CWE-89
21,595 CVEs • Abstraction: Base • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVEs (21,595)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. |
Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions. |
Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions. |
Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. |
Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. |
Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. |
Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. |
Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. |
Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. |
Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. |
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. |
Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions. |
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability allows attackers to access sensitive database information vi...Show more |
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegist...Show more |
Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive databa...Show more |
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive...Show more |
A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table...Show more |
WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can s...Show more |
Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Atta...Show more |
BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers c...Show more |