CWE-89 · weakness in SQL Injection
SQL Injection
21,716 CVEs · 32 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 32
- check available
- 479
- likely to be exploited
- 394
Every one of the 21,716 is a mark on the map. Named now: 79 to 104, most at risk first.
- Jeecg-Boot v3.5.1 - SQL Injection
- WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection
- SonicWall GMS and Analytics - SQL Injection
- WordPress RegistrationMagic <5.0.1.6 - Authenticated SQL Injection
- Ghost CMS Content API - SQL Injection
- vBulletin <= 4.2.3 - SQL Injection
- Web Directory Free < 1.7.0 - SQL Injection
- Zoho ManageEngine OpManager - SQL Injection
- Mitel MiCollab <= 9.8.0.33 - SQL Injection
- WP Hotel Booking <= 2.0.7 - SQL Injection
- GLPI 10.0.10-10.0.14 - SQL Injection
- phpMyAdmin < 5.0.3 - SQL Injection
- WordPress My Calendar <3.4.22 - SQL Injection
- LearnPress < 4.2.7.1 - SQL Injection
- Lighttpd 1.4.34 SQL Injection and Path Traversal
- Atom CMS v2.0 - SQL Injection
- Jms Blog - SQL Injection
- Joomla! Component PrayerCenter 3.0.2 - SQL Injection
- Joomla! Component Zh BaiduMap 3.0.0.1 - SQL Injection
- Login with Phone Number - Cross-Site Scripting
- Royal Event - SQL Injection
- KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution
- WordPress Events Manager <= 7.0.3 - SQL Injection
- Casdoor 1.13.0 - Unauthenticated SQL Injection
- Craft CMS <=v3.7.31 - SQL Injection
- Dokan Pro <= 3.10.3 - SQL Injection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.