CWE-89 · weakness in SQL Injection
SQL Injection
21,716 CVEs · 32 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 32
- check available
- 479
- likely to be exploited
- 394
Every one of the 21,716 is a mark on the map. Named now: 53 to 78, most at risk first.
- WordPress Perfect Survey <1.5.2 - SQL Injection
- Rudder Server < 1.3.0-rc.1 - SQL Injection
- GeoServer OGC Filter - SQL Injection
- XWiki Platform - SQL Injection
- EyesOfNetwork - Hardcoded API Key & SQL Injection
- Tutor LMS <= 2.7.6 - SQL Injection
- Joomla! JCK Editor SQL Injection
- Zabbix - SQL Injection
- WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection
- WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
- Wordpress Email Subscribers by Icegram Express - SQL Injection
- XWiki REST API Query - SQL Injection
- VICIdial - SQL Injection
- WordPress Secure Copy Content Protection and Content Locking <2.8.2 - SQL Injection
- MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection
- WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
- NotificationX <= 2.8.2 - SQL Injection
- WordPress Google Maps <7.11.18 - SQL Injection
- Riello Netman 204 - SQL Injection
- Mura/Masa CMS - SQL Injection
- Layer5 Meshery 0.5.2 - SQL Injection
- Photo Gallery by 10Web < 1.6.0 - SQL Injection
- Agentejo Cockpit <0.12.0 - NoSQL Injection
- PrestaShop SmartBlog <4.0.6 - SQL Injection
- WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection
- WP Fastest Cache 1.2.2 - SQL Injection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.