 CRITICAL
newstatpress < 1.0.5 - SQL Injection via IMG Element
CVSS 9.8
CVE-2015-9301 CRITICAL
liveforms < 3.2.0 - SQL Injection
CVSS 9.8
CVE-2015-4615 CRITICAL
easy2map-photos 1.09 - SQL Injection via Unsanitized Variables
CVSS 9.8
CVE-2015-4633 CRITICAL
Koha 3.14.00-3.14.15 - SQL Injection via OPAC Tags Subject Parameter
CVSS 9.8
CVE-2015-8298 CRITICAL
RXTEC RXAdmin UPDATE 06/2012 - SQL Injection
CVSS 9.8
CVE-2015-4043 CRITICAL
ConnX ESP HR Management 4.4.0 - SQL Injection via frmLogin.aspx UserName Parameter
CVSS 9.8
CVE-2015-9244 CRITICAL
mysqljs/mysql < 2.0.0-alpha8 - SQL Injection via Unescaped Object Keys
CVSS 9.8
CVE-2015-5725 CRITICAL
CodeIgniter < 2.2.4 - SQL Injection via Active Record Offset Method
CVSS 9.8
CVE-2015-9249 CRITICAL
Skybox Platform < 7.5.201 - SQL Injection via SOAP Body Element
CVSS 9.8
CVE-2015-3637 HIGH
phpMyBackupPro <2.5 - SQL Injection
CVSS 8.1
CVE-2015-3934 CRITICAL
Fiyo CMS 2.0_1.9.1 - SQL Injection via id Parameter or user Parameter
CVSS 9.8
CVE-2015-3933 CRITICAL
MetalGenix GeniXCMS <0.0.3-patch - SQL Injection
CVSS 9.8
CVE-2015-5533 HIGH
WordPress Count Per Day <3.4.1 - SQL Injection
CVSS 7.2
CVE-2015-5376 CRITICAL
GSI WiNPAT Portal <3.6.1.0 - SQL Injection
CVSS 9.8
CVE-2015-7714 HIGH
Realtyna RPL <8.9.5 - SQL Injection
CVSS 7.2
CVE-2015-2147 CRITICAL
Phpbugtracker < 1.6.0 - SQL Injection
CVSS 9.8
CVE-2015-2146 CRITICAL
phpBugTracker < 1.6.0 - SQL Injection via Multiple Parameters
CVSS 9.8
CVE-2015-9234 HIGH
CP Contact Form with PayPal < 1.1.5 - SQL Injection via cp_contactformpp_id Parameter
CVSS 7.2
CVE-2015-7670 CRITICAL
Support Ticket System < 1.2 - SQL Injection via User or ID Parameter
CVSS 9.8
CVE-2015-7390 CRITICAL
TestLink < 1.9.13 - SQL Injection via apikey Parameter
CVSS 9.8
CVE-2015-4669 HIGH
Xceedium Xsuite 2.x - Unauthenticated SQL Injection via Default MySQL Root Account
CVSS 7.8
CVE-2015-4073 CRITICAL
Helpdesk Pro < 1.3.0 - SQL Injection via Ticket Code or Email Parameter
CVSS 9.8
CVE-2015-9226 HIGH
AlegroCart 1.2.8 - Authenticated SQL Injection via Download Parameter
CVSS 7.2
CVE-2015-7877 CRITICAL
User Dashboard < 7.x-1.4 - SQL Injection
CVSS 9.8
Details
Vulnerabilities 19,914
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits