Skip to content
BackEsc
Sign in

CWE-89 · weakness in SQL Injection

SQL Injection

21,712 CVEs · 32 exploited

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
32
check available
479
likely to be exploited
394

Every one of the 21,712 is a mark on the map. Named now: 27 to 52, most at risk first.

  1. Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running…CVE-2021-20028SonicWall · CVSS 9.8 · 30% likely

    SonicWall

  2. Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL InjectionCVE-2026-9586Sangoma · CVSS 9.3 · 19% likelycovered by CyberSIXT

    Sangoma3 articles

  3. WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryCVE-2026-60137WordPress · CVSS 5.9 · 5.3% likelycovered by CyberSIXT

    WordPressCyberXeroRed Heron3 articles1 article this week: SOCRadar profiles CyberXero’s AI-assisted attacks on Ukraine

  4. An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.CVE-2020-29574Sophos · CVSS 9.8 · 4.7% likely

    Sophos

  5. BIG-IP Configuration utility authenticated SQL injection vulnerabilityCVE-2023-46748F5 · CVSS 8.8 · 4.3% likely

    F5

  6. Security Advisory 0199CVE-2026-114625Arista Networks · CVSS 9.9 · 1.0% likelycovered by CyberSIXT

    Arista Networks8 articles

  7. Drupal SQL InjectionCVE-2014-3704100% likely
  8. Joomla! Core SQL InjectionCVE-2015-7297100% likely
  9. Joomla! <3.7.1 - SQL InjectionCVE-2017-8917100% likely
  10. rConfig 3.9 - SQL InjectionCVE-2020-10220100% likely
  11. Agentejo Cockpit <0.11.2 - NoSQL InjectionCVE-2020-3584798% likely
  12. WordPress <5.8.3 - SQL InjectionCVE-2022-21661WordPress · CVSS 8 · 98% likely

    WordPress

  13. MOVEit Transfer - SQL InjectionCVE-2023-35708Progress · 97% likely

    Progress Software

  14. WordPress Chop Slider 3 - Blind SQL InjectionCVE-2020-1153095% likely
  15. MOVEit Transfer - SQL InjectionCVE-2023-36934Progress · 95% likely

    Progress Software

  16. WordPress PayPal Pro <1.1.65 - SQL InjectionCVE-2020-1409295% likely
  17. WordPress Automatic Plugin <= 3.92.0 - SQL InjectionCVE-2024-27956ValvePress · CVSS 9.9 · 94% likely

    ValvePress

  18. Artica Web Proxy 4.30 - Authentication Bypass/SQL InjectionCVE-2020-1750694% likely
  19. Agentejo Cockpit < 0.11.2 - NoSQL InjectionCVE-2020-3584693% likely
  20. WordPress Paid Memberships Pro <2.9.8 - Blind SQL InjectionCVE-2023-23488Strangerstudios · CVSS 9.8 · 92% likely

    Stranger Studios

  21. Fortra FileCatalyst Workflow <= v5.1.6 - SQL InjectionCVE-2024-5276Fortra · CVSS 9.8 · 90% likely

    Fortra

  22. WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL InjectionCVE-2024-1071ultimatemember · CVSS 9.8 · 89% likely

    Ultimate Member

  23. vBulletin SQL InjectionCVE-2020-1272089% likely
  24. Cacti 1.2.24 - SQL InjectionCVE-2023-39361Cacti · CVSS 9.8 · 89% likely

    Cacti

  25. rConfig 3.9.4 - SQL InjectionCVE-2020-1054687% likely
  26. GLPI < 10.0.17 - Pre-Auth SQL InjectionCVE-2025-24799glpi-project · CVSS 7.5 · 87% likelycovered by CyberSIXT

    GLPI

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in