cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 122

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 6
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-66 SQL Injection Likelihood: High · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-470 Expanding Control over the Operating System from the Database Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-89, as MITRE names them. Credits.

Ask an AI about CWE-89

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2025-6891EPSS 0.5%

    A vulnerability classified as critical has been found in code-projects Inventory Management System 1.0. Affected is an unknown function of the file /php_action/createUser.php. The manipulation of the argument Username leads to sql injectio…

  2. 2.1CVE-2025-6890EPSS 0.4%

    A vulnerability was found in code-projects Movie Ticketing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ticketConfirmation.php. The manipulation of the argument Date leads to sql inject…

  3. 5.5CVE-2025-6889EPSS 0.5%

    A vulnerability was found in code-projects Movie Ticketing System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /logIn.php. The manipulation of the argument postName leads to sql injection. The …

  4. 5.5CVE-2025-6888EPSS 0.5%

    A vulnerability was found in PHPGurukul Teachers Record Management System 2.1. It has been classified as critical. This affects an unknown part of the file /admin/changeimage.php. The manipulation of the argument tid leads to sql injection…

  5. 5.5CVE-2025-6885EPSS 0.5%

    A vulnerability, which was classified as critical, was found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/edit-teacher-detail.php. The manipulation of the argument tid leads to sql…

  6. 2.1CVE-2025-6884EPSS 0.4%

    A vulnerability, which was classified as critical, has been found in code-projects Staff Audit System 1.0. This issue affects some unknown processing of the file /search_index.php. The manipulation of the argument Search leads to sql injec…

  7. 2.1CVE-2025-6883EPSS 0.3%

    A vulnerability classified as critical was found in code-projects Staff Audit System 1.0. This vulnerability affects unknown code of the file /update_index.php. The manipulation of the argument updateid leads to sql injection. The attack c…

  8. 2.1CVE-2025-6880EPSS 0.5%

    A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/edit-tax.php. The manipulation of the argument editid leads to sql injection. It i…

  9. 2.1CVE-2025-6879EPSS 0.5%

    A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /panel/add-tax.php. The manipulation of the argument Name leads to sql inje…

  10. 2.1CVE-2025-6878EPSS 0.4%

    A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /panel/search-appointment.php. The manipulation of the argument searchdata …

  11. 2.1CVE-2025-6877EPSS 0.5%

    A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /panel/edit-category.php. The manipulation of the argument editid leads to sql injec…

  12. 2.1CVE-2025-6876EPSS 0.5%

    A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /panel/add-category.php. The manipulation of the argument Name leads …

  13. 2.1CVE-2025-6875EPSS 0.5%

    A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /panel/edit-subscription.php. The manipulation of the argu…

  14. 2.1CVE-2025-6874EPSS 0.5%

    A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/add_subscribe.php. The manipulation of the argument user_id/plan_id leads t…

  15. 5.5CVE-2025-6871EPSS 0.6%

    A vulnerability classified as critical has been found in SourceCodester Simple Company Website 1.0. This affects an unknown part of the file /classes/Login.php. The manipulation of the argument Username leads to sql injection. It is possib…

  16. 2.0CVE-2025-6869EPSS 0.5%

    A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/testimonials/manage.php. The manipulation of the argume…

  17. 9.9CVE-2025-24290EPSS 0.4%

    Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow a malicious actor with low privileges to escalate privileges.

  18. 2.0CVE-2025-6868EPSS 0.4%

    A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/clients/manage.php. The manipulation of the argument ID leads to sql injection. …

  19. 2.0CVE-2025-6867EPSS 0.4%

    A vulnerability was found in SourceCodester Simple Company Website 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/services/manage.php. The manipulation of the argument ID leads to sql injectio…

  20. 5.5CVE-2025-6863EPSS 0.5%

    A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/edit-category-detail.php. The manipulation of …

  21. 2.1CVE-2025-6862EPSS 0.5%

    A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/edit_plan.php. The manipulation of the argument editid leads to sql injection. It …

  22. 2.1CVE-2025-6861EPSS 0.5%

    A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /panel/add_plan.php. The manipulation of the argument plan_name/description…

  23. 2.1CVE-2025-6860EPSS 0.5%

    A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /panel/staff_commision.php. The manipulation of the argument fromdate/todat…

  24. 2.1CVE-2025-6859EPSS 0.5%

    A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /panel/pro_sale.php. The manipulation of the argument fromdate/todate leads to sql i…

  25. 2.1CVE-2025-6850EPSS 0.4%

    A vulnerability has been found in code-projects Simple Forum 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /forum1.php. The manipulation of the argument File leads to sql injection. …

  26. 2.1CVE-2025-6847EPSS 0.4%

    A vulnerability classified as critical was found in code-projects Simple Forum 1.0. This vulnerability affects unknown code of the file /forum_edit.php. The manipulation of the argument iii leads to sql injection. The attack can be initiat…

  27. 5.5CVE-2025-6846EPSS 0.4%

    A vulnerability classified as critical has been found in code-projects Simple Forum 1.0. This affects an unknown part of the file /forum_viewfile.php. The manipulation of the argument Name leads to sql injection. It is possible to initiate…

  28. 5.5CVE-2025-6845EPSS 0.5%

    A vulnerability was found in code-projects Simple Forum 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /register1.php. The manipulation of the argument User leads to sql injection. The …

  29. 5.5CVE-2025-6844EPSS 0.5%

    A vulnerability was found in code-projects Simple Forum 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /signin.php. The manipulation of the argument User leads to sql injection…

  30. 2.0CVE-2025-6842EPSS 0.4%

    A vulnerability was found in code-projects Product Inventory System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/edit_user.php. The manipulation of the argument ID leads to sql injection. Th…

  31. 2.0CVE-2025-6841EPSS 0.4%

    A vulnerability has been found in code-projects Product Inventory System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/edit_product.php. The manipulation of the argument ID leads to sql injectio…

  32. 5.5CVE-2025-6840EPSS 0.5%

    A vulnerability, which was classified as critical, was found in code-projects Product Inventory System 1.0. This affects an unknown part of the file /index.php of the component Login. The manipulation of the argument Username leads to sql …

  33. 5.5CVE-2025-6836EPSS 0.5%

    A vulnerability classified as critical has been found in code-projects Library System 1.0. Affected is an unknown function of the file /profile.php. The manipulation of the argument phone leads to sql injection. It is possible to launch th…

  34. 5.5CVE-2025-6835EPSS 0.5%

    A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student-issue-book.php. The manipulation of the argument reg leads to sql injection. The …

  35. 5.5CVE-2025-6834EPSS 0.5%

    A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/editPayment.php. The manipulation of the argument orderId leads t…

  36. 5.3CVE-2025-6829EPSS 0.4%

    A vulnerability was found in aaluoxiang oa_system up to c3a08168c144f27256a90838492c713f55f1b207 and classified as critical. This issue affects the function outAddress of the component External Address Book Handler. The manipulation leads …

  37. 5.5CVE-2025-6828EPSS 0.5%

    A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /orders.php. The manipulation of the argument i leads to sql injection. The att…

  38. 5.5CVE-2025-6827EPSS 0.5%

    A vulnerability, which was classified as critical, was found in code-projects Inventory Management System 1.0. This affects an unknown part of the file /php_action/editOrder.php. The manipulation leads to sql injection. It is possible to i…

  39. 5.5CVE-2025-6826EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in code-projects Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /Payroll_Management_System/ajax.php?action=save_department. …

  40. 5.5CVE-2025-6823EPSS 0.5%

    A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /php_action/editProduct.php. The manipulation of the argument editProductName…

  41. 5.5CVE-2025-6822EPSS 0.5%

    A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /php_action/removeProduct.php. The manipulation of the argument productId lea…

  42. 5.5CVE-2025-6821EPSS 0.5%

    A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /php_action/createOrder.php. The manipulation leads to sql injection. It is possible t…

  43. 5.5CVE-2025-6820EPSS 0.5%

    A vulnerability was found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /php_action/createProduct.php. The manipulation of the argument product…

  44. 5.5CVE-2025-6819EPSS 0.5%

    A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /php_action/removeBrand.php. The manipulation of the argumen…

  45. 5.5CVE-2025-6777EPSS 0.6%

    A vulnerability, which was classified as critical, has been found in code-projects Food Distributor Site 1.0. This issue affects some unknown processing of the file /admin/process_login.php. The manipulation of the argument username/passwo…

  46. 9.8CVE-2024-12364EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection. This issue affects Guest Tracking Software.  NOTE: The vendor did not…

  47. 9.8CVE-2024-12150EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection. This issue affects Wowwo CRM.  NOTE: The vendor did not inform about the completion…

  48. 9.8CVE-2024-12143EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection. This issue affects Mikro Hand Terminal - MikroDB.  NOTE…

  49. 9.8CVE-2024-11739EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection. This issue affects Case ERP: before V2.0.1.

  50. 10.0CVE-2025-53091EPSS 0.5%

    WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlm…