CWE-89 · weakness in SQL Injection
SQL Injection
21,716 CVEs · 32 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 32
- check available
- 479
- likely to be exploited
- 394
Every one of the 21,716 is a mark on the map. Named now: 209 to 234, most at risk first.
- LearnPress < 4.2.7.1 - SQL Injection
- BlueNet Technology Clinical Browsing System 1.2.1 - Sql Injection
- Contest Gallery < 13.1.0.6 - SQL injection
- Nagios XI v5.11.0 - SQL Injection
- Quiz Maker <= 6.5.8.3 - SQL Injection
- WordPress BadgeOS <=3.7.0 - SQL Injection
- Lansweeper Unauthenticated SQL Injection
- TITool PrintMonitor - Blind SQL Injection
- WordPress Easy Digital Downloads 3.1.0.2/3.1.0.3 - SQL Injection
- WordPress HTML5 Video Player - SQL Injection
- WordPress Spider Calendar <=1.4.9 - SQL Injection
- WordPress Simple Link Directory <7.7.2 - SQL injection
- CP Image Store with Slideshow <= 1.0.67 - SQL Injection
- Business Directory Plugin <= 6.4.2 - SQL Injection
- PuneethReddyHC action.php SQL Injection
- MapSVG < 6.2.20 - Unauthenticated SQLi
- Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash
- 74cms - ajax_street.php 'x' SQL Injection
- WordPress Title Experiments Free <9.0.1 - SQL Injection
- WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection
- Good Layers LMS Plugin <= 2.1.4 - SQL Injection
- School Dormitory Management System 1.0 - SQL Injection
- ZEROF Web Server 2.0 - SQL Injection
- Doctor Appointment System 1.0 - SQL Injection
- WordPress NewStatPress 0.9.8 - SQL Injection
- Joomla! Component JE Job 1.0 - Local File Inclusion
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.