cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 24

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE

Ask an AI about CWE-89

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.4CVE-2026-38467EPSS 0.3%

    A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands via the tagid …

  2. 8.6CVE-2026-75498EPSS 0.8%

    Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. Fixed in 123…

  3. 8.6CVE-2026-75497EPSS 0.8%

    Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. Fixe…

  4. 5.3CVE-2026-78864EPSS 0.3%

    A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journey/journey.controller.t of the component Journey Entry Update. This manipulation…

  5. 4.9CVE-2026-77824EPSS 0.5%

    The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and la…

  6. 8.8CVE-2026-19949EPSS 1.0%

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack o…

  7. 7.7CVE-2026-77137EPSS 0.4%

    The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation req…

  8. 2.1CVE-2026-78656EPSS 0.3%

    A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. T…

  9. 6.5CVE-2026-78470EPSS 0.4%

    The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL q…

  10. 6.5CVE-2026-15023EPSS 0.6%

    The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Location Duplicate Action in all versions up to, and including, 7.4.0 due to insufficie…

  11. 9.3CVE-2026-32555EPSS 0.4%

    Unauthenticated SQL Injection in Boost <= 2.0.4 versions.

  12. 9.3CVE-2026-32554EPSS 0.4%

    Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions.

  13. 9.2CVE-2026-77635EPSS 0.5%

    CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is …

  14. 5.5CVE-2026-78248EPSS 0.4%

    A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action=save_settings. This manipulation of the argument Name causes sql injection. The…

  15. 5.5CVE-2026-78247EPSS 0.4%

    A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirm_order. The manipulation of the argument ID results in sql injecti…

  16. 7.6CVE-2026-78270EPSS 0.4%

    Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.

  17. 5.5CVE-2026-78246EPSS 0.4%

    A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql …

  18. 9.3CVE-2026-32551EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.

  19. 8.5CVE-2026-32478EPSS 0.4%

    Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions.

  20. 8.5CVE-2026-32471EPSS 0.4%

    Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions.

  21. 5.5CVE-2026-78244EPSS 0.4%

    A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/proper…

  22. 8.8CVE-2026-78317EPSS 0.7%

    SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

  23. 8.8CVE-2026-78316EPSS 0.7%

    SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

  24. 8.8CVE-2026-78315EPSS 0.7%

    SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

  25. 8.8CVE-2026-78314EPSS 0.7%

    SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

  26. 9.3CVE-2026-77994EPSS 0.4%

    Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model.

  27. 5.5CVE-2026-78201EPSS 0.4%

    A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carri…

  28. 2.1CVE-2026-78200EPSS 0.3%

    A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed r…

  29. 5.5CVE-2026-78199EPSS 0.4%

    A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitati…

  30. 5.5CVE-2026-78198EPSS 0.4%

    A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Such manipulation of the argument pid leads…

  31. 5.5CVE-2026-78197EPSS 0.4%

    A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.php?action=save_user. This manipulation of the argument Username causes sql inject…

  32. 2.1CVE-2026-78185EPSS 0.3%

    A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulation of the argument ID results in sql injection. The attack can be exec…

  33. 5.5CVE-2026-78182EPSS 0.4%

    A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v…

  34. 5.5CVE-2026-78171EPSS 0.4%

    A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It…

  35. 5.5CVE-2026-78143EPSS 0.4%

    A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument …

  36. 2.1CVE-2026-78112EPSS 0.3%

    A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This manipulation of the argument delid causes sql injection. The attack may be initiat…

  37. 2.1CVE-2026-78057EPSS 0.3%

    A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown part of the component Management Mutation Handler. This manipulation of the argument roll_no/name/father_n…

  38. 2.1CVE-2026-78056EPSS 0.3%

    A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is some unknown functionality of the component Dashboard. The manipulation of the argument roll_no/t…

  39. 9.3CVE-2026-76602EPSS 0.4%

    Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors.

  40. 9.3CVE-2026-76571EPSS 0.4%

    Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery()…

  41. 9.8CVE-2026-76904ExploitEPSS 4.0%

    GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataSto…

  42. 5.9CVE-2026-53572EPSS 0.4%

    KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, w…

  43. 8.6CVE-2026-76613EPSS 0.4%

    Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.

  44. 6.8CVE-2026-16959ExploitEPSS 1.3%

    The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-library query handlers, allowing users with the Author role to perform SQL injection.

  45. 6.8CVE-2026-14601EPSS 0.4%

    The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users with the Editor role or above to perform SQL injection attacks.

  46. 2.1CVE-2026-77392EPSS 0.3%

    A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injecti…

  47. 9.9CVE-2026-68789EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

  48. 9.9CVE-2026-68782EPSS 1.0%

    Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

  49. 8.5CVE-2026-46682EPSS 0.6%

    BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/…

  50. 2.1CVE-2026-77025EPSS 0.3%

    A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manipulation of the argument delid causes sql injection. The attack is possible to be…