CWE-89 · SQL Injection
SQL Injection
21,713CVEs
32exploited
479with a public check
394likely (EPSS 10%+)
SortMost likely exploited
21,713 CVEs with CWE-89 as their weakness · the first 2,000 are paged here; the Atlas names every one
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-29824In CISA KEVExploitedIvanti EPM - Remote Code ExecutionIvanti · EPM · CVSS 9.6 · 2024-05-31 | 9.6 | 100% | 2024-05-31 |
| CVE-2023-34362In CISA KEVExploitedMOVEit Transfer - Remote Code ExecutionProgress · MOVEit Transfer · CVSS 9.8 · 2023-06-02 | 9.8 | 100% | 2023-06-02 |
| CVE-2025-25257In CISA KEVExploitedFortinet FortiWeb - SQL InjectionFortinet · FortiWeb · CVSS 9.6 · 2025-07-17 | 9.6 | 100% | 2025-07-17 |
| CVE-2019-7481In CISA KEVExploitedSonicWall SRA 4600 VPN - SQL InjectionSonicWall · SMA100 · CVSS 7.5 · 2019-12-17 | 7.5 | 100% | 2019-12-17 |
| CVE-2024-9465In CISA KEVExploitedPalo Alto Expedition - SQL InjectionPalo Alto Networks · Expedition · CVSS 9.2 · 2024-10-09 | 9.2 | 100% | 2024-10-09 |
| CVE-2023-48788In CISA KEVExploitedFortinet Forticlient Endpoint Management Server - SQL InjectionFortinet · FortiClientEMS · CVSS 9.3 · 2024-03-12 | 9.3 | 98% | 2024-03-12 |
| CVE-2026-72898In CISA KEVExploitedMetabase - Unauthenticated SQL InjectionMetabase · Metabase · CVSS 10 · 2026-08-10 | 10.0 | 98% | 2026-08-10 |
| CVE-2026-21643In CISA KEVExploitedFortinet FortiClientEMS 7.4.4 - SQL InjectionFortinet · FortiClientEMS · CVSS 9.1 · 2026-02-06 | 9.1 | 98% | 2026-02-06 |
| CVE-2025-57819In CISA KEVExploitedFreePBX - Remote Code ExecutionFreePBX · endpoint · CVSS 10 · 2025-08-28 | 10.0 | 95% | 2025-08-28 |
| CVE-2019-12989In CISA KEVExploitedCitrix SD-WAN and NetScaler SD-WAN - SQL InjectionCitrix · SD-WAN and NetScaler · CVSS 9.8 · 2019-07-16 | 9.8 | 95% | 2019-07-16 |
| CVE-2024-6670In CISA KEVExploitedWhatsUp Gold HasErrors SQL Injection - Authentication BypassProgress Software Corporation · WhatsUp Gold · CVSS 9.8 · 2024-08-29 | 9.8 | 93% | 2024-08-29 |
| CVE-2020-17463In CISA KEVExploitedFuel CMS 1.4.7 - SQL InjectionFuel CMS · Fuel CMS · CVSS 9.8 · 2020-08-13 | 9.8 | 90% | 2020-08-13 |
| CVE-2026-42208In CISA KEVExploitedLiteLLM - SQL InjectionBerriAI · litellm · CVSS 9.8 · 2026-05-08 | 9.8 | 89% | 2026-05-08 |
| CVE-2026-9082In CISA KEVExploitedDrupal Core - Anonymous SQL Injection via PostgreSQL Entity QueryDrupal · Drupal core · CVSS 9.8 · 2026-05-20 | 9.8 | 89% | 2026-05-20 |
| CVE-2017-18362In CISA KEVExploitedKaseya VSA 2017 ConnectWise ManagedITSync - Remote Code ExecutionKaseya · Virtual System/Server Administrator (VSA) · CVSS 9.8 · 2019-02-05 | 9.8 | 87% | 2019-02-05 |
| CVE-2020-5722In CISA KEVExploitedGrandstream UCM6200 - SQL InjectionGrandstream · Grandstream UCM6200 Series · CVSS 9.8 · 2020-03-23 | 9.8 | 84% | 2020-03-23 |
| CVE-2024-43468In CISA KEVExploitedMicrosoft Configuration Manager Remote Code Execution VulnerabilityMicrosoft · Microsoft Configuration Manager · CVSS 9.8 · 2024-10-08 | 9.8 | 81% | 2024-10-08 |
| CVE-2021-42258In CISA KEVExploitedBillQuick Web Suite SQL InjectionBQE · BillQuick Web Suite · CVSS 9.8 · 2021-10-22 | 9.8 | 75% | 2021-10-22 |
| CVE-2018-7841In CISA KEVExploitedSchneider Electric U.motion Builder - Remote Code ExecutionU.motion · U.motion Builder software version 1.3.4 · CVSS 9.8 · 2019-05-22 | 9.8 | 72% | 2019-05-22 |
| CVE-2016-2386In CISA KEVExploitedSQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Securit…SAP · NetWeaver · CVSS 9.8 · 2016-02-16 | 9.8 | 72% | 2016-02-16 |
| CVE-2021-44026In CISA KEVExploitedRoundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.Roundcube · Roundcube Webmail · CVSS 9.8 · 2021-11-19 | 9.8 | 70% | 2021-11-19 |
| CVE-2025-25181In CISA KEVExploitedA SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.Advantive · VeraCore · CVSS 5.8 · 2025-02-03 | 5.8 | 55% | 2025-02-03 |
| CVE-2024-9379In CISA KEVExploitedSQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.Ivanti · CSA (Cloud Services Appliance) · CVSS 6.5 · 2024-10-08 | 6.5 | 44% | 2024-10-08 |
| CVE-2020-12271In CISA KEVExploitedA SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices c…Sophos · SFOS · CVSS 10 · 2020-04-27 | 10.0 | 43% | 2020-04-27 |
| CVE-2026-76461In CISA KEVExploitedCisco Secure Email Gateway SQL Injection VulnerabilityCisco · Cisco Secure Email · CVSS 9.8 · 2026-09-14 | 9.8 | 40% | 2026-09-14 |
| CVE-2021-20016In CISA KEVExploitedA SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access username password and other session re…SonicWall · SonicWall SMA100 · CVSS 9.8 · 2021-02-03 | 9.8 | 40% | 2021-02-03 |
| CVE-2021-20028In CISA KEVExploitedImproper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specifically the SRA appliances running…SonicWall · SonicWall SRA/SMA100 · CVSS 9.8 · 2021-08-04 | 9.8 | 30% | 2021-08-04 |
| CVE-2026-9586In CISA KEVExploitedSangoma Switchvox < 8.4.0.2 - Unauthenticated SQL InjectionSangoma · Switchvox SMB Edition · CVSS 9.3 · 2026-07-17 | 9.3 | 19% | 2026-07-17 |
| CVE-2026-60137In CISA KEVExploitedWordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_QueryWordPress · WordPress · CVSS 5.9 · 2026-07-17 | 5.9 | 5.3% | 2026-07-17 |
| CVE-2020-29574In CISA KEVExploitedAn SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.Sophos · CyberoamOS · CVSS 9.8 · 2020-12-11 | 9.8 | 4.7% | 2020-12-11 |
| CVE-2023-46748In CISA KEVExploitedBIG-IP Configuration utility authenticated SQL injection vulnerabilityF5 · BIG-IP · CVSS 8.8 · 2023-10-26 | 8.8 | 4.3% | 2023-10-26 |
| CVE-2026-114625In CISA KEVExploitedSecurity Advisory 0199Arista Networks · VeloCloud Orchestrator · CVSS 9.9 · 2026-10-22 | 9.9 | 1.0% | 2026-10-22 |
| CVE-2014-3704CheckDrupal SQL InjectionDrupal · Drupal · 2014-10-16 | – | 100% | 2014-10-16 |
| CVE-2015-7297CheckJoomla! Core SQL InjectionJoomla · Joomla! · 2015-10-29 | – | 100% | 2015-10-29 |
| CVE-2017-8917CheckJoomla! <3.7.1 - SQL InjectionJoomla · Joomla! · 2017-05-17 | – | 100% | 2017-05-17 |
| CVE-2020-10220CheckrConfig 3.9 - SQL InjectionRconfig · Rconfig · 2020-03-07 | – | 100% | 2020-03-07 |
| CVE-2020-35847CheckAgentejo Cockpit <0.11.2 - NoSQL InjectionAgentejo · Cockpit · 2020-12-30 | – | 98% | 2020-12-30 |
| CVE-2022-21661CheckWordPress <5.8.3 - SQL InjectionWordPress · wordpress-develop · CVSS 8 · 2022-01-06 | 8.0 | 98% | 2022-01-06 |
| CVE-2023-35708CheckMOVEit Transfer - SQL InjectionProgress · Moveit Transfer · 2023-06-16 | – | 97% | 2023-06-16 |
| CVE-2020-11530CheckWordPress Chop Slider 3 - Blind SQL InjectionIdangero · Chop Slider · 2020-05-08 | – | 95% | 2020-05-08 |
| CVE-2023-36934CheckMOVEit Transfer - SQL InjectionProgress · Moveit Transfer · 2023-07-05 | – | 95% | 2023-07-05 |
| CVE-2020-14092CheckWordPress PayPal Pro <1.1.65 - SQL InjectionIthemes · Paypal Pro · 2020-07-02 | – | 95% | 2020-07-02 |
| CVE-2024-27956CheckWordPress Automatic Plugin <= 3.92.0 - SQL InjectionValvePress · Automatic · CVSS 9.9 · 2024-03-21 | 9.9 | 94% | 2024-03-21 |
| CVE-2020-17506CheckArtica Web Proxy 4.30 - Authentication Bypass/SQL InjectionArticatech · Web Proxy · 2020-08-12 | – | 94% | 2020-08-12 |
| CVE-2020-35846CheckAgentejo Cockpit < 0.11.2 - NoSQL InjectionAgentejo · Cockpit · 2020-12-30 | – | 93% | 2020-12-30 |
| CVE-2023-23488CheckWordPress Paid Memberships Pro <2.9.8 - Blind SQL InjectionStrangerstudios · Paid Memberships Pro WordPress Plugin · CVSS 9.8 · 2023-01-20 | 9.8 | 92% | 2023-01-20 |
| CVE-2024-5276CheckFortra FileCatalyst Workflow <= v5.1.6 - SQL InjectionFortra · FileCatalyst Workflow · CVSS 9.8 · 2024-06-25 | 9.8 | 90% | 2024-06-25 |
| CVE-2024-1071CheckWordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injectionultimatemember · Ultimate Member – User Profile, Registration, Login, Member Directory, Content… · CVSS 9.8 · 2024-03-13 | 9.8 | 89% | 2024-03-13 |
| CVE-2020-12720CheckvBulletin SQL InjectionVbulletin · Vbulletin · 2020-05-07 | – | 89% | 2020-05-07 |
| CVE-2023-39361CheckCacti 1.2.24 - SQL InjectionCacti · cacti · CVSS 9.8 · 2023-09-05 | 9.8 | 89% | 2023-09-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.