VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,424)

page 728 of 1,022
  • CVE-2024-12473MedJan 10, 2025
    WordPress
    AI Scribe
    risk 0.35cvss 6.5epss 0.01

    The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPress is vulnerable to SQL Injection via the 'template_id' parameter of the 'article_builder_generate_data' shortcode in…

  • CVE-2024-12067MedJan 9, 2025
    WordPress
    Wp Travel
    risk 0.35cvss 6.5epss 0.00

    The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'booking_itinerary' parameter of the 'wptravel_get_booking_data' function in all versions up to, and including, 10.0.0 due to insufficient…

  • CVE-2024-12332MedJan 7, 2025
    WordPress
    Wpschoolpress
    risk 0.35cvss 6.5epss 0.00

    The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing…

  • CVE-2024-12195MedJan 4, 2025
    WordPress
    Wp Project Manager
    risk 0.35cvss 6.5epss 0.00

    The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to,…

  • CVE-2024-12032MedDec 25, 2024
    WordPress
    Tourfic
    risk 0.35cvss 6.5epss 0.01

    The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiry_id' parameter of the 'tf_enquiry_reply_email_callback' function in all versions up to, and…

  • CVE-2024-11726MedDec 24, 2024
    WordPress
    Bookingpress
    risk 0.35cvss 6.5epss 0.00

    The Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress plugin for WordPress is vulnerable to SQL Injection via the 'category' parameter of the 'bookingpress_form' shortcode in all versions up to, and including, 1.1.21 due to insufficient escaping on the…

  • CVE-2024-12635MedDec 21, 2024
    WordPress
    Wp Docs
    risk 0.35cvss 6.5epss 0.00

    The WP Docs plugin for WordPress is vulnerable to time-based SQL Injection via the 'dir_id' parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes…

  • CVE-2024-12406MedDec 12, 2024
    WordPress
    Library Management System
    risk 0.35cvss 6.5epss 0.00

    The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the 'owt7_borrow_books_id' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of…

  • CVE-2024-11430MedDec 12, 2024
    WordPress
    SQL Chart Builder
    risk 0.35cvss 6.5epss 0.01

    The SQL Chart Builder plugin for WordPress is vulnerable to SQL Injection via the 'arg1' arg of the 'gvn_schart_2' shortcode in all versions up to, and including, 2.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing…

  • CVE-2024-11729MedDec 6, 2024
    WordPress
    KiviCare
    risk 0.35cvss 6.5epss 0.01

    The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of the get_widget_payment_options AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on…

  • CVE-2024-53364MedDec 2, 2024
    Phpgurukul
    Vehicle Parking Management System
    risk 0.35cvss 5.4epss 0.00

    A SQL injection vulnerability was found in PHPGURUKUL Vehicle Parking Management System v1.13 in /users/view-detail.php. This vulnerability affects the viewid parameter, where improper input sanitization allows attackers to inject malicious SQL queries.

  • CVE-2024-11025MedNov 27, 2024
    risk 0.35cvss 5.4epss 0.00

    An authenticated attacker with low privileges may use a SQL Injection vulnerability in the affected products administration panel to gain read and write access to a specific log file of the device.

  • CVE-2024-45875MedNov 13, 2024
    baltic-it
    TOPqw Webportal
    risk 0.35cvss 5.4epss 0.00

    The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to SQL injection. The JSON object username allows the manipulation of SQL queries.

  • CVE-2024-7857MedAug 29, 2024
    WordPress
    Media Library Folders
    risk 0.35cvss 6.5epss 0.00

    The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions up to, and including, 8.2.2 due to insufficient escaping on the user supplied parameter and lack of…

  • CVE-2024-41944MedJul 30, 2024
    Xibosignage
    Xibocms
    risk 0.35cvss 6.5epss 0.00

    Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route inside the CMS. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially…

  • CVE-2024-39909MedJul 12, 2024
    Openclarity
    Kubeclarity
    risk 0.35cvss 6.5epss 0.00

    KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems. A time/boolean SQL Injection is present in the following resource `/api/applicationResources` via the following parameter `packageID`.…

  • CVE-2024-4742MedJun 20, 2024
    WordPress
    Youzify
    risk 0.35cvss 6.5epss 0.01

    The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the order_by shortcode attribute in all versions up to, and including, 1.2.5 due to insufficient escaping on the user…

  • CVE-2024-37799MedJun 18, 2024
    Code Projects
    Restaurant Reservation System
    risk 0.35cvss 5.4epss 0.00

    CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_reservations.php.

  • CVE-2024-29169MedJun 13, 2024
    Dell
    Secure Connect Gateway
    risk 0.35cvss 5.4epss 0.00

    Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal audit REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend…

  • CVE-2024-29168MedJun 13, 2024
    Dell
    Secure Connect Gateway
    risk 0.35cvss 5.4epss 0.00

    Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal assets REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's…