cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 10

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE

Ask an AI about CWE-89

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-79794EPSS 0.3%

    A SQL injection vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploit…

  2. 8.1CVE-2025-45871EPSS 0.3%

    LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name.

  3. 2.1CVE-2026-105957EPSS 0.2%

    A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/view_product.php. Performing a manipulation of the argument Category results in sql injec…

  4. 8.6CVE-2026-105856EPSS 0.3%

    Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enable…

  5. 9.8CVE-2026-105845EPSS 0.4%

    Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins ca…

  6. 2.1CVE-2026-105921EPSS 0.2%

    A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads to…

  7. 5.5CVE-2026-105920EPSS 0.3%

    A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration Endp…

  8. 5.5CVE-2026-105919EPSS 0.3%

    A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint…

  9. 5.5CVE-2026-105918EPSS 0.3%

    A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the a…

  10. 7.8CVE-2026-4889EPSS 0.3%

    SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection…

  11. 9.3CVE-2026-42417EPSS 0.3%

    Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

  12. 8.5CVE-2026-42416EPSS 0.3%

    Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

  13. 9.3CVE-2026-42415EPSS 0.2%

    Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

  14. 8.5CVE-2026-42414EPSS 0.3%

    Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

  15. 9.3CVE-2026-41555EPSS 0.2%

    Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.

  16. 9.3CVE-2026-39795EPSS 0.3%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brewlabs SendPress Newsletters sendpress allows Blind SQL Injection.This issue affects SendPress Newsletters: from n/a through 1.26.1.20.

  17. 9.3CVE-2026-39785EPSS 0.2%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.…

  18. 8.5CVE-2026-39771EPSS 0.3%

    Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.

  19. 9.3CVE-2026-39764EPSS 0.3%

    Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19 versions.

  20. 8.5CVE-2026-39747EPSS 0.3%

    Subscriber SQL Injection in Woffice <= 5.4.35 versions.

  21. 9.3CVE-2026-39746EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Booknetic Booknetic booknetic allows Blind SQL Injection.This issue affects Booknetic: from n/a before 5.10.3.

  22. 7.1CVE-2026-32581EPSS 0.3%

    Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.

  23. 7.5CVE-2026-32580EPSS 0.3%

    Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.

  24. 9.3CVE-2026-32557EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BookingWP WooCommerce Appointments woocommerce-appointments allows Blind SQL Injection.This issue affects WooCommerce Appointments: from …

  25. 8.5CVE-2026-25434EPSS 0.3%

    Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.

  26. 8.5CVE-2026-105317EPSS 0.3%

    Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.

  27. 6.9CVE-2026-105807EPSS 0.3%

    A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.

  28. 5.5CVE-2026-105776EPSS 0.3%

    A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. T…

  29. 2.1CVE-2026-105472EPSS 0.2%

    A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipul…

  30. 5.5CVE-2026-105471EPSS 0.3%

    A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipula…

  31. 5.5CVE-2026-105470EPSS 0.3%

    A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint. …

  32. 5.5CVE-2026-105469EPSS 0.3%

    A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file get_town.php of the component AJAX Endpoint. Executing a ma…

  33. 5.5CVE-2026-105468EPSS 0.3%

    A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file Admin/mlogin.php of the component Login Handler. Performing a man…

  34. 6.4CVE-2026-71298EPSS 0.3%

    A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extrac…

  35. 2.1CVE-2026-105388EPSS 0.2%

    A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function index of the file App/Feelcrm/Index/Controller/MemberController.class.php of the component Member Endpoint. This manipulation of the a…

  36. 8.5CVE-2026-103066EPSS 0.3%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking…

  37. 9.8CVE-2026-88424EPSS 0.3%

    FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). This vulnerability allows attackers to access sensitive database information via crafted SQL statement…

  38. 5.5CVE-2026-105387EPSS 0.3%

    A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file cover.php of the component Patient Login Handler. The m…

  39. 5.5CVE-2026-105386EPSS 0.3%

    A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this issue is the function get of the file print.php. The manipulation of the argument transaction_id le…

  40. 9.3CVE-2026-103352EPSS 0.2%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking…

  41. 5.5CVE-2026-105385EPSS 0.3%

    A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functionality of the file transaction_details.php. Executing a manipula…

  42. 5.5CVE-2026-105384EPSS 0.3%

    A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument patient_id results in sql i…

  43. 5.5CVE-2026-105383EPSS 0.3%

    A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This impacts an unknown function of the file php/controller.php. Such manipulation of the argument transaction_idS l…

  44. 6.5CVE-2026-88397EPSS 0.3%

    ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.

  45. 9.8CVE-2026-88395EPSS 0.4%

    GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.

  46. 9.3CVE-2026-102428EPSS 0.5%

    Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

  47. 2.1CVE-2026-105287EPSS 0.3%

    A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument g…

  48. 2.1CVE-2026-105254EPSS 0.2%

    A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely…

  49. 5.5CVE-2026-105253EPSS 0.3%

    A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be in…

  50. 7.6CVE-2026-104408EPSS 0.3%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind SQL Injection.This issue affects Groundhogg: from n/a through 4.8.3.