CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,200)
page 951 of 1,010| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-17197 | Cri | 0.00 | 9.8 | 0.01 | Oct 5, 2019 | OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. | ||
| CVE-2019-15533 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | XENFCoreSharp before 2019-07-16 allows SQL injection in web/verify.php. | ||
| CVE-2019-15558 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResolver.java. | ||
| CVE-2019-15557 | Cri | 0.00 | 9.8 | 0.02 | Aug 26, 2019 | XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key. | ||
| CVE-2019-15555 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php. | ||
| CVE-2019-15560 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js. | ||
| CVE-2019-15559 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | DianoxDragon Hawn before 2019-07-10 allows SQL injection. | ||
| CVE-2019-15571 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php. | ||
| CVE-2019-15569 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java. | ||
| CVE-2019-15568 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels. | ||
| CVE-2019-15567 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature. | ||
| CVE-2019-15566 | Cri | 0.00 | 9.8 | 0.02 | Aug 26, 2019 | The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java. | ||
| CVE-2019-15565 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php. | ||
| CVE-2019-15564 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py. | ||
| CVE-2019-15562 | Cri | 0.00 | 9.8 | 0.02 | Aug 26, 2019 | GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm | ||
| CVE-2019-15561 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js. | ||
| CVE-2019-15534 | Cri | 0.00 | 9.8 | 0.01 | Aug 26, 2019 | Raml-Module-Builder 26.4.0 allows SQL Injection in PostgresClient.update. | ||
| CVE-2019-15537 | Cri | 0.00 | 9.8 | 0.02 | Aug 23, 2019 | The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php. | ||
| CVE-2019-15536 | Cri | 0.00 | 9.8 | 0.01 | Aug 23, 2019 | The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records. | ||
| CVE-2019-13578 | Cri | 0.00 | 9.8 | 0.03 | Aug 15, 2019 | A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php. |
- risk 0.00cvss 9.8epss 0.01
OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc.
- risk 0.00cvss 9.8epss 0.01
XENFCoreSharp before 2019-07-16 allows SQL injection in web/verify.php.
- risk 0.00cvss 9.8epss 0.01
XM^online 2 Common Utils and Endpoints 0.2.1 allows SQL injection, related to Constants.java, DropSchemaResolver.java, and SchemaChangeResolver.java.
- risk 0.00cvss 9.8epss 0.02
XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key.
- risk 0.00cvss 9.8epss 0.01
FredReinink Wellness-app before 2019-06-19 allows SQL injection, related to dietTrack.php, exerciseGenerator.php, fitnessTrack.php, and server.php.
- risk 0.00cvss 9.8epss 0.01
The Reviews Module before 2019-06-14 for OpenSource Table allows SQL injection in database/index.js.
- risk 0.00cvss 9.8epss 0.01
DianoxDragon Hawn before 2019-07-10 allows SQL injection.
- risk 0.00cvss 9.8epss 0.01
The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.
- risk 0.00cvss 9.8epss 0.01
HM Courts & Tribunals ccd-data-store-api before 2019-06-10 allows SQL injection, related to SearchQueryFactoryOperation.java and SortDirection.java.
- risk 0.00cvss 9.8epss 0.01
idseq-web before 2019-07-01 in Infectious Disease Sequencing Platform IDseq allows SQL injection via tax_levels.
- risk 0.00cvss 9.8epss 0.01
OpenForis Arena before 2019-05-07 allows SQL injection in the sorting feature.
- risk 0.00cvss 9.8epss 0.02
The Alfresco application before 1.8.7 for Android allows SQL injection in HistorySearchProvider.java.
- risk 0.00cvss 9.8epss 0.01
The ICOMMKT connector before 1.0.7 for PrestaShop allows SQL injection in icommktconnector.php.
- risk 0.00cvss 9.8epss 0.01
The Compassion Switzerland addons 10.01.4 for Odoo allow SQL injection in models/partner_compassion.py.
- risk 0.00cvss 9.8epss 0.02
GORM before 1.9.10 allows SQL injection via incomplete parentheses. NOTE: Misusing Gorm by passing untrusted user input where Gorm expects trusted SQL fragments is a vulnerability in the application, not in Gorm
- risk 0.00cvss 9.8epss 0.01
FlashLingo before 2019-06-12 allows SQL injection, related to flashlingo.js and db.js.
- risk 0.00cvss 9.8epss 0.01
Raml-Module-Builder 26.4.0 allows SQL Injection in PostgresClient.update.
- risk 0.00cvss 9.8epss 0.02
The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.
- risk 0.00cvss 9.8epss 0.01
The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.
- risk 0.00cvss 9.8epss 0.03
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.