SQL injection

SQL injection exploits sites that handle user-entered data incorrectly. The attacker "appends" a special fragment to a form or URL that the database treats as a command, and as a result can read, change or delete data, including accounts and passwords.

It is one of the most dangerous and oldest classes of vulnerability. It is prevented by building queries correctly (so-called parameterised queries) and by keeping plugins and the CMS core up to date, where such bugs are patched.