CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,861)
page 543 of 1,044| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-41378 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2022 | Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/manage_inventory. | ||
| CVE-2022-41377 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2022 | Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=maintenance/manage_category. | ||
| CVE-2022-41515 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2022 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_payment. | ||
| CVE-2022-41514 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2022 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_loan. | ||
| CVE-2022-41513 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2022 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php. | ||
| CVE-2022-41355 | Hig | 0.47 | 7.2 | 0.01 | Oct 6, 2022 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /leave_system/classes/Master.php?f=delete_department. | ||
| CVE-2022-42250 | Hig | 0.47 | 7.2 | 0.01 | Oct 6, 2022 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=. | ||
| CVE-2022-42249 | Hig | 0.47 | 7.2 | 0.01 | Oct 6, 2022 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=. | ||
| CVE-2022-42243 | Hig | 0.47 | 7.2 | 0.01 | Oct 6, 2022 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=. | ||
| CVE-2022-42242 | Hig | 0.47 | 7.2 | 0.01 | Oct 6, 2022 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking. | ||
| CVE-2022-42241 | Hig | 0.47 | 7.2 | 0.01 | Oct 6, 2022 | Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message. | ||
| CVE-2022-41440 | Hig | 0.47 | 7.2 | 0.01 | Sep 30, 2022 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php. | ||
| CVE-2022-41439 | Hig | 0.47 | 7.2 | 0.01 | Sep 30, 2022 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php. | ||
| CVE-2022-40354 | Hig | 0.47 | 7.2 | 0.01 | Sep 27, 2022 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php. | ||
| CVE-2022-40353 | Hig | 0.47 | 7.2 | 0.01 | Sep 27, 2022 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php. | ||
| CVE-2022-40352 | Hig | 0.47 | 7.2 | 0.01 | Sep 27, 2022 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php. | ||
| CVE-2022-40099 | Hig | 0.47 | 7.2 | 0.01 | Sep 26, 2022 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense_category.php. | ||
| CVE-2022-40098 | Hig | 0.47 | 7.2 | 0.01 | Sep 26, 2022 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense.php. | ||
| CVE-2022-40097 | Hig | 0.47 | 7.2 | 0.01 | Sep 26, 2022 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_currency.php. | ||
| CVE-2022-40928 | Hig | 0.47 | 7.2 | 0.01 | Sep 26, 2022 | Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application. |
- risk 0.47cvss 7.2epss 0.01
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/manage_inventory.
- risk 0.47cvss 7.2epss 0.01
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=maintenance/manage_category.
- risk 0.47cvss 7.2epss 0.01
Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_payment.
- risk 0.47cvss 7.2epss 0.01
Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_loan.
- risk 0.47cvss 7.2epss 0.01
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php.
- risk 0.47cvss 7.2epss 0.01
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /leave_system/classes/Master.php?f=delete_department.
- risk 0.47cvss 7.2epss 0.01
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=.
- risk 0.47cvss 7.2epss 0.01
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=.
- risk 0.47cvss 7.2epss 0.01
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=.
- risk 0.47cvss 7.2epss 0.01
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking.
- risk 0.47cvss 7.2epss 0.01
Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message.
- risk 0.47cvss 7.2epss 0.01
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.
- risk 0.47cvss 7.2epss 0.01
Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.
- risk 0.47cvss 7.2epss 0.01
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_booking.php.
- risk 0.47cvss 7.2epss 0.01
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/up_booking.php.
- risk 0.47cvss 7.2epss 0.01
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_traveller.php.
- risk 0.47cvss 7.2epss 0.01
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense_category.php.
- risk 0.47cvss 7.2epss 0.01
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense.php.
- risk 0.47cvss 7.2epss 0.01
Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_currency.php.
- risk 0.47cvss 7.2epss 0.01
Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application.