sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious u…

CVE-2016-10551CRITICALCVSS 9.8EG 9.8

2018-05-29

waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contains`, `startsWith`, or `endsWith` will end up in waterline-sequel with the potential for malicious c…

CVE-2016-10553CRITICALCVSS 9.8EG 9.8

2018-05-31

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. A fix was pushed out that fixed potential SQL injection in sequelize 2.…

CVE-2016-10554CRITICALCVSS 9.8EG 9.8

2018-05-31

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS. Before version 1.7.0-alpha3, sequelize defaulted SQLite to use MySQL ba…

CVE-2016-10556HIGHCVSS 7.5EG 7.5

2018-05-29

sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS In Postgres, SQLite, and Microsoft SQL Server there is an issue where ar…

CVE-2016-10731CRITICALCVSS 9.8EG 9.8

2018-10-29

ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the …

CVE-2016-10754HIGHCVSS 8.8EG 8.8

2019-05-24

modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter.

CVE-2016-10755HIGHCVSS 8.8EG 8.8

2019-05-24

AbanteCart 1.2.8 allows SQL Injection via the source_language parameter to admin/controller/pages/localisation/language.php and core/lib/language_manager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/…

CVE-2016-10817CRITICALCVSS 9.8EG 9.8

2019-08-01

cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file (SEC-123).

CVE-2016-10839HIGHCVSS 8.1EG 8.1

2019-08-01

cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).

CVE-2016-10887CRITICALCVSS 9.8EG 9.8

2019-08-14

The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues.

CVE-2016-10888CRITICALCVSS 9.8EG 9.8

2019-08-14

The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues.

CVE-2016-10889CRITICALCVSS 9.8EG 9.8

2019-08-14

The nextgen-gallery plugin before 2.1.57 for WordPress has SQL injection via a gallery name.

CVE-2016-10904CRITICALCVSS 9.8EG 9.8

2019-08-16

The olimometer plugin before 2.57 for WordPress has SQL injection.

CVE-2016-10909CRITICALCVSS 9.8EG 9.8

2019-08-21

The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.

CVE-2016-10916CRITICALCVSS 9.8EG 9.8

2019-08-22

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.

CVE-2016-10917CRITICALCVSS 9.8EG 9.8

2019-08-22

The search-everything plugin before 8.1.6 for WordPress has SQL injection related to empty search strings, a different vulnerability than CVE-2014-2316.

CVE-2016-10921CRITICALCVSS 9.8EG 9.8

2019-08-22

The gallery-photo-gallery plugin before 1.0.1 for WordPress has SQL injection.

CVE-2016-10939HIGHCVSS 7.2EG 7.2

2019-09-13

The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.

CVE-2016-10940HIGHCVSS 7.2EG 7.2

2019-09-13

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.

CVE-2016-10942CRITICALCVSS 9.8EG 9.8

2019-09-13

The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insert_id parameter exploitable via CSRF.

CVE-2016-10943HIGHCVSS 7.2EG 7.2

2019-09-13

The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.

CVE-2016-10947HIGHCVSS 7.2EG 7.2

2019-09-13

The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.

CVE-2016-10949HIGHCVSS 8.8EG 8.8

2019-09-13

The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.

CVE-2016-10950HIGHCVSS 8.8EG 8.8

2019-09-13

The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.

CVE-2016-10951HIGHCVSS 7.2EG 7.2

2019-09-13

The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.

CVE-2016-11000CRITICALCVSS 9.8EG 9.8

2019-09-20

The wp-ultimate-exporter plugin through 1.1 for WordPress has SQL injection via the export_type_name parameter.

CVE-2016-11018CRITICALCVSS 9.8EG 9.8

2020-01-21

An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-Forwarded-For are prone to unauthenticated SQL injection. The affected file is gallery-images.php. The affected function i…

CVE-2016-11023CRITICALCVSS 9.8EG 9.8

2020-03-30

odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.

CVE-2016-11024CRITICALCVSS 9.8EG 9.8

2020-03-30

odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.

CVE-2016-15012MEDIUMCVSS 5.5EG 9.8

2023-01-07

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critical. This issue affects the function ComputeCountSql of the file SalesforceSDK/SmartStore/Store/Query…

CVE-2016-15013MEDIUMCVSS 5.5EG 9.8

2023-01-07

A vulnerability was found in ForumHulp searchresults. It has been rated as critical. Affected by this issue is the function list_keywords of the file event/listener.php. The manipulation of the argument word leads to sql injection. The nam…

CVE-2016-15016MEDIUMCVSS 5.5EG 9.8

2023-01-08

A vulnerability was found in mrtnmtth joomla_mod_einsatz_stats up to 0.2. It has been classified as critical. This affects the function getStatsByType of the file helper.php. The manipulation of the argument year leads to sql injection. Up…

CVE-2016-15018MEDIUMCVSS 5.5EG 9.8

2023-01-15

A vulnerability was found in krail-jpa up to 0.9.1. It has been classified as critical. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version 0.9.2 is able to address this issue. The identifier of the …

CVE-2016-15020MEDIUMCVSS 5.5EG 5.5

2023-01-16

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 …

CVE-2016-15021MEDIUMCVSS 5.5EG 9.8

2023-01-17

A vulnerability was found in nickzren alsdb. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. Upgrading to version v2 is able to address this issue. The identifier of the p…

CVE-2016-15031HIGHCVSS 7.3EG 7.3

2023-05-06

A vulnerability was found in PHP-Login 1.0. It has been declared as critical. This vulnerability affects the function checkLogin of the file login/scripts/class.loginscript.php of the component POST Parameter Handler. The manipulation of t…

CVE-2016-15034MEDIUMCVSS 5.5EG 5.5

2023-07-10

A vulnerability was found in Dynacase Webdesk and classified as critical. Affected by this issue is the function freedomrss_search of the file freedomrss_search.php. The manipulation leads to sql injection. Upgrading to version 3.2-2018030…

CVE-2016-15040CRITICALCVSS 9.8EG 9.8

2024-10-16

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kento_pvc_geo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient prep…

CVE-2016-15050HIGHCVSS 8.8EG 8.8

2025-10-30

Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorporated into SQL statements without adequate parameterization or sanitation, allo…

CVE-2016-20018HIGHCVSS 7.5EG 7.5

2022-12-19

Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.

CVE-2016-20062HIGHCVSS 8.2EG 8.2

2026-06-09

Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the 'pollid' POST parameter. Attackers can send requests to …

CVE-2016-20063HIGHCVSS 7.1EG 7.1

2026-06-09

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and …

CVE-2016-20065HIGHCVSS 8.2EG 8.2

2026-06-09

Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can sub…

CVE-2016-20068HIGHCVSS 8.2EG 8.2

2026-06-15

WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Atta…

CVE-2016-20069HIGHCVSS 8.2EG 8.2

2026-06-15

WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject …

CVE-2016-20071HIGHCVSS 8.2EG 8.2

2026-06-15

The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through unsanitized user input. …

CVE-2016-20072HIGHCVSS 8.2EG 8.2

2026-06-15

BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests t…

CVE-2016-20073HIGHCVSS 8.2EG 8.2

2026-06-15

Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit cr…

CVE-2016-2386CRITICALCVSS 9.8EG 9.8⚠ KEV

2016-02-16

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

CWE-89— SQL Injection

CVEs classified under CWE-89page 86 of 371

Map vulnerabilities like CWE-89 to your infrastructure