CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,861)
page 545 of 1,044| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-38303 | Hig | 0.47 | 7.2 | 0.01 | Sep 12, 2022 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /employees/manage_leave_type.php. | ||
| CVE-2022-38302 | Hig | 0.47 | 7.2 | 0.01 | Sep 12, 2022 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_department.php. | ||
| CVE-2022-38610 | Hig | 0.47 | 7.2 | 0.01 | Sep 12, 2022 | Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editclient.php. | ||
| CVE-2022-38606 | Hig | 0.47 | 7.2 | 0.01 | Sep 12, 2022 | Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editcategory.php. | ||
| CVE-2022-38605 | Hig | 0.47 | 7.2 | 0.01 | Sep 12, 2022 | Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_event.php. | ||
| CVE-2022-38286 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list. | ||
| CVE-2022-38285 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list. | ||
| CVE-2022-38284 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list. | ||
| CVE-2022-38283 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list. | ||
| CVE-2022-38282 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list. | ||
| CVE-2022-38281 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list. | ||
| CVE-2022-38280 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list. | ||
| CVE-2022-38279 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list. | ||
| CVE-2022-38278 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list. | ||
| CVE-2022-38277 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list. | ||
| CVE-2022-38276 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list. | ||
| CVE-2022-38275 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list. | ||
| CVE-2022-38274 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list. | ||
| CVE-2022-38273 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve. | ||
| CVE-2022-38272 | Hig | 0.47 | 7.2 | 0.01 | Sep 9, 2022 | JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list. |
- risk 0.47cvss 7.2epss 0.01
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /employees/manage_leave_type.php.
- risk 0.47cvss 7.2epss 0.01
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_department.php.
- risk 0.47cvss 7.2epss 0.01
Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editclient.php.
- risk 0.47cvss 7.2epss 0.01
Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editcategory.php.
- risk 0.47cvss 7.2epss 0.01
Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_event.php.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.
- risk 0.47cvss 7.2epss 0.01
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.