CWE-89 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-89 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2024-29824An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an…99.9%높음8.8● 랜섬웨어 캠페인에 사용됨CVE-2023-34362In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5…99.9%심각9.8● 실제 악용이 확인됨CVE-2025-25257An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerabilit…99.9%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2019-7481Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorize…99.9%높음7.5● 실제 악용이 확인됨CVE-2024-9465An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker t…99.6%심각9.2● 실제 악용이 확인됨CVE-2026-72898Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password'…98.8%심각10.0● 랜섬웨어 캠페인에 사용됨CVE-2023-48788A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet F…98.4%심각9.8● 실제 악용이 확인됨CVE-2026-21643An improper neutralization of special elements used in an sql command ('sql injection') vulnerabilit…97.7%심각9.8
전체 목록
120건
CVE-2025-57819악용 확인FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable …95.2%심각10.0
CVE-2019-12989악용 확인Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.95.0%심각9.8
CVE-2024-6670랜섬웨어 악용In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated att…92.9%심각9.8
CVE-2020-17463악용 확인FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/…89.7%심각9.8
CVE-2026-42208악용 확인LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to …89.4%심각9.3
CVE-2026-9082악용 확인Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal D…89.4%심각9.8
CVE-2017-18362랜섬웨어 악용ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote comm…86.8%심각9.8
CVE-2020-5722악용 확인The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection …84.3%심각9.8
CVE-2021-42258랜섬웨어 악용BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code…75.2%심각9.8
CVE-2018-7841악용 확인A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unw…72.5%심각9.8
CVE-2016-2386악용 확인SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to ex…71.5%심각9.8
CVE-2021-44026악용 확인Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_par…69.9%심각9.8
CVE-2025-25181악용 확인A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attac…55.5%높음7.5
CVE-2024-9379악용 확인SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attack…44.3%높음7.2
CVE-2020-12271랜섬웨어 악용A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall dev…42.4%심각9.8
CVE-2021-20016랜섬웨어 악용A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker …40.0%심각9.8
CVE-2021-20028랜섬웨어 악용Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure R…30.1%심각9.8
CVE-2026-76461악용 확인A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an u…29.5%심각9.8
CVE-2026-9586악용 확인An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa e…19.0%심각9.3
CVE-2026-60137악용 확인WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author…5.3%보통5.9
CVE-2020-29574랜섬웨어 악용An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attack…4.7%심각9.8
CVE-2023-46748악용 확인An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an aut…4.3%높음8.8
CVE-2026-114625악용 확인VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to acce…1.0%심각9.4
CVE-2026-70049Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuratio…2.3%높음8.0
CVE-2026-86677ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unau…2.0%높음8.8
CVE-2026-78482Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…1.9%높음7.8
CVE-2026-18912ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerabi…1.5%높음7.7
CVE-2026-54647CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly conc…1.4%높음7.2
CVE-2026-54646CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places adm…1.4%높음7.2
CVE-2026-44642Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_ac…1.3%높음8.1
CVE-2026-75746ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injectio…1.1%심각9.1
CVE-2026-67401A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi …1.0%심각9.9
CVE-2026-53629GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with…1.0%높음7.1
CVE-2026-82009Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Comm…1.0%심각9.1
CVE-2026-70266Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office Share…0.9%높음8.8
CVE-2026-14913ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL In…1.0%높음8.8
CVE-2026-69636Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office Share…1.0%보통6.5
CVE-2026-42324Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_se…0.9%높음7.2
CVE-2026-69716Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office Share…0.9%높음8.8
CVE-2026-61781pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_par…0.8%심각9.9
CVE-2026-108065SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAll…0.8%심각9.8
CVE-2026-79947Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00,…0.8%보통5.5
CVE-2026-79849Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct S…0.7%심각10.0
CVE-2026-79848Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct S…0.7%심각10.0
CVE-2026-57190Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, …0.7%높음7.0
CVE-2026-61820pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_te…0.7%높음8.5
CVE-2026-61819pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jo…0.7%높음8.5
CVE-2026-61817pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_mainte…0.7%높음8.5
CVE-2026-66819Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an a…0.7%높음8.8
CVE-2026-62895Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate …0.7%높음8.8
CVE-2026-42093Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Resu…0.7%높음8.7
CVE-2026-54354MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime f…0.7%높음8.2
CVE-2026-79854A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct …0.6%심각9.8
CVE-2026-79852A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to…0.6%심각9.8
CVE-2026-84082IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to impro…0.7%심각9.8
CVE-2026-67370Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an a…0.7%높음8.8
CVE-2026-88075Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuratio…0.6%높음8.8
CVE-2026-61667DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.2…0.7%심각9.9
CVE-2026-65980Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data t…0.7%높음7.9
CVE-2026-55416Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an a…0.6%높음8.8
CVE-2026-84064IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL command…0.6%심각9.9
CVE-2026-8462SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all plat…0.6%높음8.9
CVE-2026-65128NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injectio…0.6%높음8.8
CVE-2026-9855The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parame…0.6%보통6.5
CVE-2026-77051Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache S…0.6%심각9.8
CVE-2026-82232Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache S…0.6%심각9.8
CVE-2026-86460Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. Thi…0.6%심각9.8
CVE-2026-80441IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability…0.6%심각9.8
CVE-2026-105781Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Comm…0.5%심각10.0
CVE-2026-82011Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Comm…0.6%심각9.1
CVE-2026-85652The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQ…0.6%보통6.5
CVE-2026-75682Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injec…0.5%심각9.9
CVE-2026-84239IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information …0.5%높음7.6
CVE-2026-66820Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an a…0.5%높음8.8
CVE-2026-114358This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied inp…0.5%심각9.3
CVE-2026-61685ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints …0.5%높음7.5
CVE-2026-55572e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db au…0.5%심각10.0
CVE-2026-62849ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in th…0.5%심각9.1
CVE-2026-26245A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user acc…0.5%높음7.1
CVE-2026-26244A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user acc…0.5%높음7.1
CVE-2026-104354Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Comm…0.5%심각9.1
CVE-2026-97882A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3f…0.5%보통5.5
CVE-2026-119418CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying…0.5%심각9.2
CVE-2026-107083SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin…0.5%심각9.8
CVE-2026-61818pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_parti…0.5%높음8.5
CVE-2026-105489Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Comm…0.5%심각9.9
CVE-2026-55680WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/…0.5%심각9.8
CVE-2026-6295The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up …0.5%보통4.9
CVE-2025-63564SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbi…0.5%심각9.8
CVE-2026-78082Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP P…0.5%심각9.3
CVE-2026-84993MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior t…0.5%보통6.5
CVE-2026-75961The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injectio…0.5%보통4.9
CVE-2026-89076Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress…0.5%높음7.2
CVE-2026-92366A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the fi…0.5%보통5.5
CVE-2026-93426SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_r…0.5%높음8.4
CVE-2026-18442The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic S…0.5%높음7.5
CVE-2026-76477As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco E…0.5%높음8.8
CVE-2022-51021NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability…0.5%높음8.8
CVE-2019-25778SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to man…0.5%높음8.8
CVE-2026-93904The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to…0.5%높음7.5
CVE-2026-18782Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Dig…0.5%심각9.8
CVE-2026-55684WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema…0.5%심각9.8
CVE-2026-55683WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema…0.5%심각9.8
CVE-2026-79752CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsB…0.5%심각9.2
CVE-2026-54524Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user…0.5%높음7.1
CVE-2026-89310A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escapin…0.5%심각9.4
CVE-2026-110614Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic qu…0.5%높음7.1
CVE-2026-110609Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated l…0.5%높음7.1
CVE-2026-53556SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /…0.5%보통6.0
CVE-2015-20122Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in …0.5%높음8.7
CVE-2026-91848A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDat…0.5%보통5.5
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.