CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,855)
page 145 of 1,043| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-3604 | Cri | 0.64 | 9.8 | 0.02 | Jun 18, 2021 | Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database. | ||
| CVE-2020-22212 | Cri | 0.64 | 9.8 | 0.01 | Jun 16, 2021 | SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php. | ||
| CVE-2020-22211 | Cri | 0.64 | 9.8 | 0.08 | Jun 16, 2021 | SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php. | ||
| CVE-2020-22210 | Cri | 0.64 | 9.8 | 0.09 | Jun 16, 2021 | SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php. | ||
| CVE-2020-22209 | Cri | 0.64 | 9.8 | 0.09 | Jun 16, 2021 | SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php. | ||
| CVE-2020-22206 | Cri | 0.64 | 9.8 | 0.01 | Jun 16, 2021 | SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php. | ||
| CVE-2020-22205 | Cri | 0.64 | 9.8 | 0.01 | Jun 16, 2021 | SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php. | ||
| CVE-2020-22204 | Cri | 0.64 | 9.8 | 0.01 | Jun 16, 2021 | SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. . | ||
| CVE-2020-22203 | Cri | 0.64 | 9.8 | 0.01 | Jun 16, 2021 | SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php. | ||
| CVE-2020-22199 | Cri | 0.64 | 9.8 | 0.01 | Jun 16, 2021 | SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php. | ||
| CVE-2020-22198 | Cri | 0.64 | 9.8 | 0.02 | Jun 16, 2021 | SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php. | ||
| CVE-2020-29214 | Cri | 0.64 | 9.8 | 0.04 | Jun 15, 2021 | SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php. | ||
| CVE-2021-23230 | Cri | 0.64 | 9.9 | 0.01 | Jun 11, 2021 | A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions… | ||
| CVE-2020-35441 | Cri | 0.64 | 9.8 | 0.01 | Jun 2, 2021 | FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php. | ||
| CVE-2021-29089 | Cri | 0.64 | 9.8 | 0.02 | Jun 2, 2021 | Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors. | ||
| CVE-2021-27828 | — | Cri | 0.64 | 9.1 | 0.20 | Jun 1, 2021 | SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries. | |
| CVE-2021-33470 | Cri | 0.64 | 9.8 | 0.02 | May 26, 2021 | COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel. | ||
| CVE-2019-12348 | Cri | 0.64 | 9.8 | 0.02 | May 24, 2021 | An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter. | ||
| CVE-2020-25409 | Cri | 0.64 | 9.8 | 0.02 | May 24, 2021 | Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters. | ||
| CVE-2021-20720 | Cri | 0.64 | 9.8 | 0.01 | May 20, 2021 | SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL commands and to obtain/alter the information stored in the database via unspecified vectors. |
- risk 0.64cvss 9.8epss 0.02
Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. An attacker could exploit this vulnerability in order to extract information of users and administrator accounts stored in the database.
- risk 0.64cvss 9.8epss 0.01
SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
- risk 0.64cvss 9.8epss 0.08
SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
- risk 0.64cvss 9.8epss 0.09
SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
- risk 0.64cvss 9.8epss 0.09
SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
- risk 0.64cvss 9.8epss 0.01
SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php.
- risk 0.64cvss 9.8epss 0.01
SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php.
- risk 0.64cvss 9.8epss 0.01
SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. .
- risk 0.64cvss 9.8epss 0.01
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.
- risk 0.64cvss 9.8epss 0.01
SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.
- risk 0.64cvss 9.8epss 0.02
SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.
- risk 0.64cvss 9.8epss 0.04
SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php.
- risk 0.64cvss 9.9epss 0.01
A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 (MR3); 8.30 versions…
- risk 0.64cvss 9.8epss 0.01
FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php.
- risk 0.64cvss 9.8epss 0.02
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Station before 6.8.14-3500 allows remote attackers users to execute arbitrary SQL commands via unspecified vectors.
- risk 0.64cvss 9.1epss 0.20
SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries.
- risk 0.64cvss 9.8epss 0.02
COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
- risk 0.64cvss 9.8epss 0.02
An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.
- risk 0.64cvss 9.8epss 0.02
Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters.
- risk 0.64cvss 9.8epss 0.01
SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL commands and to obtain/alter the information stored in the database via unspecified vectors.