İçeriğe atla
Noroxi

CWE-89 · 17.346 kayıt

SQL enjeksiyonu

Neden olur?

Sorgu metni, kullanıcı girdisiyle birleştirilerek oluşturuluyor. Veritabanı, verinin nerede bitip komutun nerede başladığını ayırt edemez.

Hatalı ve düzeltilmiş kod

Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.

Hatalı

ts
const owner = req.query.owner;const rows = await db.query(  "SELECT * FROM files WHERE owner = '" + owner + "'");

Düzeltilmiş

ts
const owner = req.query.owner;const rows = await db.query(  "SELECT * FROM files WHERE owner = $1",  [owner]);

Nasıl önlenir?

  1. 01Her sorguda parametreli sorgu ya da güvenilir bir ORM kullanın.
  2. 02Veritabanı hesabına yalnızca gereken tablolarda yetki verin.
  3. 03Dinamik sütun ya da sıralama adlarını izin listesiyle sınırlayın.

Bu sınıftaki CVE’ler

10.000 kayıt

  • CVE-2023-34362
    99Hemen

    In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    progress · moveit cloud2 Haz 2023

  • CVE-2025-25257
    99Hemen

    An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %100

    fortinet · fortiweb17 Tem 2025

  • CVE-2023-48788
    99Hemen

    A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98

    fortinet · forticlient enterprise management server12 Mar 2024

  • CVE-2019-12989
    97Hemen

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %95

    citrix · netscaler sd-wan16 Tem 2019

  • CVE-2026-21643
    97Hemen

    An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may a

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %94

    fortinet · forticlientems6 Şub 2026

  • CVE-2024-6670
    97Hemen

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    progress · whatsup gold29 Ağu 2024

  • CVE-2024-9465
    96Hemen

    Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

    KritikCVSS 9,2KEVSilahlaştırılmışEPSS %100

    paloaltonetworks · expedition9 Eki 2024

  • CVE-2020-17463
    96Hemen

    FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %90

    thedaylightstudio · fuel cms13 Ağu 2020

  • CVE-2025-57819
    96Hemen

    FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %85

    sangoma · freepbx28 Ağu 2025

  • CVE-2024-29824
    95Hemen

    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %100

    ivanti · endpoint manager31 May 2024

  • CVE-2017-18362
    95Hemen

    ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct ac

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %87

    connectwise · manageditsync5 Şub 2019

  • CVE-2020-5722
    94Hemen

    The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %84

    grandstream · ucm6200 firmware23 Mar 2020

  • CVE-2024-43468
    93Hemen

    Microsoft Configuration Manager Remote Code Execution Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %81

    microsoft · configuration manager 24038 Eki 2024

  • CVE-2021-42258
    91Hemen

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %74

    bqe · billquick web suite22 Eki 2021

  • CVE-2018-7841
    91Hemen

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an i

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %73

    schneider-electric · u.motion builder22 May 2019

  • CVE-2019-7481
    90Hemen

    Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %100

    sonicwall · sma 100 firmware17 Ara 2019

  • CVE-2016-2386
    90Hemen

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %72

    sap · netweaver application server java16 Şub 2016

  • CVE-2021-44026
    90Hemen

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %70

    roundcube · webmail19 Kas 2021

  • CVE-2020-12271
    82Hemen

    A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %42

    sophos · sfos27 Nis 2020

  • CVE-2021-20016
    81Hemen

    A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %40

    sonicwall · sma 100 firmware4 Şub 2021

  • CVE-2021-20028
    78Bu hafta

    Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, s

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %30

    sonicwall · sma 210 firmware4 Ağu 2021

  • CVE-2025-25181
    77Bu hafta

    A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %57

    advantive · veracore3 Şub 2025

  • CVE-2026-76461
    77Bu hafta

    Cisco Secure Email Gateway SQL Injection Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %28

    cisco · asyncos14 Eyl 2026

  • CVE-2026-72898
    76Bu hafta

    Metabase SQL injection via password reset endpoint

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %19

    metabase · metabase10 Ağu 2026

  • CVE-2026-9082
    74Bu hafta

    Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %16

    drupal · drupal20 May 2026

Tüm zafiyet sınıfları