CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (8,887)
page 275 of 445| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2010-2610 | 0.03 | — | 0.00 | Jul 2, 2010 | Multiple SQL injection vulnerabilities in 2daybiz Job Site Script allow remote attackers to execute arbitrary SQL commands via the (1) jid parameter to view_current_job.php, (2) job_iid parameter to show_search_more.php, and (3) left_cat parameter to show_search_result.php. | |||
| CVE-2010-2609 | 0.03 | — | 0.02 | Jul 2, 2010 | SQL injection vulnerability in show_search_result.php in 2daybiz Job Search Engine Script allows remote attackers to execute arbitrary SQL commands via the keyword parameter. | |||
| CVE-2010-2513 | 0.03 | — | 0.01 | Jun 28, 2010 | SQL injection vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the view parameter to index.php. | |||
| CVE-2010-2512 | 0.03 | — | 0.00 | Jun 28, 2010 | SQL injection vulnerability in customprofile.php in 2daybiz Matrimonial Script allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2010-2511 | 0.03 | — | 0.00 | Jun 28, 2010 | SQL injection vulnerability in viewnews.php in 2daybiz Multi Level Marketing (MLM) Software allows remote attackers to execute arbitrary SQL commands via the nwsid parameter. | |||
| CVE-2010-2510 | 0.03 | — | 0.00 | Jun 28, 2010 | SQL injection vulnerability in customize.php in 2daybiz Web Template Software allows remote attackers to execute arbitrary SQL commands via the tid parameter. | |||
| CVE-2010-2508 | 0.03 | — | 0.00 | Jun 28, 2010 | SQL injection vulnerability in user-profile.php in 2daybiz Video Community Portal Script allows remote attackers to execute arbitrary SQL commands via the userid parameter. | |||
| CVE-2010-2462 | 0.03 | — | 0.00 | Jun 25, 2010 | SQL injection vulnerability in withdraw_money.php in Toma Cero OroHYIP allows remote attackers to execute arbitrary SQL commands via the id parameter in a cancel action. | |||
| CVE-2010-2461 | 0.03 | — | 0.00 | Jun 25, 2010 | SQL injection vulnerability in storecat.php in JCE-Tech Overstock 1 allows remote attackers to execute arbitrary SQL commands via the store parameter. | |||
| CVE-2010-2460 | 0.03 | — | 0.00 | Jun 25, 2010 | SQL injection vulnerability in merchant_product_list.php in JCE-Tech Shareasale Script (SASS) 1 allows remote attackers to execute arbitrary SQL commands via the mechant_id parameter. | |||
| CVE-2010-2459 | 0.03 | — | 0.00 | Jun 25, 2010 | SQL injection vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to execute arbitrary SQL commands via the videoid parameter. | |||
| CVE-2010-2438 | 0.03 | — | 0.00 | Jun 24, 2010 | SQL injection vulnerability in G.CMS generator allows remote attackers to execute arbitrary SQL commands via the lang parameter to the default URI, probably index.php. | |||
| CVE-2010-2436 | 0.03 | — | 0.00 | Jun 24, 2010 | SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO. | |||
| CVE-2010-2359 | 0.03 | — | 0.01 | Jun 21, 2010 | SQL injection vulnerability in eWebQuiz.asp in ActiveWebSoftwares.com eWebquiz 8 allows remote attackers to execute arbitrary SQL commands via the QuizType parameter, a different vector than CVE-2007-1706. | |||
| CVE-2010-2357 | 0.03 | — | 0.00 | Jun 21, 2010 | SQL injection vulnerability in index.php in Eicra Realestate Script 1.0 and 1.6.0 allows remote attackers to execute arbitrary SQL commands via the p_id parameter. NOTE: some of these details are obtained from third party information. | |||
| CVE-2010-2354 | 0.03 | — | 0.01 | Jun 21, 2010 | SQL injection vulnerability in subscribe.php in Pilot Group (PG) eLMS Pro allows remote attackers to execute arbitrary SQL commands via the course_id parameter. | |||
| CVE-2010-2342 | 0.03 | — | 0.00 | Jun 21, 2010 | SQL injection vulnerability in onlinenotebookmanager.asp in DMXReady Online Notebook Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter. | |||
| CVE-2010-2340 | 0.03 | — | 0.01 | Jun 18, 2010 | SQL injection vulnerability in members.php in Arab Portal 2.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the by parameter in the msearch action. | |||
| CVE-2010-2338 | 0.03 | — | 0.02 | Jun 18, 2010 | Multiple SQL injection vulnerabilities in redir.asp in VU Web Visitor Analyst allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter. NOTE: some of these details are obtained from third party information. | |||
| CVE-2010-2335 | 0.03 | — | 0.00 | Jun 18, 2010 | SQL injection vulnerability in index.php in Yamamah Photo Gallery 1.00, as distributed before 20100618, allows remote attackers to execute arbitrary SQL commands via the news parameter. |
- CVE-2010-2610Jul 2, 2010risk 0.03cvss —epss 0.00
Multiple SQL injection vulnerabilities in 2daybiz Job Site Script allow remote attackers to execute arbitrary SQL commands via the (1) jid parameter to view_current_job.php, (2) job_iid parameter to show_search_more.php, and (3) left_cat parameter to show_search_result.php.
- CVE-2010-2609Jul 2, 2010risk 0.03cvss —epss 0.02
SQL injection vulnerability in show_search_result.php in 2daybiz Job Search Engine Script allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
- CVE-2010-2513Jun 28, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the view parameter to index.php.
- CVE-2010-2512Jun 28, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in customprofile.php in 2daybiz Matrimonial Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2010-2511Jun 28, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in viewnews.php in 2daybiz Multi Level Marketing (MLM) Software allows remote attackers to execute arbitrary SQL commands via the nwsid parameter.
- CVE-2010-2510Jun 28, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in customize.php in 2daybiz Web Template Software allows remote attackers to execute arbitrary SQL commands via the tid parameter.
- CVE-2010-2508Jun 28, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in user-profile.php in 2daybiz Video Community Portal Script allows remote attackers to execute arbitrary SQL commands via the userid parameter.
- CVE-2010-2462Jun 25, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in withdraw_money.php in Toma Cero OroHYIP allows remote attackers to execute arbitrary SQL commands via the id parameter in a cancel action.
- CVE-2010-2461Jun 25, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in storecat.php in JCE-Tech Overstock 1 allows remote attackers to execute arbitrary SQL commands via the store parameter.
- CVE-2010-2460Jun 25, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in merchant_product_list.php in JCE-Tech Shareasale Script (SASS) 1 allows remote attackers to execute arbitrary SQL commands via the mechant_id parameter.
- CVE-2010-2459Jun 25, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to execute arbitrary SQL commands via the videoid parameter.
- CVE-2010-2438Jun 24, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in G.CMS generator allows remote attackers to execute arbitrary SQL commands via the lang parameter to the default URI, probably index.php.
- CVE-2010-2436Jun 24, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
- CVE-2010-2359Jun 21, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in eWebQuiz.asp in ActiveWebSoftwares.com eWebquiz 8 allows remote attackers to execute arbitrary SQL commands via the QuizType parameter, a different vector than CVE-2007-1706.
- CVE-2010-2357Jun 21, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in index.php in Eicra Realestate Script 1.0 and 1.6.0 allows remote attackers to execute arbitrary SQL commands via the p_id parameter. NOTE: some of these details are obtained from third party information.
- CVE-2010-2354Jun 21, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in subscribe.php in Pilot Group (PG) eLMS Pro allows remote attackers to execute arbitrary SQL commands via the course_id parameter.
- CVE-2010-2342Jun 21, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in onlinenotebookmanager.asp in DMXReady Online Notebook Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
- CVE-2010-2340Jun 18, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in members.php in Arab Portal 2.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the by parameter in the msearch action.
- CVE-2010-2338Jun 18, 2010risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in redir.asp in VU Web Visitor Analyst allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter. NOTE: some of these details are obtained from third party information.
- CVE-2010-2335Jun 18, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in index.php in Yamamah Photo Gallery 1.00, as distributed before 20100618, allows remote attackers to execute arbitrary SQL commands via the news parameter.