CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,855)
page 103 of 1,043| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-36503 | Cri | 0.64 | 9.8 | 0.01 | Feb 3, 2023 | SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file. | ||
| CVE-2021-36484 | Cri | 0.64 | 9.8 | 0.01 | Feb 3, 2023 | SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page. | ||
| CVE-2022-48114 | Cri | 0.64 | 9.8 | 0.01 | Feb 2, 2023 | RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable. | ||
| CVE-2022-48082 | Cri | 0.64 | 9.8 | 0.01 | Feb 2, 2023 | Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag. | ||
| CVE-2022-47770 | Cri | 0.64 | 9.8 | 0.01 | Feb 1, 2023 | Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection. | ||
| CVE-2023-24241 | Cri | 0.64 | 9.8 | 0.01 | Feb 1, 2023 | Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php. | ||
| CVE-2022-47780 | Cri | 0.64 | 9.8 | 0.01 | Jan 31, 2023 | SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter. | ||
| CVE-2023-22900 | Cri | 0.64 | 9.8 | 0.01 | Jan 31, 2023 | Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database. | ||
| CVE-2022-27596 | Cri | 0.64 | 9.8 | 0.03 | Jan 30, 2023 | A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build… | ||
| CVE-2022-48011 | Cri | 0.64 | 9.8 | 0.01 | Jan 27, 2023 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. | ||
| CVE-2022-44298 | Cri | 0.64 | 9.8 | 0.01 | Jan 27, 2023 | SiteServer CMS 7.1.3 is vulnerable to SQL Injection. | ||
| CVE-2022-46966 | Cri | 0.64 | 9.8 | 0.01 | Jan 26, 2023 | Revenue Collection System v1.0 was discovered to contain a SQL injection vulnerability at step1.php. | ||
| CVE-2022-46999 | Cri | 0.64 | 9.8 | 0.01 | Jan 26, 2023 | Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php. | ||
| CVE-2022-44297 | Cri | 0.64 | 9.8 | 0.01 | Jan 26, 2023 | SiteServer CMS 7.1.3 has a SQL injection vulnerability the background. | ||
| CVE-2022-41142 | Hig | 0.64 | 8.8 | 0.85 | Jan 26, 2023 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to configure poller resources. The issue results from the… | ||
| CVE-2023-23331 | Cri | 0.64 | 9.8 | 0.01 | Jan 24, 2023 | Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection. | ||
| CVE-2022-48152 | Cri | 0.64 | 9.8 | 0.01 | Jan 20, 2023 | SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php. | ||
| CVE-2022-48120 | Cri | 0.64 | 9.8 | 0.01 | Jan 20, 2023 | SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php. | ||
| CVE-2020-29297 | Cri | 0.64 | 9.8 | 0.01 | Jan 20, 2023 | Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0. | ||
| CVE-2020-21152 | Cri | 0.64 | 9.8 | 0.01 | Jan 20, 2023 | SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction. |
- risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file.
- risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.
- risk 0.64cvss 9.8epss 0.01
RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
- risk 0.64cvss 9.8epss 0.01
Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
- risk 0.64cvss 9.8epss 0.01
Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.
- risk 0.64cvss 9.8epss 0.01
Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
- risk 0.64cvss 9.8epss 0.01
SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.
- risk 0.64cvss 9.8epss 0.01
Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
- risk 0.64cvss 9.8epss 0.03
A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build…
- risk 0.64cvss 9.8epss 0.01
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
- risk 0.64cvss 9.8epss 0.01
SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
- risk 0.64cvss 9.8epss 0.01
Revenue Collection System v1.0 was discovered to contain a SQL injection vulnerability at step1.php.
- risk 0.64cvss 9.8epss 0.01
Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.
- risk 0.64cvss 9.8epss 0.01
SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
- risk 0.64cvss 8.8epss 0.85
This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of requests to configure poller resources. The issue results from the…
- risk 0.64cvss 9.8epss 0.01
Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
- risk 0.64cvss 9.8epss 0.01
SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php.
- risk 0.64cvss 9.8epss 0.01
SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php.
- risk 0.64cvss 9.8epss 0.01
Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0.
- risk 0.64cvss 9.8epss 0.01
SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction.