cve.bz

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection), page 71

Filter

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

What the weakness is: CWE-89 at MITRE

Related attack patterns (CAPEC): 6
  • CAPEC-7 Blind SQL Injection Likelihood: High · Severity: High
  • CAPEC-66 SQL Injection Likelihood: High · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-109 Object Relational Mapping Injection Likelihood: Low · Severity: High
  • CAPEC-110 SQL Injection through SOAP Parameter Tampering Likelihood: High · Severity: Very High
  • CAPEC-470 Expanding Control over the Operating System from the Database Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-89, as MITRE names them. Credits.

Ask an AI about CWE-89

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-89: Improper Neutralization of Special Elements used in an SQL Command and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/89.html and https://cve.bz/cve/cwe/89?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 2.7CVE-2026-26889EPSS 0.3%

    Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_category.php.

  2. 2.7CVE-2026-26888EPSS 0.3%

    Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_stock.php.

  3. 2.7CVE-2026-26887EPSS 0.3%

    Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_supplier.php.

  4. 2.7CVE-2026-26890EPSS 0.3%

    Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_product.php.

  5. 8.2CVE-2021-35484EPSS 0.3%

    Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/rest-proxy/campaign/statistic (for the View Campaign page) via the sortColumn HTT…

  6. 2.7CVE-2026-26886EPSS 0.3%

    Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /admin/services/manage_service.php.

  7. 2.7CVE-2026-26885EPSS 0.3%

    Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /classes/Master.php?f=delete_service.

  8. 2.7CVE-2026-26884EPSS 0.3%

    Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/admin/appointments/view_appointment.php.

  9. 2.7CVE-2026-26883EPSS 0.3%

    Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/classes/Master.php?f=delete_appointment.

  10. 9.8CVE-2025-70821EPSS 0.5%

    renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component

  11. 6.5CVE-2026-1487EPSS 0.4%

    The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSO…

  12. 9.8CVE-2026-26713EPSS 0.4%

    code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php.

  13. 9.8CVE-2026-26712EPSS 0.4%

    code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php.

  14. 9.8CVE-2026-26711EPSS 0.4%

    code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php.

  15. 9.8CVE-2026-26710EPSS 0.4%

    code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php.

  16. 9.8CVE-2026-26709EPSS 0.4%

    code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php.

  17. 8.4CVE-2025-48650EPSS 0.1%

    In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  18. 7.5CVE-2026-3180ExploitEPSS 1.1%

    The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordEmail’ and the ’cgl_mail’ parameter in all versions up to, and including, 28.1.4 …

  19. 9.8CVE-2026-26707EPSS 0.5%

    sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php.

  20. 9.8CVE-2026-26706EPSS 0.5%

    sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php.

  21. 9.8CVE-2026-26705EPSS 0.5%

    sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php.

  22. 9.8CVE-2026-26704EPSS 0.5%

    sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php.

  23. 6.2CVE-2026-28399EPSS 0.4%

    NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter. This issue has been patched in version 0.301.3.

  24. 9.8CVE-2026-26708EPSS 0.4%

    sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.

  25. 9.8CVE-2026-26700EPSS 0.4%

    sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.

  26. 9.8CVE-2026-26701EPSS 0.5%

    sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.

  27. 9.8CVE-2026-26703EPSS 0.6%

    sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/advance_search.php.

  28. 9.8CVE-2026-26702EPSS 0.6%

    sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/myitem_reuse.php.

  29. 9.8CVE-2026-26696EPSS 0.6%

    code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php.

  30. 9.8CVE-2026-26695EPSS 0.6%

    code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php.

  31. 9.8CVE-2026-26694EPSS 0.6%

    code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php.

  32. 8.8CVE-2025-50192EPSS 0.7%

    Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30.

  33. 7.0CVE-2025-50191EPSS 0.6%

    Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30.

  34. 8.8CVE-2025-50190EPSS 0.7%

    Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30.

  35. 7.2CVE-2025-50189EPSS 0.8%

    Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/…

  36. 7.0CVE-2025-50188EPSS 0.8%

    Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php…

  37. 4.9CVE-2026-26698EPSS 0.3%

    code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php.

  38. 4.9CVE-2026-26697EPSS 0.3%

    code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?teacherID=.

  39. 9.3CVE-2025-12462EPSS 0.5%

    A Blind SQL injection vulnerability has been identified in DobryCMS.  A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple parameters resulting in Blind SQL Injection. This issue was fixed in versions a…

  40. 6.9CVE-2025-30062EPSS 0.2%

    In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.

  41. 8.8CVE-2025-10350EPSS 0.2%

    SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to database, including data processed by GCM CLININET software.This issue affects C…

  42. 9.3CVE-2026-2584EPSS 0.5%

    A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker (AV:N/PR:N) can exploit this flaw by sending specially crafted SQL queries through the login …

  43. 5.5CVE-2026-3413EPSS 0.4%

    A flaw has been found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /admin_single_student.php. This manipulation of the argument ID causes sql injection. The attack is possible to be …

  44. 5.5CVE-2026-3411EPSS 0.4%

    A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /admin_single_student_update.php. The manipulation of the argument ID leads to sq…

  45. 5.5CVE-2026-3410EPSS 0.4%

    A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/check_studid.php. Executing a manipulation of the argument student_id can lead to s…

  46. 5.5CVE-2026-3406EPSS 0.4%

    A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the component Registration Handler. The manipulation of the argument fname results i…

  47. 8.8CVE-2026-28562EPSS 0.5%

    wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitization on unquoted identifiers. Attackers exploit the wpfob parameter with CASE W…

  48. 7.5CVE-2025-13673EPSS 0.5%

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied paramete…

  49. 9.3CVE-2026-28516ExploitEPSS 1.1%

    openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string inter…

  50. 7.1CVE-2026-27832EPSS 0.3%

    Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) vulnerability, exploitable through the `advancedQueryData` parameter (`comparator…