CWE-89 · weakness in SQL Injection
SQL Injection
21,717 CVEs · 32 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 32
- check available
- 479
- likely to be exploited
- 394
Every one of the 21,717 is a mark on the map. Named now: 261 to 286, most at risk first.
- Multiple Shipping Address Woocommerce < 2.0 - SQL Injection
- Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection
- CommonsBooking < 2.6.8 - SQL Injection
- Sourcecodester Simple Client Management System 1.0 - SQL Injection
- WordPress Personal Dictionary <1.3.4 - Blind SQL Injection
- ProFTPD mod_sql - Preauth User Backdoor
- Registrations for the Events Calendar < 2.7.6 - SQL Injection
- SRS Simple Hits Counter 1.0.3-1.0.4 - Unauthenticated Blind SQL Injection
- Atom CMS v2.0 - SQL Injection
- Online Fire Reporting System v1.0 - SQL injection
- Online Fire Reporting System v1.0 - SQL injection
- Online Fire Reporting System v1.0 - SQL injection
- Bylancer Quicklancer 2.4 G - SQL Injection
- MCMS 5.2.4 - SQL Injection
- WBCE 1.6.0 - SQL Injection
- RSVPMaker <= 9.2.5 - SQL Injection
- WordPress Master Elements <=8.0 - SQL Injection
- Cuppa CMS v1.0 - SQL injection
- Terraboard <2.2.0 - SQL Injection
- ECShop 4.1.0 - SQL Injection
- Cuppa CMS v1.0 - SQL injection
- Cuppa CMS v1.0 - SQL injection
- WordPress Paytm Donation <=1.3.2 - Authenticated SQL Injection
- Cuppa CMS v1.0 - SQL injection
- AWP Classifieds <= 4.2.1 - Unauthenticated SQL Injection
- KevinLAB BEMS 1.0 - SQL Injection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.