CWE-89
20,752 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVEs (20,752)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name. |
1Wpfastestcache 1Wp Fastest Cache Nov 21, 2024 Aug 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The wp-fastest-cache plugin before 0.8.4.9 for WordPress has SQL injection in wp-admin/admin-ajax.php?action=wpfc_wppolls_ajax_request via the poll_id parameter. |
1Newstatpress Project 1Newstatpress Nov 21, 2024 Aug 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The newstatpress plugin before 1.0.1 for WordPress has SQL injection. |
1Newstatpress Project 1Newstatpress Nov 21, 2024 Aug 14, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element. |
The wp-statistics plugin before 12.0.8 for WordPress has SQL injection. |
The liveforms plugin before 3.2.0 for WordPress has SQL injection. |
An issue was discovered in imcat 4.9. There is SQL Injection via the index.php order parameter in a mod=faqs action. |
An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection. |
Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. |
1Foliovision 1Fv Flowplayer Video Player Jun 17, 2026 Aug 9, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows email subscription SQL injection. |
3Debian DjangoprojectFedoraproject3Debian Linux DjangoFedoraJun 17, 2026 Aug 9, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and...Show more |
Open-School 3.0, and Community Edition 2.3, allows SQL Injection via the index.php?r=students/students/document id parameter. |
An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running on https://lookup.nextcloud.com) caused unauthenticated users to be able to execute arbitrary SQL commands. |
1Microdigital 3Mdc N2190v Firmware Mdc N4090 FirmwareMdc N4090w FirmwareJun 17, 2026 Aug 6, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. SQL injection vulnerabilities exist in 13 forms that are reachable through HTTPD. An attacker can, for example, create an admin a...Show more |
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the aff...Show more |
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter. |
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php. |
cPanel before 67.9999.103 allows SQL injection during eximstats processing (SEC-276). |
cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123). |
cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71). |