cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 40

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE

Ask an AI about CWE-89

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2026-13487EPSS 0.4%

    A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive.php. The manipulation of the argument sy leads to sql injection. The attack may be initiated remot…

  2. 5.5CVE-2026-13486EPSS 0.4%

    A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This impacts an unknown function of the file /preview6.php. Executing a manipulation of the argument course_year_section can lead to sql injectio…

  3. 5.5CVE-2026-13485EPSS 0.4%

    A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /preview.php. Performing a manipulation of the argument course_year_section results in sql injection. The attac…

  4. 6.5CVE-2026-13333EPSS 0.6%

    The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via 'query[select]' Parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supp…

  5. 6.5CVE-2026-13331EPSS 0.5%

    The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versions up to, and including, 4.5.5 due to insufficient escaping on the user supplie…

  6. 9.8CVE-2026-54350EPSS 0.5%

    Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collect…

  7. 9.9CVE-2026-52785EPSS 0.4%

    OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection in timestamps functionality. OpenProject baseline comparison allows callers to request historic work-package attributes…

  8. 8.5CVE-2026-57667EPSS 0.4%

    Sales Representative SQL Injection in Groundhogg <= 4.5 versions.

  9. 8.5CVE-2026-57663EPSS 0.4%

    Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.

  10. 8.5CVE-2026-57662EPSS 0.4%

    Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.

  11. 8.5CVE-2026-57653EPSS 0.4%

    Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.

  12. 8.5CVE-2026-57644EPSS 0.4%

    Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.

  13. 8.5CVE-2026-57643EPSS 0.4%

    Contributor SQL Injection in WP Post Author <= 3.9.1 versions.

  14. 8.5CVE-2026-57642EPSS 0.4%

    Contributor SQL Injection in Gallery <= 4.7.8 versions.

  15. 8.5CVE-2026-57636EPSS 0.4%

    Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.

  16. 7.6CVE-2026-57631EPSS 0.4%

    Administrator SQL Injection in Popup box <= 6.0.1 versions.

  17. 7.6CVE-2026-57628EPSS 0.4%

    Administrator SQL Injection in WP All Import <= 4.0.1 versions.

  18. 9.3CVE-2026-56070ExploitEPSS 1.4%

    Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.

  19. 9.3CVE-2026-56068EPSS 0.4%

    Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.

  20. 9.3CVE-2026-56067EPSS 0.5%

    Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.

  21. 8.5CVE-2026-56064EPSS 0.4%

    Subscriber SQL Injection in Tourfic <= 2.22.5 versions.

  22. 9.3CVE-2026-56062ExploitEPSS 1.4%

    Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.

  23. 9.3CVE-2026-56036EPSS 0.4%

    Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.

  24. 9.3CVE-2026-56034EPSS 0.4%

    Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.

  25. 9.3CVE-2026-54831EPSS 0.4%

    Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.

  26. 9.3CVE-2026-54827EPSS 0.4%

    Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.

  27. 9.3CVE-2026-54825EPSS 0.4%

    Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.

  28. 9.3CVE-2026-54820EPSS 0.4%

    Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.

  29. 6.5CVE-2026-13226EPSS 0.5%

    The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied…

  30. 7.2CVE-2026-40083EPSS 0.5%

    Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selected_items…

  31. 7.7CVE-2026-37149EPSS 0.2%

    GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive dat…

  32. 1.8CVE-2026-57588ExploitEPSS 0.3%

    A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQL into the scan results database, potentially enabling exfiltration of scan-resu…

  33. 2.9CVE-2026-57587EPSS 0.4%

    A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result …

  34. 9.3CVE-2026-54849EPSS 0.4%

    Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

  35. 9.3CVE-2026-54843EPSS 0.4%

    Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

  36. 8.5CVE-2026-54838EPSS 0.4%

    Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.

  37. 9.3CVE-2026-54836ExploitEPSS 1.3%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.

  38. 7.5CVE-2026-54829EPSS 0.3%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.

  39. 8.5CVE-2026-54822EPSS 0.4%

    Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.

  40. 7.5CVE-2026-12937EPSS 0.5%

    The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient e…

  41. 6.5CVE-2026-2508EPSS 0.4%

    The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of suffi…

  42. 6.5CVE-2026-12079EPSS 0.4%

    The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara…

  43. 7.5CVE-2026-12077EPSS 0.5%

    The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack…

  44. 8.8CVE-2026-9786EPSS 0.9%

    Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is requ…

  45. 8.8CVE-2026-9785EPSS 0.9%

    Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is re…

  46. 8.8CVE-2026-9784EPSS 0.9%

    Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is re…

  47. 8.8CVE-2026-9783EPSS 0.9%

    Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is…

  48. 8.8CVE-2026-9782EPSS 0.9%

    Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is re…

  49. 8.8CVE-2026-9781EPSS 0.9%

    Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is requ…

  50. 8.8CVE-2026-7570EPSS 0.9%

    Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is requ…