cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 138

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE. OWASP Top 10: A05:2025 Injection

Related attack patterns (CAPEC): 6
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-66 SQL Injection Likelihood: High · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-470 Expanding Control over the Operating System from the Database Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-89, as MITRE names them. Credits.

Ask an AI about CWE-89

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2025-4226EPSS 0.6%

    A vulnerability classified as critical has been found in PHPGurukul/Campcodes Cyber Cafe Management System 1.0. This affects an unknown part of the file /add-computer.php. The manipulation of the argument compname/comploc leads to sql inje…

  2. 6.9CVE-2025-4214EPSS 0.6%

    A vulnerability was found in PHPGuruku Online DJ Booking Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/booking-bwdates-reports-details.php. The manipulation of the argument …

  3. 6.9CVE-2025-4213EPSS 0.4%

    A vulnerability has been found in PHPGurukul Online Birth Certificate System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search.php. The manipulation of the argument searchdata leads to sql in…

  4. 7.5CVE-2025-4204EPSS 0.4%

    The Ultimate Auction Pro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient prep…

  5. 9.8CVE-2025-2812EPSS 0.5%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mydata Informatics Ticket Sales Automation allows Blind SQL Injection. This issue affects Ticket Sales Automation: before 03.04.2025 (DD…

  6. 9.8CVE-2025-3708EPSS 0.6%

    Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

  7. 6.5CVE-2025-3707EPSS 0.4%

    The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL command to read database contents.

  8. 7.5CVE-2024-13344EPSS 0.4%

    The Advance Seat Reservation Management for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'profileId' parameter in all versions up to, and including, 3.3 due to insufficient escaping on the user supplied parameter…

  9. 7.5CVE-2024-13322ExploitEPSS 1.8%

    The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the 'a_id' parameter in all versions up to, and including, 4.88 due to insufficient escaping on the user supplied para…

  10. 6.5CVE-2024-12023EPSS 0.4%

    The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin…

  11. 5.3CVE-2025-4197EPSS 0.5%

    A vulnerability classified as critical has been found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file /edit_xpatient.php. The manipulation of the argument lastname leads to sql injection. …

  12. 5.3CVE-2025-4196EPSS 0.5%

    A vulnerability was found in SourceCodester Patient Record Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /birthing.php. The manipulation of the argument comp_id leads to sql in…

  13. 6.9CVE-2025-4195EPSS 0.6%

    A vulnerability was found in itsourcecode Gym Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /ajax.php?action=save_member. The manipulation of the argument umember_id leads to s…

  14. 6.9CVE-2025-4193EPSS 0.6%

    A vulnerability was found in itsourcecode Restaurant Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/category_update.php. The manipulation of the argument Category l…

  15. 6.9CVE-2025-4192EPSS 0.6%

    A vulnerability was found in itsourcecode Restaurant Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/category_save.php. The manipulation of the argument Category leads to sql injec…

  16. 5.5CVE-2025-4191EPSS 0.6%

    A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /editmyeducation.php. The manipulation of the argument co…

  17. 6.9CVE-2025-4176EPSS 0.6%

    A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as critical. This vulnerability affects unknown code of the file /admin/request-received-bydonar.php. The manipulation of the argument sea…

  18. 6.9CVE-2025-4174EPSS 0.6%

    A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username l…

  19. 10.0CVE-2025-46337EPSS 0.8%

    ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. Prior to version 5.22.9, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when …

  20. 5.3CVE-2025-4173EPSS 0.5%

    A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_cart of the file /oews/classes/Master.php?f=delete_cart. The manipulation of the argument ID …

  21. 6.9CVE-2025-4164EPSS 0.6%

    A vulnerability, which was classified as critical, was found in PHPGurukul Employee Record Management System 1.3. Affected is an unknown function of the file changepassword.php. The manipulation of the argument currentpassword leads to sql…

  22. 5.3CVE-2025-4163EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in PHPGurukul Land Record System 1.0. This issue affects some unknown processing of the file /admin/aboutus.php. The manipulation of the argument pagetitle leads to sql inje…

  23. 5.3CVE-2025-4157EPSS 0.5%

    A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/booking-details.php. The manipulation of the argument Status leads to sql injection. …

  24. 5.3CVE-2025-4156EPSS 0.5%

    A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/change-image.php. The manipulation of the argument ID leads to sql injection. The a…

  25. 5.3CVE-2025-4155EPSS 0.5%

    A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file /admin/edit-boat.php. The manipulation of the argument bid leads to sql injection. It is possible …

  26. 5.3CVE-2025-4154EPSS 0.5%

    A vulnerability, which was classified as critical, has been found in PHPGurukul Pre-School Enrollment System 1.0. Affected by this issue is some unknown functionality of the file /admin/enrollment-details.php. The manipulation of the argum…

  27. 6.9CVE-2025-4153EPSS 0.6%

    A vulnerability classified as critical was found in PHPGurukul Park Ticketing Management System 2.0. Affected by this vulnerability is an unknown functionality of the file /profile.php. The manipulation of the argument adminname leads to s…

  28. 6.9CVE-2025-4152EPSS 0.4%

    A vulnerability classified as critical has been found in PHPGurukul Online Birth Certificate System 1.0. Affected is an unknown function of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql…

  29. 6.9CVE-2025-4151EPSS 0.6%

    A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/pass-bwdates-reports-details.php. The manipulation of the argument fr…

  30. 7.3CVE-2025-44194EPSS 0.4%

    SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_household.

  31. 7.6CVE-2025-44193EPSS 0.4%

    SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_complaint.

  32. 9.8CVE-2025-44192EPSS 0.5%

    SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_clearance.

  33. 5.3CVE-2025-45021EPSS 0.2%

    A SQL Injection vulnerability was identified in the admin/edit-directory.php file of the PHPGurukul Directory Management System v2.0. Attackers can exploit this vulnerability via the email parameter in a POST request to execute arbitrary S…

  34. 5.4CVE-2025-45019EPSS 0.5%

    A SQL injection vulnerability was discovered in /add-foreigners-ticket.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the cprice POST request parameter.

  35. 9.8CVE-2025-45018EPSS 0.6%

    A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the todate par…

  36. 9.8CVE-2025-45017EPSS 0.8%

    A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the tprice POST request parameter.

  37. 7.2CVE-2025-45020EPSS 0.6%

    A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the todate parame…

  38. 5.3CVE-2025-4113EPSS 0.5%

    A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/edit-pass-detail.php. The manipulation of the argument editid leads t…

  39. 6.9CVE-2025-4112EPSS 0.6%

    A vulnerability was found in PHPGurukul Student Record System 3.20. It has been declared as critical. This vulnerability affects unknown code of the file /add-course.php. The manipulation of the argument course-short leads to sql injection…

  40. 5.3CVE-2025-4111EPSS 0.5%

    A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/visitor-details.php. The manipulation of the argument Status leads to sql injecti…

  41. 5.3CVE-2025-4110EPSS 0.5%

    A vulnerability was found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/edit-teacher.php. The manipulation of the argument mobilenumber le…

  42. 5.3CVE-2025-4109EPSS 0.5%

    A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit-subadmin.php. The manipulation of the argument mob…

  43. 6.9CVE-2025-4108EPSS 0.6%

    A vulnerability, which was classified as critical, was found in PHPGurukul Student Record System 3.20. Affected is an unknown function of the file /add-subject.php. The manipulation of the argument sub1 leads to sql injection. It is possib…

  44. 6.5CVE-2025-2890EPSS 0.4%

    The tagDiv Opt-In Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘subscriptionCouponId’ parameter in all versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter and lac…

  45. 5.3CVE-2025-4080EPSS 0.5%

    A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/view-request.php. The manipulation of the argument viewid…

  46. 6.9CVE-2025-4074EPSS 0.6%

    A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/pass-bwdates-report.php. The manipulation of the a…

  47. 6.9CVE-2025-4073EPSS 0.6%

    A vulnerability was found in PHPGurukul Student Record System 3.20. It has been classified as critical. Affected is an unknown function of the file /change-password.php. The manipulation of the argument currentpassword leads to sql injecti…

  48. 5.3CVE-2025-4072EPSS 0.5%

    A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/edit-nurse.php. The manipulation leads to sql injection. The attack may be ini…

  49. 8.8CVE-2025-45956EPSS 0.5%

    A SQL injection vulnerability in manage_damage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arbitrary SQL commands via the "id" parameter

  50. 6.9CVE-2025-4071EPSS 0.6%

    A vulnerability has been found in PHPGurukul COVID19 Testing Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /test-details.php. The manipulation of the argument Status leads to sql inje…