CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,387)
page 799 of 1,020| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2010-5019 | 0.03 | — | 0.02 | Nov 2, 2011 | SQL injection vulnerability in view_photo.php in 2daybiz Online Classified Script allows remote attackers to execute arbitrary SQL commands via the alb parameter. | |||
| CVE-2010-5017 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in stats.php in Elite Gaming Ladders 3.0 allows remote attackers to execute arbitrary SQL commands via the account parameter. | |||
| CVE-2010-5016 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in matchdb.php in Elite Gaming Ladders 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the match parameter. | |||
| CVE-2010-5015 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in view_photo.php in 2daybiz Network Community Script allows remote attackers to execute arbitrary SQL commands via the alb parameter. | |||
| CVE-2010-5014 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in standings.php in Elite Gaming Ladders 3.5 allows remote attackers to execute arbitrary SQL commands via the ladder[id] parameter. | |||
| CVE-2010-5013 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows remote attackers to execute arbitrary SQL commands via the Lid parameter. | |||
| CVE-2010-5012 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information. | |||
| CVE-2010-5011 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to execute arbitrary SQL commands via the session parameter. | |||
| CVE-2010-5009 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter in a matchp action. | |||
| CVE-2010-5008 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in pages/contact_list_mail_form.asp in BrightSuite Groupware 5.4 allows remote attackers to execute arbitrary SQL commands via the ContactID parameter. | |||
| CVE-2010-5004 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in searchvote.php in 2daybiz Polls (aka Advanced Poll) Script allows remote attackers to execute arbitrary SQL commands via the category parameter. | |||
| CVE-2010-5000 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute arbitrary SQL commands via the myusername parameter (aka Username field) in a do_login action. NOTE: some of these details are obtained from third party… | |||
| CVE-2010-4997 | 0.03 | — | 0.01 | Nov 2, 2011 | SQL injection vulnerability in index.php in OlyKit Swoopo Clone 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter in a product action. | |||
| CVE-2010-5003 | 0.03 | — | 0.02 | Nov 1, 2011 | SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via the limit parameter in an autartimonial action to index.php. NOTE: some of these details are obtained from third party… | |||
| CVE-2010-5001 | 0.03 | — | 0.01 | Nov 1, 2011 | SQL injection vulnerability in view.php in esoftpro Online Contact Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2010-4999 | 0.03 | — | 0.01 | Nov 1, 2011 | SQL injection vulnerability in index.php in esoftpro Online Photo Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the section parameter. | |||
| CVE-2010-4996 | 0.03 | — | 0.01 | Nov 1, 2011 | SQL injection vulnerability in ogp_show.php in esoftpro Online Guestbook Pro 5.1 allows remote attackers to execute arbitrary SQL commands via the search parameter. | |||
| CVE-2010-4995 | 0.03 | — | 0.01 | Nov 1, 2011 | SQL injection vulnerability in the NeoRecruit (com_neorecruit) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in an offer_view action to index.php, a different vector than CVE-2007-4506. | |||
| CVE-2010-4993 | 0.03 | — | 0.01 | Nov 1, 2011 | SQL injection vulnerability in the eventcal (com_eventcal) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php. | |||
| CVE-2010-4992 | 0.03 | — | 0.01 | Nov 1, 2011 | SQL injection vulnerability in the Payments Plus component 2.1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the type parameter to add.html. |
- CVE-2010-5019Nov 2, 2011risk 0.03cvss —epss 0.02
SQL injection vulnerability in view_photo.php in 2daybiz Online Classified Script allows remote attackers to execute arbitrary SQL commands via the alb parameter.
- CVE-2010-5017Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in stats.php in Elite Gaming Ladders 3.0 allows remote attackers to execute arbitrary SQL commands via the account parameter.
- CVE-2010-5016Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in matchdb.php in Elite Gaming Ladders 3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the match parameter.
- CVE-2010-5015Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in view_photo.php in 2daybiz Network Community Script allows remote attackers to execute arbitrary SQL commands via the alb parameter.
- CVE-2010-5014Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in standings.php in Elite Gaming Ladders 3.5 allows remote attackers to execute arbitrary SQL commands via the ladder[id] parameter.
- CVE-2010-5013Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in listing_detail.asp in Mckenzie Creations Virtual Real Estate Manager (VRM) 3.5 allows remote attackers to execute arbitrary SQL commands via the Lid parameter.
- CVE-2010-5012Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in new.php in DaLogin 2.2 and 2.2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information.
- CVE-2010-5011Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in schoolmv2/html/studentmain.php in SchoolMation 2.3 allows remote attackers to execute arbitrary SQL commands via the session parameter.
- CVE-2010-5009Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in UTStats Beta 4 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter in a matchp action.
- CVE-2010-5008Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in pages/contact_list_mail_form.asp in BrightSuite Groupware 5.4 allows remote attackers to execute arbitrary SQL commands via the ContactID parameter.
- CVE-2010-5004Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in searchvote.php in 2daybiz Polls (aka Advanced Poll) Script allows remote attackers to execute arbitrary SQL commands via the category parameter.
- CVE-2010-5000Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in login/login_index.php in MCLogin System 1.1 and 1.2 allows remote attackers to execute arbitrary SQL commands via the myusername parameter (aka Username field) in a do_login action. NOTE: some of these details are obtained from third party…
- CVE-2010-4997Nov 2, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in OlyKit Swoopo Clone 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter in a product action.
- CVE-2010-5003Nov 1, 2011risk 0.03cvss —epss 0.02
SQL injection vulnerability in the AutarTimonial (com_autartimonial) component 1.0.8 for Joomla! allows remote attackers to execute arbitrary SQL commands via the limit parameter in an autartimonial action to index.php. NOTE: some of these details are obtained from third party…
- CVE-2010-5001Nov 1, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in view.php in esoftpro Online Contact Manager 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2010-4999Nov 1, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in esoftpro Online Photo Pro 2.0 allows remote attackers to execute arbitrary SQL commands via the section parameter.
- CVE-2010-4996Nov 1, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in ogp_show.php in esoftpro Online Guestbook Pro 5.1 allows remote attackers to execute arbitrary SQL commands via the search parameter.
- CVE-2010-4995Nov 1, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in the NeoRecruit (com_neorecruit) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter in an offer_view action to index.php, a different vector than CVE-2007-4506.
- CVE-2010-4993Nov 1, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in the eventcal (com_eventcal) component 1.6.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
- CVE-2010-4992Nov 1, 2011risk 0.03cvss —epss 0.01
SQL injection vulnerability in the Payments Plus component 2.1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the type parameter to add.html.