Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)

4,444
CRITICAL
7,116
HIGH
4,287
MEDIUM
104
LOW
16,171 CVEs · Page 216/324
7.3
CVE-2023-5020

A vulnerability, which was classified as critical, has been found in 07FLY CRM V2. This issue affects some unknown proce

7.3
CVE-2023-5373

A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected i

7.3
CVE-2023-5589

A vulnerability was found in SourceCodester Judging Management System 1.0. It has been declared as critical. This vulner

7.3
CVE-2023-5780

A vulnerability classified as critical was found in Tongda OA 2017 11.10. This vulnerability affects unknown code of the

7.3
CVE-2023-5787

A vulnerability was found in Shaanxi Chanming Education Technology Score Query System 5.0. It has been rated as critical

7.3
CVE-2023-5794

A vulnerability was found in PHPGurukul Online Railway Catering System 1.0. It has been classified as critical. Affected

7.3
CVE-2023-5804

A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue

7.3
CVE-2023-5828

A vulnerability was found in Nanning Ontall Longxing Industrial Development Zone Project Construction and Installation M

7.3
CVE-2020-36768

A vulnerability was found in rl-institut NESP2 Initial Release/1.0. It has been classified as critical. Affected is an u

7.3
CVE-2023-6579

A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknow

7.3
CVE-2023-6647

A vulnerability, which was classified as critical, has been found in AMTT HiBOS 1.0. Affected by this issue is some unkn

7.3
CVE-2023-6648

A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. Th

7.3
CVE-2023-6651

A vulnerability was found in code-projects Matrimonial Site 1.0. It has been classified as critical. Affected is an unkn

7.3
CVE-2023-6652

A vulnerability was found in code-projects Matrimonial Site 1.0. It has been declared as critical. Affected by this vuln

7.3
CVE-2023-6655

A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some

7.3
CVE-2023-6903

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affec

7.3
CVE-2023-7156

A vulnerability has been found in Campcodes Online College Library System 1.0 and classified as critical. This vulnerabi

7.3
CVE-2023-7161

A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affec

7.3
CVE-2023-7172

A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected

7.2
CVE-2022-4360

The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it

7.2
CVE-2023-0254

The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in

7.2
CVE-2022-46472

Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/cla

7.2
CVE-2022-46946

Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes

7.2
CVE-2022-46947

Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes

7.2
CVE-2022-46949

Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes

7.2
CVE-2022-46950

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at

7.2
CVE-2022-46951

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at

7.2
CVE-2022-46952

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at

7.2
CVE-2022-46953

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at

7.2
CVE-2022-46956

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at

7.2
CVE-2022-4547

The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a par

7.2
CVE-2022-45589

All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL

7.2
CVE-2023-24684

ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.

7.2
CVE-2023-24685

ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Eve

7.2
CVE-2022-4546

The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL sta

7.2
CVE-2022-38868

SQL Injection vulnerability in Ehoney version 2.0.0 in models/protocol.go and models/images.go, allows attackers to exec

7.2
CVE-2023-23007

An issue was discovered in ESPCMS P8.21120101 after logging in to the background, there is a SQL injection vulnerability

7.2
CVE-2023-0895

The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘

7.2
CVE-2023-0487

The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it i

7.2
CVE-2023-25432

An issue was discovered in Online Reviewer Management System v1.0. There is a SQL injection that can directly issue inst

7.2
CVE-2023-1211

SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.

7.2
CVE-2023-25223

CRMEB <=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list.

7.2
CVE-2023-27707

SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_*

7.2
CVE-2023-27709

SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_*

7.2
CVE-2023-24840

HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated rem

7.2
CVE-2023-26856

Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter a

7.2
CVE-2023-27733

DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.

7.2
CVE-2023-2114

The NEX-Forms WordPress plugin before 8.4 does not properly escape the `table` parameter, which is populated with user i

7.2
CVE-2023-32569

An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2.800 and 8.x before 8.0.410. The Info

7.2
CVE-2023-31842

Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/index.php?page=edit_faculty&id=.

Frequently Asked Questions

What is CWE-89?

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.

How many CVEs are classified as CWE-89?

There are 24,110 CVE records associated with CWE-89 in our database. Of these, 4444 are critical severity, 7116 are high severity, and 4287 are medium severity.

How can I protect against CWE-89 vulnerabilities?

Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-89 using AI-powered security agents.

Detect CWE-89 Vulnerabilities

CyberStrike's AI agents automatically detect improper neutralization of special elements used in an sql command (sql injection) vulnerabilities across your infrastructure.

Get Started