CWE-943
Improper Neutralization of Special Elements in Data Query Logic
The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
66 vulnerabilities with CWE-943
CVE-2025-23292
MEDIUM
NVIDIA Delegated Licensing Service - SQL Injection
CVSS 4.6
CVE-2025-33114
MEDIUM
IBM Db2 12.1.0-12.1.2 - Denial of Service via Specially Crafted Query
CVSS 5.3
CVE-2025-24787
HIGH
WhoDB < 0.45.0 - Parameter Injection in Database Connection String
CVSS 8.6
CVE-2024-4872
CRITICAL
MicroSCADA Pro/X SYS600 - Code Injection
CVSS 9.9
CVE-2024-35136
MEDIUM
IBM Db2 10.5-11.5 - Denial of Service via Specially Crafted Query
CVSS 5.3
CVE-2024-31882
MEDIUM
IBM Db2 11.1-11.5 - Authenticated Denial of Service via Crafted SQL Statement
CVSS 5.3
CVE-2024-28192
MEDIUM
your_spotify < 1.8.0 - Unauthenticated NoSQL Injection in Public Access Token Processing
CVSS 5.3
CVE-2022-36084
CRITICAL
cruddl <2.7.0-3.0.2 - Code Injection
CVSS 9.9
CVE-2021-1481
MEDIUM
Cisco SD-WAN vManage Software - SQL Injection
CVSS 4.3
CVE-2021-34712
MEDIUM
Cisco SD-WAN vManage Software - SQL Injection
CVSS 5.4
CVE-2021-1349
MEDIUM
Cisco SD-WAN vManage Software - SQL Injection
CVSS 6.5
CVE-2020-36195
CRITICAL
QNAP QTS - SQL Injection via Multimedia Console or Media Streaming Add-on
CVSS 9.8
CVE-2020-5257
HIGH
Administrate < 0.13.0 - SQL Injection via Direction Parameter
CVSS 7.7
CVE-2018-19952
HIGH
QNAP Music Station < 5.3.11 - SQL Injection
CVSS 7.5
CVE-2018-7829
HIGH
Pelco Sarix Enhanced Camera/Spectra Enhanced PTZ Camera - Code Inje...
CVSS 8.8
CVE-2017-12904
HIGH
Newsbeuter 0.7-2.9 - Remote Code Execution via RSS Item Title or URL
CVSS 8.8
Details
Vulnerabilities
66