CWE-89 · weakness in SQL Injection
SQL Injection
21,716 CVEs · 32 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 32
- check available
- 479
- likely to be exploited
- 394
Every one of the 21,716 is a mark on the map. Named now: 131 to 156, most at risk first.
- SupportCandy < 3.1.5 - Unauthenticated SQL Injection
- Advantech WISE-IoTSuite/SaaS - SQL Injection
- WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection
- Bangresto - SQL Injection
- NetMRI Unauthenticated SQL Injection via skipjackUsername
- LearnPress WordPress LMS Plugin <= 4.2.6.5 - SQL Injection
- ZoneMinder v1.37.* <= 1.37.64 - SQL Injection
- rConfig 3.9.4 - SQL Injection
- rConfig 3.9.4 - SQL Injection
- ASIS - SQL Injection Authentication Bypass
- Jeecg-boot 3.5.0 qurestSql - SQL Injection
- Dolibarr ERP CMS `list.php` - SQL Injection
- WordPress NotificationX <2.3.9 - SQL Injection
- SkyWalking SQLI
- Nagios XI < 5.11.3 - SQL Injection
- Virtua Software Cobranca <12R - Blind SQL Injection
- Gogs (Go Git Service) - SQL Injection
- Prestashop posstaticfooter <= 1.0.0 - SQL Injection
- WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
- rConfig <=3.9.4 - SQL Injection
- Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component
- WordPress Statistics <13.0.8 - Blind SQL Injection
- 1Panel SQL Injection - Authenticated
- College Management System 1.0 - SQL Injection
- WpStickyBar <= 2.1.0 - SQL Injection
- AudioCodes Device Manager Express - SQL Injection
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.