CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,200)
page 934 of 1,010| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-9272 | Hig | 0.00 | 8.1 | 0.00 | Jul 2, 2026 | In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to… | ||
| CVE-2026-56841 | Hig | 0.00 | 8.8 | 0.00 | Jul 2, 2026 | A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device. | ||
| CVE-2026-54404 | Hig | 0.00 | 8.8 | 0.00 | Jul 2, 2026 | A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances. | ||
| CVE-2026-50747 | Cri | 0.00 | 9.9 | 0.00 | Jul 2, 2026 | A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device. | ||
| CVE-2026-57765 | Hig | 0.00 | 8.5 | 0.00 | Jul 2, 2026 | Contributor SQL Injection in WP EasyCart <= 5.9.0 versions. | ||
| CVE-2026-57756 | Hig | 0.00 | 8.5 | 0.00 | Jul 2, 2026 | Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions. | ||
| CVE-2026-57752 | Hig | 0.00 | 8.5 | 0.00 | Jul 2, 2026 | Contributor SQL Injection in iNET Webkit 1.2.4 versions. | ||
| CVE-2026-57687 | Hig | 0.00 | 8.5 | 0.00 | Jul 2, 2026 | Contributor SQL Injection in Custom Field Template <= 2.7.8 versions. | ||
| CVE-2026-57683 | Cri | 0.00 | 9.3 | 0.00 | Jul 2, 2026 | Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions. | ||
| CVE-2026-57679 | Cri | 0.00 | 9.3 | 0.00 | Jul 2, 2026 | Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions. | ||
| CVE-2025-69094 | Hig | 0.00 | 8.5 | 0.00 | Jul 2, 2026 | Subscriber SQL Injection in Unicamp <= 2.2.2 versions. | ||
| CVE-2026-8441 | Hig | 0.00 | 7.5 | 0.00 | Jul 2, 2026 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field()… | ||
| CVE-2026-14029 | Med | 0.00 | 6.5 | 0.00 | Jul 2, 2026 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient… | ||
| CVE-2026-13357 | Med | 0.00 | 4.9 | 0.00 | Jul 2, 2026 | The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the… | ||
| CVE-2026-52186 | Cri | 0.00 | 9.8 | 0.01 | Jul 1, 2026 | SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component | ||
| CVE-2026-58521 | Cri | 0.00 | 9.8 | 0.00 | Jul 1, 2026 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. | ||
| CVE-2026-51946 | Med | 0.00 | 6.5 | 0.00 | Jul 1, 2026 | SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints | ||
| CVE-2026-34105 | Cri | 0.00 | 9.8 | 0.00 | Jul 1, 2026 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract… | ||
| CVE-2026-34104 | Cri | 0.00 | 9.8 | 0.00 | Jul 1, 2026 | Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\".$_GET['name'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents. | ||
| CVE-2026-34103 | Cri | 0.00 | 9.8 | 0.00 | Jul 1, 2026 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract… |
- risk 0.00cvss 8.1epss 0.00
In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to…
- risk 0.00cvss 8.8epss 0.00
A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerability found in UniFi Protect Application to escalate privileges on the host device.
- risk 0.00cvss 8.8epss 0.00
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi OS to escalate privileges within such UniFi OS devices or instances.
- risk 0.00cvss 9.9epss 0.00
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in WP EasyCart <= 5.9.0 versions.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in nicen-localize-image <= 1.4.9 versions.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in iNET Webkit 1.2.4 versions.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in Custom Field Template <= 2.7.8 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions.
- risk 0.00cvss 8.5epss 0.00
Subscriber SQL Injection in Unicamp <= 2.2.2 versions.
- risk 0.00cvss 7.5epss 0.00
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field()…
- risk 0.00cvss 6.5epss 0.00
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient…
- risk 0.00cvss 4.9epss 0.00
The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the…
- risk 0.00cvss 9.8epss 0.01
SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component
- risk 0.00cvss 9.8epss 0.00
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
- risk 0.00cvss 6.5epss 0.00
SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type URL parameter on all /admin/info/{table} endpoints
- risk 0.00cvss 9.8epss 0.00
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line 15): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract…
- risk 0.00cvss 9.8epss 0.00
Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124): SELECT * FROM complex WHERE name='\".$_GET['name'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.
- risk 0.00cvss 9.8epss 0.00
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract…