CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,295)
page 848 of 1,015| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2008-6320 | 0.03 | — | 0.01 | Feb 27, 2009 | SQL injection vulnerability in index.cfm in CF Shopkart 5.2.2 allows remote attackers to execute arbitrary SQL commands via the Category parameter in a ViewCategory action. | |||
| CVE-2008-6319 | 0.03 | — | 0.01 | Feb 27, 2009 | SQL injection vulnerability in calendarevent.cfm in CF_Calendar allows remote attackers to execute arbitrary SQL commands via the calid parameter. | |||
| CVE-2008-6314 | 0.03 | — | 0.01 | Feb 27, 2009 | SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action. | |||
| CVE-2008-6312 | 0.03 | — | 0.01 | Feb 27, 2009 | SQL injection vulnerability in index.php in ProQuiz 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter. | |||
| CVE-2008-6311 | 0.03 | — | 0.01 | Feb 27, 2009 | SQL injection vulnerability in view.php in Butterfly Organizer 2.0.1 allows remote attackers to execute arbitrary SQL commands via the mytable parameter. NOTE: the id vector is covered by another CVE name. | |||
| CVE-2008-6310 | — | 0.03 | — | 0.01 | Feb 27, 2009 | SQL injection vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to execute arbitrary SQL commands via the f[password] parameter. NOTE: some of these details are obtained from third party information. | ||
| CVE-2008-6309 | — | 0.03 | — | 0.01 | Feb 27, 2009 | SQL injection vulnerability in index.php in W3matter AskPert allows remote attackers to execute arbitrary SQL commands via the f[password] parameter. NOTE: some of these details are obtained from third party information. | ||
| CVE-2008-6303 | 0.03 | — | 0.01 | Feb 26, 2009 | SQL injection vulnerability in tourview.php in ToursManager allows remote attackers to execute arbitrary SQL commands via the tourid parameter. | |||
| CVE-2008-6301 | 0.03 | — | 0.01 | Feb 26, 2009 | SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action. | |||
| CVE-2008-6289 | 0.03 | — | 0.01 | Feb 26, 2009 | SQL injection vulnerability in cityview.php in Tours Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the cityid parameter. | |||
| CVE-2008-6286 | 0.03 | — | 0.01 | Feb 25, 2009 | Multiple SQL injection vulnerabilities in SubscriberStart.asp in Active Newsletter 4.3 allow remote attackers to execute arbitrary SQL commands via (1) the email parameter (aka username or E-mail field), or (2) the password parameter (aka password field), to (a) Subscriber.asp… | |||
| CVE-2008-6285 | 0.03 | — | 0.01 | Feb 25, 2009 | SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the mid parameter. | |||
| CVE-2008-6284 | 0.03 | — | 0.01 | Feb 25, 2009 | SQL injection vulnerability in edit.php in Z1Exchange 1.0 allows remote attackers to execute arbitrary SQL commands via the site parameter. | |||
| CVE-2008-6282 | 0.03 | — | 0.02 | Feb 25, 2009 | SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the city parameter in a users_edit_pub action to index.php. | |||
| CVE-2008-6281 | 0.03 | — | 0.01 | Feb 25, 2009 | SQL injection vulnerability in index.php in Bluo CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |||
| CVE-2008-6277 | 0.03 | — | 0.01 | Feb 25, 2009 | SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to execute arbitrary SQL commands via the subcategory_id parameter. | |||
| CVE-2008-6274 | 0.03 | — | 0.01 | Feb 25, 2009 | Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the logmbr parameter (aka login field) or (2) the mdpmbr parameter (aka pass or "Mot de passe" field). NOTE: some of these details are… | |||
| CVE-2009-0741 | 0.03 | — | 0.01 | Feb 25, 2009 | SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter. | |||
| CVE-2009-0740 | 0.03 | — | 0.01 | Feb 25, 2009 | SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters. | |||
| CVE-2009-0739 | 0.03 | — | 0.01 | Feb 25, 2009 | SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters. |
- CVE-2008-6320Feb 27, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.cfm in CF Shopkart 5.2.2 allows remote attackers to execute arbitrary SQL commands via the Category parameter in a ViewCategory action.
- CVE-2008-6319Feb 27, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in calendarevent.cfm in CF_Calendar allows remote attackers to execute arbitrary SQL commands via the calid parameter.
- CVE-2008-6314Feb 27, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in tag_board.php in the Tag Board module 4.0 and earlier for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action.
- CVE-2008-6312Feb 27, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in ProQuiz 1.0 allows remote attackers to execute arbitrary SQL commands via the username parameter.
- CVE-2008-6311Feb 27, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in view.php in Butterfly Organizer 2.0.1 allows remote attackers to execute arbitrary SQL commands via the mytable parameter. NOTE: the id vector is covered by another CVE name.
- CVE-2008-6310Feb 27, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in W3matter RevSense 1.0 allows remote attackers to execute arbitrary SQL commands via the f[password] parameter. NOTE: some of these details are obtained from third party information.
- CVE-2008-6309Feb 27, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in W3matter AskPert allows remote attackers to execute arbitrary SQL commands via the f[password] parameter. NOTE: some of these details are obtained from third party information.
- CVE-2008-6303Feb 26, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in tourview.php in ToursManager allows remote attackers to execute arbitrary SQL commands via the tourid parameter.
- CVE-2008-6301Feb 26, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in shoutbox_view.php in the Small ShoutBox module 1.4 for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter in a delete action.
- CVE-2008-6289Feb 26, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in cityview.php in Tours Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the cityid parameter.
- CVE-2008-6286Feb 25, 2009risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in SubscriberStart.asp in Active Newsletter 4.3 allow remote attackers to execute arbitrary SQL commands via (1) the email parameter (aka username or E-mail field), or (2) the password parameter (aka password field), to (a) Subscriber.asp…
- CVE-2008-6285Feb 25, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in PHP TV Portal 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the mid parameter.
- CVE-2008-6284Feb 25, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in edit.php in Z1Exchange 1.0 allows remote attackers to execute arbitrary SQL commands via the site parameter.
- CVE-2008-6282Feb 25, 2009risk 0.03cvss —epss 0.02
SQL injection vulnerability in engine/users/users_edit_pub.inc in CMS Ortus 1.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the city parameter in a users_edit_pub action to index.php.
- CVE-2008-6281Feb 25, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in index.php in Bluo CMS 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
- CVE-2008-6277Feb 25, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in product.php in RakhiSoftware Price Comparison Script (aka Shopping Cart) allows remote attackers to execute arbitrary SQL commands via the subcategory_id parameter.
- CVE-2008-6274Feb 25, 2009risk 0.03cvss —epss 0.01
Multiple SQL injection vulnerabilities in index.php in FamilyProject 2.0 allow remote attackers to execute arbitrary SQL commands via (1) the logmbr parameter (aka login field) or (2) the mdpmbr parameter (aka pass or "Mot de passe" field). NOTE: some of these details are…
- CVE-2009-0741Feb 25, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in Login.asp in Craft Silicon Banking@Home 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the LoginName parameter.
- CVE-2009-0740Feb 25, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.
- CVE-2009-0739Feb 25, 2009risk 0.03cvss —epss 0.01
SQL injection vulnerability in login.php in MyNews 0.10 allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) passwd parameters.