CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,915 vulnerabilities with CWE-89
CVE-2014-1619
Cubic CMS 5.1.1-5.2 - SQL Injection via Resource ID, Version ID, Login, or Pass Parameter
CVE-2014-1618
UAEPD Shopping Cart Script - SQL Injection
CVE-2014-1466
CSP MySQL User Manager 2.3 - SQL Injection via Login Field
CVE-2014-1206
Open Web Analytics < 1.5.5 - SQL Injection via Password Reset Email Parameter
CVE-2013-10044 HIGH
OpenEMR < 4.1.1 Patch 14 - SQL Injection
CVSS 8.8
CVE-2013-10043 CRITICAL
OAstium VoIP PBX astium-confweb-2.1-25399 - Auth Bypass & RCE
CVE-2013-10033 CRITICAL
Kimai 0.9.2.x - Unauthenticated SQL Injection via db_restore.php dates[] Parameter
CVE-2013-10023 MEDIUM
Editorial Calendar Plugin <2.6 - SQL Injection
CVSS 6.3
CVE-2013-10019 MEDIUM
OCLC-Research OAICat <1.5.62 - SQL Injection
CVSS 6.3
CVE-2013-10018 MEDIUM
Fanzila WebFinance <0.5 - SQL Injection
CVSS 5.5
CVE-2013-10017 MEDIUM
Fanzila WebFinance 0.5 - SQL Injection
CVSS 5.5
CVE-2013-10016 MEDIUM
Fanzila WebFinance <0.5 - SQL Injection
CVSS 5.5
CVE-2013-10015 MEDIUM
Fanzila WebFinance 0.5 - SQL Injection
CVSS 5.5
CVE-2013-10014 MEDIUM
2moons < 2013-01-18 - SQL Injection
CVSS 5.5
CVE-2013-10013 MEDIUM
Bricco Authenticator Plugin <1.39 - SQL Injection
CVSS 5.5
CVE-2013-10012 MEDIUM
antonbolling clan7ups - SQL Injection
CVSS 5.5
CVE-2013-10011 MEDIUM
Aeharding Classroom-Engagement-System - SQL Injection
CVSS 6.3
CVE-2013-10009 MEDIUM
pychao < 2013-11-03 - SQL Injection in klauen/lesen Function
CVSS 5.5
CVE-2013-10008 MEDIUM
eshop < 2013-01-13 - SQL Injection
CVSS 5.5
CVE-2013-10003 MEDIUM
Telecomsoftware SAMwin Contact Center Suite 5.1 - SQL Injection in getCurrentDBVersion Function
CVSS 6.5
CVE-2013-4717 HIGH
OTRS Help Desk <3.0.22-3.2.9 - SQL Injection
CVSS 8.8
CVE-2013-2018 CRITICAL
BOINC Client - SQL Injection
CVSS 9.8
CVE-2013-1401 CRITICAL
WordPress Poll Plugin 34.5 - SQL Injection via editAnswer deleteAnswer addAnswer and deletePoll Functions
CVSS 9.8
CVE-2013-1400 CRITICAL
WordPress Poll Plugin 34.5 - SQL Injection via pollid or poll_id Parameter
CVSS 9.8
CVE-2013-5945 CRITICAL
D-Link DSR Series Firmware - SQL Injection via Login Password Parameter
CVSS 9.8
Details
Vulnerabilities 19,915
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits