CWE-89 · weakness in SQL Injection
SQL Injection
21,711 CVEs · 32 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 32
- check available
- 479
- likely to be exploited
- 394
Every one of the 21,711 is a mark on the map. Named now: 1 to 26, most at risk first.
- Ivanti EPM - Remote Code Execution
- MOVEit Transfer - Remote Code Execution
- Fortinet FortiWeb - SQL Injection
- SonicWall SRA 4600 VPN - SQL Injection
- Palo Alto Expedition - SQL Injection
- Fortinet Forticlient Endpoint Management Server - SQL Injection
- Metabase - Unauthenticated SQL Injection
- Fortinet FortiClientEMS 7.4.4 - SQL Injection
- FreePBX - Remote Code Execution
- Citrix SD-WAN and NetScaler SD-WAN - SQL Injection
- WhatsUp Gold HasErrors SQL Injection - Authentication Bypass
- Fuel CMS 1.4.7 - SQL Injection
- LiteLLM - SQL Injection
- Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query
- Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution
- Grandstream UCM6200 - SQL Injection
- Microsoft Configuration Manager Remote Code Execution Vulnerability
- BillQuick Web Suite SQL Injection
- Schneider Electric U.motion Builder - Remote Code Execution
- SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Securit…
- Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
- A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
- SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
- A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices c…
- Cisco Secure Email Gateway SQL Injection Vulnerability
- A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session re…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.