CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,858)
page 279 of 1,043| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-17294 | Hig | 0.57 | 8.8 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user. | ||
| CVE-2019-17293 | Hig | 0.57 | 8.8 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user. | ||
| CVE-2019-17319 | Hig | 0.57 | 8.8 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user. | ||
| CVE-2019-17318 | Hig | 0.57 | 8.8 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user. | ||
| CVE-2015-9454 | Hig | 0.57 | 8.8 | 0.02 | Oct 7, 2019 | The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter. | ||
| CVE-2019-12686 | Hig | 0.57 | 8.8 | 0.03 | Oct 2, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input… | ||
| CVE-2019-12685 | Hig | 0.57 | 8.8 | 0.03 | Oct 2, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input… | ||
| CVE-2019-12684 | Hig | 0.57 | 8.8 | 0.03 | Oct 2, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input… | ||
| CVE-2019-12683 | Hig | 0.57 | 8.8 | 0.03 | Oct 2, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input… | ||
| CVE-2019-12682 | Hig | 0.57 | 8.8 | 0.03 | Oct 2, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input… | ||
| CVE-2019-12681 | Hig | 0.57 | 8.8 | 0.03 | Oct 2, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input… | ||
| CVE-2019-12680 | Hig | 0.57 | 8.8 | 0.03 | Oct 2, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input… | ||
| CVE-2019-12679 | Hig | 0.57 | 8.8 | 0.03 | Oct 2, 2019 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input… | ||
| CVE-2019-16745 | Hig | 0.57 | 8.8 | 0.02 | Sep 30, 2019 | eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection. | ||
| CVE-2019-16744 | Hig | 0.57 | 8.8 | 0.02 | Sep 30, 2019 | eBrigade before 5.0 has evenements.php cid SQL Injection. | ||
| CVE-2019-16743 | Hig | 0.57 | 8.8 | 0.02 | Sep 30, 2019 | eBrigade before 5.0 has evenement_ical.php evenement SQL Injection. | ||
| CVE-2015-9448 | Hig | 0.57 | 8.8 | 0.02 | Sep 26, 2019 | The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter. | ||
| CVE-2015-9446 | Hig | 0.57 | 8.8 | 0.02 | Sep 26, 2019 | The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php. | ||
| CVE-2019-16194 | Cri | 0.57 | 9.8 | 0.02 | Sep 25, 2019 | SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php. | ||
| CVE-2015-9400 | Hig | 0.57 | 8.8 | 0.02 | Sep 20, 2019 | The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection. |
- risk 0.57cvss 8.8epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user.
- risk 0.57cvss 8.8epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user.
- risk 0.57cvss 8.8epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user.
- risk 0.57cvss 8.8epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user.
- risk 0.57cvss 8.8epss 0.02
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin current_slider_id parameter.
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input…
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input…
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input…
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input…
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input…
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input…
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input…
- risk 0.57cvss 8.8epss 0.03
Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input…
- risk 0.57cvss 8.8epss 0.02
eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection.
- risk 0.57cvss 8.8epss 0.02
eBrigade before 5.0 has evenements.php cid SQL Injection.
- risk 0.57cvss 8.8epss 0.02
eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.
- risk 0.57cvss 8.8epss 0.02
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter.
- risk 0.57cvss 8.8epss 0.02
The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
- risk 0.57cvss 9.8epss 0.02
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
- risk 0.57cvss 8.8epss 0.02
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.