cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 28

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE

Ask an AI about CWE-89

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.3CVE-2026-66458EPSS 0.4%

    Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.

  2. 9.3CVE-2026-66446EPSS 0.4%

    Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.

  3. 9.3CVE-2026-66436EPSS 0.4%

    Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.

  4. 8.5CVE-2026-66430EPSS 0.4%

    Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.

  5. 9.3CVE-2026-61969EPSS 0.4%

    Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

  6. 9.3CVE-2026-61966EPSS 0.4%

    Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

  7. 8.5CVE-2026-28168EPSS 0.4%

    Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

  8. 8.5CVE-2026-28156EPSS 0.4%

    Subscriber SQL Injection in Do Lasso <= 358 versions.

  9. 9.3CVE-2026-28142EPSS 0.4%

    Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

  10. 8.5CVE-2026-28002EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.

  11. 9.3CVE-2026-28001EPSS 0.4%

    Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

  12. 7.5CVE-2026-27538EPSS 0.3%

    Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

  13. 8.8CVE-2026-15741EPSS 0.4%

    SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, …

  14. 8.8CVE-2026-11840EPSS 3.1%

    Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.

  15. 9.2CVE-2026-73332EPSS 0.4%

    CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through…

  16. 7.1CVE-2026-73331EPSS 0.4%

    CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates a…

  17. 8.8CVE-2026-72807EPSS 0.3%

    SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which executes raw SQL using string substitution instead of parameterized queries. At…

  18. 7.5CVE-2026-67579EPSS 0.6%

    Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the da…

  19. 9.8CVE-2026-17111EPSS 0.5%

    IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

  20. 9.6CVE-2026-73300EPSS 0.6%

    Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject m…

  21. 8.8CVE-2026-44741EPSS 0.5%

    Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is …

  22. 6.5CVE-2026-17419EPSS 0.4%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.

  23. 7.8CVE-2026-17418EPSS 0.3%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command.

  24. 4.3CVE-2026-17222EPSS 0.3%

    IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command.

  25. 5.3CVE-2025-41771EPSS 0.3%

    An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore,…

  26. 9.3CVE-2026-66659EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.

  27. 8.6CVE-2026-18474EPSS 0.4%

    The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configu…

  28. 8.1CVE-2026-18230EPSS 0.4%

    The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated us…

  29. 8.1CVE-2026-18057EPSS 0.4%

    The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with …

  30. 8.1CVE-2026-16977EPSS 0.4%

    The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perfo…

  31. 8.8CVE-2026-13613EPSS 0.4%

    The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.

  32. 9.8CVE-2026-73211EPSS 0.7%

    PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to r…

  33. 9.0CVE-2026-48381EPSS 0.8%

    Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker…

  34. 8.7CVE-2022-50997EPSS 0.6%

    Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arbitrary data from the backend database by manipulating the id G…

  35. 8.7CVE-2016-20097EPSS 0.6%

    Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by injecting a UNION SELECT payload into the markId GET parameter, wh…

  36. 7.8CVE-2026-65673EPSS 0.3%

    Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges over a network.

  37. 9.1CVE-2026-73069EPSS 0.7%

    Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector …

  38. 9.8CVE-2026-46670ExploitEPSS 2.0%

    YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary …

  39. 5.8CVE-2026-72775EPSS 0.5%

    n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper es…

  40. 5.3CVE-2026-72750EPSS 0.5%

    n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, ext…

  41. 4.3CVE-2026-72610EPSS 0.3%

    A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in …

  42. 7.1CVE-2026-72609EPSS 0.4%

    An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in …

  43. 6.5CVE-2026-72608EPSS 0.4%

    A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout…

  44. 7.1CVE-2026-72607EPSS 0.5%

    A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agef…

  45. 9.8CVE-2026-72599EPSS 0.6%

    An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated a…

  46. 8.8CVE-2026-72562EPSS 0.4%

    An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the …

  47. 8.8CVE-2026-72558EPSS 0.4%

    An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization…

  48. 9.8CVE-2026-72550EPSS 0.6%

    An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW …

  49. 9.3CVE-2026-19425EPSS 0.6%

    Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

  50. 6.3CVE-2026-66770EPSS 0.3%

    Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying database without further authorization. Successful exploitat…