CWE-89 · 17.923 kayıt
SQL enjeksiyonu
Neden olur?
Sorgu metni, kullanıcı girdisiyle birleştirilerek oluşturuluyor. Veritabanı, verinin nerede bitip komutun nerede başladığını ayırt edemez.
Nasıl önlenir?
- 01Her sorguda parametreli sorgu ya da güvenilir bir ORM kullanın.
- 02Veritabanı hesabına yalnızca gereken tablolarda yetki verin.
- 03Dinamik sütun ya da sıralama adlarını izin listesiyle sınırlayın.
Hatalı ve düzeltilmiş kod
Temsili ders örneği. Vurgulu satırlar hatanın ve düzeltmenin yeridir.
Hatalı
const owner = req.query.owner;
const rows = await db.query(
"SELECT * FROM files WHERE owner = '" + owner + "'"
);Düzeltilmiş
const owner = req.query.owner;
const rows = await db.query(
"SELECT * FROM files WHERE owner = $1",
[owner]
);Kodunuzda bu kalıp var mı?
Web ve API sızma testi kapsamında bu sınıfı özellikle arıyoruz. Bulgular satır numarasıyla teslim edilir.
Bu sınıftaki CVE’ler
10.000 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
99Hemen | CVE-2023-34362Silahlaştırılmış | In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL progress · moveit cloud · CWE-89 | Kritik9,8 | KEV | %99,9 | 2 Haz 2023 |
99Hemen | CVE-2025-25257Silahlaştırılmış | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet Forfortinet · fortiweb · CWE-89 | Kritik9,8 | KEV | %99,9 | 17 Tem 2025 |
99Hemen | CVE-2023-48788Silahlaştırılmış | A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.fortinet · forticlient enterprise management server · CWE-89 | Kritik9,8 | KEV | %98,4 | 12 Mar 2024 |
99Hemen | CVE-2026-72898Silahlaştırılmış | Metabase SQL injection via password reset endpointmetabase · metabase · CWE-89 | Kritik10,0 | KEV | %98,2 | 10 Ağu 2026 |
99Hemen | CVE-2025-57819Silahlaştırılmış | FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCEsangoma · freepbx · CWE-89 | Kritik10,0 | KEV | %95,2 | 28 Ağu 2025 |
98Hemen | CVE-2026-21643Silahlaştırılmış | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may afortinet · forticlientems · CWE-89 | Kritik9,8 | KEV | %97,7 | 6 Şub 2026 |
97Hemen | CVE-2019-12989Silahlaştırılmış | Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.citrix · netscaler sd-wan · CWE-89 | Kritik9,8 | KEV | %94,9 | 16 Tem 2019 |
97Hemen | CVE-2024-6670Silahlaştırılmış | WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerabilityprogress · whatsup gold · CWE-89 | Kritik9,8 | KEV | %92,9 | 29 Ağu 2024 |
96Hemen | CVE-2024-9465Silahlaştırılmış | Expedition: SQL Injection Leads to Firewall Admin Credential Disclosurepaloaltonetworks · expedition · CWE-89 | Kritik9,2 | KEV | %99,6 | 9 Eki 2024 |
96Hemen | CVE-2020-17463Silahlaştırılmış | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.thedaylightstudio · fuel cms · CWE-89 | Kritik9,8 | KEV | %89,6 | 13 Ağu 2020 |
96Hemen | CVE-2026-9082Silahlaştırılmış | Drupal core - Highly critical - SQL injection - SA-CORE-2026-004drupal · drupal · CWE-89 | Kritik9,8 | KEV | %89,3 | 20 May 2026 |
95Hemen | CVE-2024-29824Silahlaştırılmış | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the samivanti · endpoint manager · CWE-89 | Yüksek8,8 | KEV | %99,9 | 31 May 2024 |
95Hemen | CVE-2017-18362Silahlaştırılmış | ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct acconnectwise · manageditsync · CWE-89 | Kritik9,8 | KEV | %86,8 | 5 Şub 2019 |
94Hemen | CVE-2026-42208Silahlaştırılmış | LiteLLM: SQL injection in Proxy API key verificationlitellm · litellm · CWE-89 | Kritik9,3 | KEV | %89,4 | 8 May 2026 |
94Hemen | CVE-2020-5722Silahlaştırılmış | The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.grandstream · ucm6200 firmware · CWE-89 | Kritik9,8 | KEV | %84,2 | 23 Mar 2020 |
93Hemen | CVE-2024-43468Silahlaştırılmış | Microsoft Configuration Manager Remote Code Execution Vulnerabilitymicrosoft · configuration manager 2403 · CWE-89 | Kritik9,8 | KEV | %81,0 | 8 Eki 2024 |
92Hemen | CVE-2021-42258Silahlaştırılmış | BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in thbqe · billquick web suite · CWE-89 | Kritik9,8 | KEV | %75,1 | 22 Eki 2021 |
91Hemen | CVE-2018-7841Silahlaştırılmış | A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an ischneider-electric · u.motion builder · CWE-89 | Kritik9,8 | KEV | %72,4 | 22 May 2019 |
90Hemen | CVE-2019-7481Silahlaştırılmış | Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.sonicwall · sma 100 firmware · CWE-89 | Yüksek7,5 | KEV | %99,9 | 17 Ara 2019 |
90Hemen | CVE-2016-2386Silahlaştırılmış | SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands vsap · netweaver application server java · CWE-89 | Kritik9,8 | KEV | %71,5 | 16 Şub 2016 |
90Hemen | CVE-2021-44026Silahlaştırılmış | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.roundcube · webmail · CWE-89 | Kritik9,8 | KEV | %69,8 | 19 Kas 2021 |
82Hemen | CVE-2020-12271Silahlaştırılmış | A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wildsophos · sfos · CWE-89 | Kritik9,8 | KEV | %43,3 | 27 Nis 2020 |
81Hemen | CVE-2026-76461Silahlaştırılmış | Cisco Secure Email Gateway SQL Injection Vulnerabilitycisco · asyncos · CWE-89 | Kritik9,8 | KEV | %40,1 | 14 Eyl 2026 |
81Hemen | CVE-2021-20016Silahlaştırılmış | A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to accesssonicwall · sma 100 firmware · CWE-89 | Kritik9,8 | KEV | %40,0 | 4 Şub 2021 |
78Bu hafta | CVE-2021-20028Silahlaştırılmış | Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, ssonicwall · sma 210 firmware · CWE-89 | Kritik9,8 | KEV | %30,0 | 4 Ağu 2021 |
- CVE-2023-3436299Hemen
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99progress · moveit cloud2 Haz 2023
- CVE-2025-2525799Hemen
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %99fortinet · fortiweb17 Tem 2025
- CVE-2023-4878899Hemen
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %98fortinet · forticlient enterprise management server12 Mar 2024
- CVE-2026-7289899Hemen
Metabase SQL injection via password reset endpoint
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %98metabase · metabase10 Ağu 2026
- CVE-2025-5781999Hemen
FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %95sangoma · freepbx28 Ağu 2025
- CVE-2026-2164398Hemen
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may a
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %97fortinet · forticlientems6 Şub 2026
- CVE-2019-1298997Hemen
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %94citrix · netscaler sd-wan16 Tem 2019
- CVE-2024-667097Hemen
WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %92progress · whatsup gold29 Ağu 2024
- CVE-2024-946596Hemen
Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure
KritikCVSS 9,2KEVSilahlaştırılmışEPSS %99paloaltonetworks · expedition9 Eki 2024
- CVE-2020-1746396Hemen
FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %89thedaylightstudio · fuel cms13 Ağu 2020
- CVE-2026-908296Hemen
Drupal core - Highly critical - SQL injection - SA-CORE-2026-004
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %89drupal · drupal20 May 2026
- CVE-2024-2982495Hemen
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam
YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %99ivanti · endpoint manager31 May 2024
- CVE-2017-1836295Hemen
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct ac
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %86connectwise · manageditsync5 Şub 2019
- CVE-2026-4220894Hemen
LiteLLM: SQL injection in Proxy API key verification
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %89litellm · litellm8 May 2026
- CVE-2020-572294Hemen
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %84grandstream · ucm6200 firmware23 Mar 2020
- CVE-2024-4346893Hemen
Microsoft Configuration Manager Remote Code Execution Vulnerability
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %81microsoft · configuration manager 24038 Eki 2024
- CVE-2021-4225892Hemen
BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %75bqe · billquick web suite22 Eki 2021
- CVE-2018-784191Hemen
A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an i
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %72schneider-electric · u.motion builder22 May 2019
- CVE-2019-748190Hemen
Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.
YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %99sonicwall · sma 100 firmware17 Ara 2019
- CVE-2016-238690Hemen
SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %71sap · netweaver application server java16 Şub 2016
- CVE-2021-4402690Hemen
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %69roundcube · webmail19 Kas 2021
- CVE-2020-1227182Hemen
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %43sophos · sfos27 Nis 2020
- CVE-2026-7646181Hemen
Cisco Secure Email Gateway SQL Injection Vulnerability
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %40cisco · asyncos14 Eyl 2026
- CVE-2021-2001681Hemen
A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %40sonicwall · sma 100 firmware4 Şub 2021
- CVE-2021-2002878Bu hafta
Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, s
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %30sonicwall · sma 210 firmware4 Ağu 2021