CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,915 vulnerabilities with CWE-89
CVE-2012-10063 CRITICAL
Nagios XI <2012R1.3 - SQL Injection
CVSS 9.8
CVE-2012-10047 CRITICAL
Cyclope Employee Surveillance Solution 6.x - SQL Injection
CVE-2012-5872 CRITICAL
arc2 < 2011-12-01 - SQL Injection via SPARQL WHERE Clause Comments
CVSS 9.8
CVE-2012-10011 MEDIUM
HD FLV PLayer Plugin <1.8 - SQL Injection
CVSS 6.3
CVE-2012-10009 HIGH
404like Plugin <1.0.2 - SQL Injection
CVSS 7.3
CVE-2012-10008 MEDIUM
oneapp < 2012-05-09 - SQL Injection
CVSS 6.3
CVE-2012-10006 MEDIUM
sigeprosi < 2012-05-15 - SQL Injection
CVSS 5.5
CVE-2012-3336 HIGH
IBM InfoSphere Guardium 8.0, 8.01, 8.2 - Authenticated SQL Injection
CVSS 8.8
CVE-2012-1124 CRITICAL
phxEventManager 2.0 beta 5 - SQL Injection
CVSS 9.8
CVE-2012-4383 HIGH
Contao < 2.11.4 - SQL Injection
CVSS 8.8
CVE-2012-5698 HIGH
babygekko < 1.2.4 - SQL Injection
CVSS 8.8
CVE-2012-1259 CRITICAL
Scrutinizer NetFlow & sFlow Analyzer 8.6.2.16204-9.0.1.19899 - SQL Injection via Multiple CGI Parameters
CVSS 9.8
CVE-2012-6719 CRITICAL
sharebar < 1.2.2 - SQL Injection
CVSS 9.8
CVE-2012-2576 CRITICAL
SolarWinds Backup Profiler < 5.1.2 - SQL Injection via LoginServlet loginName Parameter
CVSS 9.8
CVE-2012-4570 CRITICAL
LetoDMS < 3.3.7 - SQL Injection in inc.ClassDMS.php
CVSS 9.8
CVE-2012-1665
osCMax < 2.5.1 - SQL Injection via Admin Panel Parameters
CVE-2012-5849
ClipBucket < 2.6 - SQL Injection via Multiple Parameters
CVE-2012-5853
AJAX Post Search < 1.3 - SQL Injection via srch_txt Parameter
CVE-2012-5694
Bulb Security Smartphone Pentest Framework <0.1.3 - SQL Injection
CVE-2012-5865
Achievo 1.4.5 - Authenticated SQL Injection via Activity ID Parameter
CVE-2012-5701
dotproject < 2.1.7 - Authenticated SQL Injection via Multiple Parameters
CVE-2012-5244
Banana Dance < b.2.6 - SQL Injection via Multiple Parameters
CVE-2012-0811
Postfix Admin <2.3.5 - SQL Injection
CVE-2012-2956
SpiceWorks 5.3.75941 - SQL Injection
CVE-2012-1506
OrangeHRM < 2.7 - Authenticated SQL Injection via hspSummaryId Parameter
Details
Vulnerabilities 19,915
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits