CWE-89 · weakness in SQL Injection
SQL Injection
21,716 CVEs · 32 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 32
- check available
- 479
- likely to be exploited
- 394
Every one of the 21,716 is a mark on the map. Named now: 105 to 130, most at risk first.
- WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter
- PuneethReddyHC Online Shopping System homeaction.php SQL Injection
- LearnPress <= 4.2.5.7 - SQL Injection
- Rosario Student Information System Unauthenticated SQL Injection
- JeecgBoot v3.7.1 - SQL Injection
- PrestaShop Step by Step products Pack - SQL Injection
- VoipMonitor - Pre-Auth SQL Injection
- WordPress Gift Voucher <4.1.8 - Blind SQL Injection
- NETGEAR ProSafe SSL VPN firmware - SQL Injection
- Metinfo 7.0.0 beta - SQL Injection
- MetInfo 7.0.0 beta - SQL Injection
- Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection
- Wordpress Polls Widget < 1.5.3 - SQL Injection
- 404 to 301 <= 2.0.2 - Authenticated Blind SQL Injection
- FUXA <= 1.1.12 - Unauthenticated SQL Injection
- Bank Locker Management System v1.0 - SQL Injection
- Popup Builder Plugin - SQL Injection and Cross-Site Scripting
- Photo Gallery WordPress v1.6.3 - SQL Injection
- Documentor <= 1.5.3 - Unauthenticated SQL Injection
- Wordpress Gift Cards <= 4.3.1 - SQL Injection
- NagiosXI <= 5.4.12 - SQL injection
- NagiosXI <= 5.4.12 `commandline.php` SQL injection
- NagiosXI <= 5.4.12 menuaccess.php - SQL injection
- NagiosXI <= 5.4.12 logbook.php SQL injection
- PrestaShop PireosPay - SQL Injection
- TurboMeeting - Boolean-based SQL Injection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.