Skip to content
OpenAdvisories

Weakness (CWE)

CWE-943: Improper Neutralization of Special Elements in Data Query Logic

Class Incomplete

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Source: MITRE CWE-943

All Critical High Medium Low Exploited only Public exploit

163 results · Feed

  • Medium 6.5
    CVE-2021-1349

    Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability

    A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input valid…

    Cisco Cisco SD-WAN vManage Network devices
  • Unscored —
    CVE-2018-19952

    If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This iss…

    QNAP Systems Music Station
  • High 7.7
    CVE-2020-5257

    Sort order SQL injection in Administrate

    In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before being interpolated into the SQL query. This could present a SQL injection if the attacker were able to modify the `dir…

    thoughtbot administrate administrate RubyGems