cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 33

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE

Ask an AI about CWE-89

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.3CVE-2026-59549EPSS 0.4%

    Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

  2. 9.3CVE-2026-59538EPSS 0.4%

    Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.

  3. 7.6CVE-2026-59537EPSS 0.4%

    Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions.

  4. 9.3CVE-2026-59533EPSS 0.4%

    Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.

  5. 9.3CVE-2026-59527EPSS 0.4%

    Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

  6. 8.2CVE-2026-65877EPSS 0.4%

    Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector.

  7. 9.2CVE-2026-65876EPSS 0.4%

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.

  8. 9.2CVE-2026-65766EPSS 0.4%

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector.

  9. 3.8CVE-2026-14189EPSS 0.3%

    The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers…

  10. 8.5CVE-2026-65707EPSS 0.5%

    Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount me…

  11. 4.9CVE-2026-15663EPSS 0.5%

    The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user…

  12. 5.5CVE-2026-16765EPSS 0.4%

    A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection.…

  13. 9.3CVE-2026-63359EPSS 0.7%

    The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other us…

  14. 9.3CVE-2026-65761ExploitEPSS 1.0%

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including c…

  15. 7.6CVE-2026-65532EPSS 0.4%

    Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions.

  16. 8.5CVE-2026-65526EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1.

  17. 7.1CVE-2026-65494EPSS 0.3%

    Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions.

  18. 7.6CVE-2026-65462EPSS 0.4%

    Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

  19. 8.5CVE-2026-65454EPSS 0.4%

    Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

  20. 8.5CVE-2026-65451EPSS 0.4%

    Contributor SQL Injection in MapSVG <= 8.14.0 versions.

  21. 8.5CVE-2026-65450EPSS 0.4%

    Contributor SQL Injection in MapSVG <= 8.14.0 versions.

  22. 9.3CVE-2026-61950EPSS 0.4%

    Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.

  23. 9.3CVE-2026-61949EPSS 0.4%

    Unauthenticated SQL Injection in Bookly <= 27.7 versions.

  24. 9.3CVE-2026-61948EPSS 0.4%

    Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.

  25. 9.3CVE-2026-59526EPSS 0.4%

    Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

  26. 9.3CVE-2026-59525EPSS 0.4%

    Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.

  27. 9.3CVE-2026-59514EPSS 0.4%

    Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.

  28. 8.5CVE-2026-25405EPSS 0.4%

    Contributor SQL Injection in eRoom <= 1.7.1 versions.

  29. 8.5CVE-2026-24552EPSS 0.4%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3.

  30. 6.5CVE-2026-15906EPSS 0.5%

    The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied par…

  31. 6.5CVE-2026-15761EPSS 0.5%

    The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied para…

  32. 6.5CVE-2026-15448EPSS 0.4%

    The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user suppli…

  33. 6.5CVE-2026-13119EPSS 0.4%

    The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes a…

  34. 6.5CVE-2026-13009EPSS 0.5%

    The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack o…

  35. 7.5CVE-2026-9713EPSS 0.5%

    The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.…

  36. 9.8CVE-2026-2395EPSS 0.5%

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before …

  37. 7.5CVE-2026-12987EPSS 0.5%

    The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without r…

  38. 2.1CVE-2026-16490EPSS 0.3%

    A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed…

  39. 6.3CVE-2026-62528EPSS 0.3%

    Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with…

  40. 6.3CVE-2026-62527EPSS 0.3%

    Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker wi…

  41. 8.8CVE-2026-62516EPSS 0.5%

    Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker …

  42. 6.3CVE-2026-61294EPSS 0.3%

    Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Calendar Synchronizations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privi…

  43. 6.3CVE-2026-61266EPSS 0.3%

    Vulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite (component: Copy Inventory Organization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privi…

  44. 8.3CVE-2026-60582EPSS 0.4%

    Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with net…

  45. 5.5CVE-2026-16484EPSS 0.4%

    A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_subjecta.php. This manipulation of the argument ID causes sql injection. The attack…

  46. 7.1CVE-2026-63080EPSS 0.4%

    Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL tem…

  47. 7.5CVE-2026-52476EPSS 0.5%

    SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file

  48. 9.8CVE-2026-52472EPSS 0.6%

    SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file

  49. 9.8CVE-2026-52470EPSS 0.6%

    SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file

  50. 9.8CVE-2026-52469EPSS 0.6%

    SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file