CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

CWE-943

Children

CWE-564

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (10,236)

page 30 of 512

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2023-4830	Turaconsulting Signalix	Cri	0.64	9.8	0.01	Sep 15, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection. This issue affects Signalix: 7T_0228.
CVE-2023-4673	Sanalogi Turasistan	Cri	0.64	9.8	0.01	Sep 15, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection. This issue affects Turasistan: before 20230911 .
CVE-2023-4766	Movus Movus	Cri	0.64	9.8	0.01	Sep 14, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection. This issue affects Movus: before 20230913.
CVE-2023-4832	Acekaholding Company Management	Cri	0.64	9.8	0.01	Sep 14, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aceka Company Management allows SQL Injection. This issue affects Company Management: before 3072 .
CVE-2023-42268	—	Cri	0.64	9.8	0.01	Sep 8, 2023	Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.
CVE-2023-4531	Mestav Software E Commerce Software	Cri	0.64	9.8	0.01	Sep 5, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .
CVE-2023-4034	Digita Information Technology Smartrise Document Management System	Cri	0.64	9.8	0.01	Sep 5, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection. This issue affects Smartrise Document Management System: before Hvl-2.0.
CVE-2023-3616	Mava Software Hotel Management System	Cri	0.64	9.8	0.01	Sep 5, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection. This issue affects Hotel Management System: before 2.0.
CVE-2023-35072	Coyav Travel Proagent	Cri	0.64	9.8	0.01	Sep 5, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection. This issue affects Proagent: before 20230904 .
CVE-2023-35068	BMA Personnel Tracking System	Cri	0.64	9.8	0.01	Sep 5, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection. This issue affects Personnel Tracking System: before 20230904.
CVE-2023-35065	Osoft Paint Production Management	Cri	0.64	9.8	0.01	Sep 5, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection. This issue affects Paint Production Management: before 2.1.
CVE-2023-3522	—	Cri	0.64	9.8	0.01	Aug 8, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection. This issue affects License Portal System: before 1.48.
CVE-2023-3386	A2 Camera Trap Tracking System	Cri	0.64	9.8	0.01	Aug 8, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905.
CVE-2023-3651	Digital Ant Digital Ant	Cri	0.64	9.8	0.01	Aug 8, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 11.
CVE-2023-3716	Oduyo Online Collection	Cri	0.64	9.8	0.01	Aug 8, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Online Collection Software allows SQL Injection. This issue affects Online Collection Software: before 1.0.1.
CVE-2023-3717	Farmakom Remote Administration Console	Cri	0.64	9.8	0.01	Aug 8, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farmakom Remote Administration Console allows SQL Injection. This issue affects Remote Administration Console: before 1.02.
CVE-2023-3898	Mayanets E Commerce	Cri	0.64	9.8	0.01	Aug 8, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 1.1.
CVE-2023-35066	Infodrom Software E-Invoice Approval System	Cri	0.64	9.8	0.01	Jul 25, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL Injection. This issue affects E-Invoice Approval System: before v.20230701.
CVE-2023-3046	Biltay Technology Scienta	Cri	0.64	9.8	0.01	Jul 25, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Scienta allows SQL Injection. This issue affects Scienta: before 20230630.1953.
CVE-2023-3376	Digital Strategy Zekiweb	Cri	0.64	9.8	0.01	Jul 17, 2023	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection. This issue affects Zekiweb: before 2.

CVE-2023-4830CriSep 15, 2023
Turaconsulting
Signalix
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection. This issue affects Signalix: 7T_0228.
CVE-2023-4673CriSep 15, 2023
Sanalogi
Turasistan
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sanalogy Turasistan allows SQL Injection. This issue affects Turasistan: before 20230911 .
CVE-2023-4766CriSep 14, 2023
Movus
Movus
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection. This issue affects Movus: before 20230913.
CVE-2023-4832CriSep 14, 2023
Acekaholding
Company Management
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aceka Company Management allows SQL Injection. This issue affects Company Management: before 3072 .
CVE-2023-42268CriSep 8, 2023
risk 0.64cvss 9.8epss 0.01
Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.
CVE-2023-4531CriSep 5, 2023
Mestav Software
E Commerce Software
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .
CVE-2023-4034CriSep 5, 2023
Digita Information Technology
Smartrise Document Management System
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection. This issue affects Smartrise Document Management System: before Hvl-2.0.
CVE-2023-3616CriSep 5, 2023
Mava Software
Hotel Management System
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection. This issue affects Hotel Management System: before 2.0.
CVE-2023-35072CriSep 5, 2023
Coyav Travel
Proagent
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection. This issue affects Proagent: before 20230904 .
CVE-2023-35068CriSep 5, 2023
BMA
Personnel Tracking System
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection. This issue affects Personnel Tracking System: before 20230904.
CVE-2023-35065CriSep 5, 2023
Osoft
Paint Production Management
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection. This issue affects Paint Production Management: before 2.1.
CVE-2023-3522CriAug 8, 2023
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection. This issue affects License Portal System: before 1.48.
CVE-2023-3386CriAug 8, 2023
A2
Camera Trap Tracking System
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905.
CVE-2023-3651CriAug 8, 2023
Digital Ant
Digital Ant
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Ant E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 11.
CVE-2023-3716CriAug 8, 2023
Oduyo
Online Collection
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Online Collection Software allows SQL Injection. This issue affects Online Collection Software: before 1.0.1.
CVE-2023-3717CriAug 8, 2023
Farmakom
Remote Administration Console
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farmakom Remote Administration Console allows SQL Injection. This issue affects Remote Administration Console: before 1.02.
CVE-2023-3898CriAug 8, 2023
Mayanets
E Commerce
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mAyaNet E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: before 1.1.
CVE-2023-35066CriJul 25, 2023
Infodrom Software
E-Invoice Approval System
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infodrom Software E-Invoice Approval System allows SQL Injection. This issue affects E-Invoice Approval System: before v.20230701.
CVE-2023-3046CriJul 25, 2023
Biltay Technology
Scienta
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Scienta allows SQL Injection. This issue affects Scienta: before 20230630.1953.
CVE-2023-3376CriJul 17, 2023
Digital Strategy
Zekiweb
risk 0.64cvss 9.8epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection. This issue affects Zekiweb: before 2.