CWE-89

High likelihood

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Parent: CWE-943 - Improper Neutralization of Special Elements in Data Query Logic

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

19,915 vulnerabilities with CWE-89
CVE-2010-2622
Joomanager - SQL Injection via catid Parameter
CVE-2010-2616
PHP Bible Search - SQL Injection via Chapter Parameter
CVE-2010-2614
grafik_cms 1.1.2 - SQL Injection via id Parameter in edit_page Action
CVE-2010-2611
i-netsolution Job Search Engine - SQL Injection via show_search_result.php keyword parameter
CVE-2010-2610
2daybiz Job Site Script - SQL Injection via jid, job_iid, or left_cat Parameter
CVE-2010-2609
2daybiz Job Search Engine Script - SQL Injection via show_search_result.php keyword parameter
CVE-2010-1522
BookLibrary Basic <1.5.3_2010_06_20 - SQL Injection
CVE-2010-1521
TaskFreak! < 0.6.4 - SQL Injection via Login Password Parameter
CVE-2010-2516
2daybiz Multi Level Marketing Software - SQL Injection via Username Parameter
CVE-2010-2515
JFaq (com_jfaq) 1.2 - SQL Injection via id Parameter
CVE-2010-2513
Harmistechnology Com Jeajaxeventcalendar - SQL Injection
CVE-2010-2512
2daybiz Matrimonial Script - SQL Injection via customprofile.php id Parameter
CVE-2010-2511
2daybiz Multi Level Marketing Software - SQL Injection via viewnews.php nwsid Parameter
CVE-2010-2510
2daybiz Web Template Software - SQL Injection via customize.php tid Parameter
CVE-2010-2508
2daybiz Video Community Portal Script - SQL Injection via UserID Parameter
CVE-2010-2462
OroHYIP - SQL Injection via withdraw_money.php id Parameter
CVE-2010-2461
JCE-Tech Overstock 1 - SQL Injection via Store Parameter
CVE-2010-2460
JCE-Tech Shareasale Script 1 - SQL Injection via merchant_id Parameter
CVE-2010-2459
2daybiz Video Community Portal Script 1.0 - SQL Injection via videoid Parameter
CVE-2010-2438
laubrotel g.cms_generator - SQL Injection via Lang Parameter
CVE-2010-2436
anecms_blog < 1.3 - SQL Injection via PATH_INFO
CVE-2010-2359
eWebquiz 8 - SQL Injection via QuizType Parameter
CVE-2010-2357
Eicra Realestate Script 1.0 and 1.6.0 - SQL Injection via p_id Parameter
CVE-2010-2354
Pilot Group eLMS Pro - SQL Injection via subscribe.php course_id Parameter
CVE-2010-2342
DMXReady Online Notebook Manager 1.0 - SQL Injection via ItemID Parameter
Details
Vulnerabilities 19,915
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits