CWE-89 · weakness in SQL Injection
SQL Injection
21,717 CVEs · 32 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 32
- check available
- 479
- likely to be exploited
- 394
Every one of the 21,717 is a mark on the map. Named now: 235 to 260, most at risk first.
- WordPress Best Books <=2.6.3 - SQL Injection
- WordPress WP Video Gallery <=1.7.1 - SQL Injection
- WordPress Daily Prayer Time <2022.03.01 - SQL Injection
- WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection
- SpeakOut Email Petitions < 2.14.15.1 - SQL Injection
- Opencart Divido - Sql Injection
- WeiPHP 5.0 - SQL Injection
- IPS Community Suite - Unauthenticated SQL Injection
- 74cms - ajax_officebuilding.php SQL Injection
- 74cms - ajax_common.php SQL Injection
- ZEROF Web Server 1.0 - SQL Injection
- WCFM WooCommerce Multivendor Marketplace < 3.4.12 - SQL Injection
- Users Ultra <= 3.1.0 - SQL Injection
- CRMEB v.5.2.2 - SQL Injection
- WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection
- Ubigeo de Peru < 3.6.4 - SQL Injection
- 74cms - ajax_street.php 'key' SQL Injection
- WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection
- Doctor Appointment System 1.0 - SQL Injection
- Doctor Appointment System 1.0 - SQL Injection
- Doctor Appointment System 1.0 - SQL Injection
- WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection
- Hospital Management System 1.0 - SQL Injection
- MCMS 5.2.5 - SQL Injection
- WordPress Stop Bad Bots <6.930 - SQL Injection
- PrestaShop - SQL Injection to Eval Injection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.