CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (8,875)
page 284 of 444| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2010-0803 | 0.03 | — | 0.00 | Mar 2, 2010 | SQL injection vulnerability in the jVideoDirect (com_jvideodirect) component 1.1 RC3b for Joomla! allows remote attackers to execute arbitrary SQL commands via the v parameter to index.php. | |||
| CVE-2010-0802 | 0.03 | — | 0.00 | Mar 2, 2010 | SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action. | |||
| CVE-2010-0800 | 0.03 | — | 0.00 | Mar 2, 2010 | SQL injection vulnerability in the Ossolution Team Documents Seller (aka DMS) (com_dms) component 2.5.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a view_category action to index.php. | |||
| CVE-2010-0796 | 0.03 | — | 0.01 | Mar 2, 2010 | SQL injection vulnerability in the JE Quiz (com_jequizmanagement) component 1.b01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the eid parameter in a question action to index.php. | |||
| CVE-2010-0795 | 0.03 | — | 0.00 | Mar 2, 2010 | SQL injection vulnerability in the JE Event Calendars (com_jeeventcalendar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the event_id parameter in an event action to index.php. | |||
| CVE-2010-0764 | 0.03 | — | 0.00 | Mar 2, 2010 | SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands via the cid parameter in a show action. | |||
| CVE-2010-0763 | 0.03 | — | 0.00 | Mar 2, 2010 | SQL injection vulnerability in index.php in CommodityRentals Vacation Rental Software allows remote attackers to execute arbitrary SQL commands via the rental_id parameter in a CalendarView action. | |||
| CVE-2010-0762 | 0.03 | — | 0.01 | Mar 2, 2010 | SQL injection vulnerability in index.php in CommodityRentals CD Rental Software allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action. | |||
| CVE-2010-0761 | 0.03 | — | 0.01 | Mar 2, 2010 | SQL injection vulnerability in index.php in CommodityRentals Books/eBooks Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a gamecatalog action. | |||
| CVE-2010-0758 | 0.03 | — | 0.00 | Feb 27, 2010 | SQL injection vulnerability in news_desc.php in Softbiz Jobs allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2010-0753 | 0.03 | — | 0.01 | Feb 27, 2010 | SQL injection vulnerability in the SQL Reports (com_sqlreport) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter to ajax/print.php. NOTE: some of these details are obtained from third party information. | |||
| CVE-2010-0724 | 0.03 | — | 0.01 | Feb 26, 2010 | SQL injection vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2010-0723 | 0.03 | — | 0.02 | Feb 26, 2010 | SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2010-0722 | 0.03 | — | 0.00 | Feb 26, 2010 | SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2010-0721 | 0.03 | — | 0.01 | Feb 26, 2010 | SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2010-0720 | 0.03 | — | 0.01 | Feb 26, 2010 | SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2010-0712 | 0.03 | — | 0.01 | Feb 26, 2010 | Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters. | |||
| CVE-2010-0702 | 0.03 | — | 0.01 | Feb 23, 2010 | SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter. | |||
| CVE-2010-0701 | 0.03 | — | 0.01 | Feb 23, 2010 | SQL injection vulnerability in ForceChangePassword.jsp in Newgen Software OmniDocs allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | |||
| CVE-2010-0698 | 0.03 | — | 0.00 | Feb 23, 2010 | SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: some of these details are obtained from third party information. |
- CVE-2010-0803Mar 2, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in the jVideoDirect (com_jvideodirect) component 1.1 RC3b for Joomla! allows remote attackers to execute arbitrary SQL commands via the v parameter to index.php.
- CVE-2010-0802Mar 2, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in index.php in (nv2) Awards 1.1.0, a modification for Invision Power Board, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action.
- CVE-2010-0800Mar 2, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in the Ossolution Team Documents Seller (aka DMS) (com_dms) component 2.5.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter in a view_category action to index.php.
- CVE-2010-0796Mar 2, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in the JE Quiz (com_jequizmanagement) component 1.b01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the eid parameter in a question action to index.php.
- CVE-2010-0795Mar 2, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in the JE Event Calendars (com_jeeventcalendar) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the event_id parameter in an event action to index.php.
- CVE-2010-0764Mar 2, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in index.php in KuwaitPHP eSmile allows remote attackers to execute arbitrary SQL commands via the cid parameter in a show action.
- CVE-2010-0763Mar 2, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in index.php in CommodityRentals Vacation Rental Software allows remote attackers to execute arbitrary SQL commands via the rental_id parameter in a CalendarView action.
- CVE-2010-0762Mar 2, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in CommodityRentals CD Rental Software allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action.
- CVE-2010-0761Mar 2, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in CommodityRentals Books/eBooks Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a gamecatalog action.
- CVE-2010-0758Feb 27, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in news_desc.php in Softbiz Jobs allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2010-0753Feb 27, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in the SQL Reports (com_sqlreport) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the user_id parameter to ajax/print.php. NOTE: some of these details are obtained from third party information.
- CVE-2010-0724Feb 26, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2010-0723Feb 26, 2010risk 0.03cvss —epss 0.02
SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2010-0722Feb 26, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2010-0721Feb 26, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2010-0720Feb 26, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2010-0712Feb 26, 2010risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.
- CVE-2010-0702Feb 23, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
- CVE-2010-0701Feb 23, 2010risk 0.03cvss —epss 0.01
SQL injection vulnerability in ForceChangePassword.jsp in Newgen Software OmniDocs allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- CVE-2010-0698Feb 23, 2010risk 0.03cvss —epss 0.00
SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitrary SQL commands via the Password parameter. NOTE: some of these details are obtained from third party information.