Skip to main content

Over 150 LLM Providers · Over 5,300 Models The most extensible AI-powered pentesting platform. Open source. Star on GitHub

CWE-89

MITRE ↗

Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)

4,444
CRITICAL
7,116
HIGH
4,287
MEDIUM
104
LOW
16,171 CVEs · Page 247/324
9.8
CVE-2022-38540

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the crea

 9.8
CVE-2022-38541

Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_ti

 9.8
CVE-2022-38542

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill

 9.8
CVE-2022-38637

Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Pa

 9.8
CVE-2022-38771

The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT tag

 9.8
CVE-2022-36669

Hospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication

 9.8
CVE-2022-37138

Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as

 9.8
CVE-2022-40300

Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager P

 9.8
CVE-2022-40766

Modern Campus Omni CMS (formerly OU Campus) 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , <?php' subst

 9.8
CVE-2022-2754

The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation paramet

 9.8
CVE-2022-2840

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using th

 9.8
CVE-2022-37203

JFinal CMS 5.1.0 is vulnerable to SQL Injection. These interfaces do not use the same component, nor do they have filter

 9.8
CVE-2022-38509

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budg

 9.8
CVE-2022-37204

Final CMS 5.1.0 is vulnerable to SQL Injection.

 9.8
CVE-2022-38619

SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /S

 9.8
CVE-2022-40030

SourceCodester Simple Task Managing System v1.0 was discovered to contain a SQL injection vulnerability via the bookId p

 9.8
CVE-2022-40113

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-ban

 9.8
CVE-2022-40114

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-ban

 9.8
CVE-2022-40115

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-ban

 9.8
CVE-2022-40116

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-bank

 9.8
CVE-2022-40117

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-ban

 9.8
CVE-2022-40118

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-ban

 9.8
CVE-2022-40119

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net

 9.8
CVE-2022-40120

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net

 9.8
CVE-2022-40121

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-bank

 9.8
CVE-2022-40122

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-ban

 9.8
CVE-2022-40483

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.ph

 9.8
CVE-2022-40484

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_

 9.8
CVE-2022-40485

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php

 9.8
CVE-2022-30004

Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing

9.8
CVE-2021-41433

SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application logi

 9.8
CVE-2022-40877

Exam Reviewer Management System 1.0 is vulnerable to SQL Injection via the ‘id’ parameter.

 9.8
CVE-2022-41570

An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.

 9.8
CVE-2020-35674

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordRe

 9.8
CVE-2022-40887

SourceCodester Best Student Result Management System 1.0 is vulnerable to SQL Injection.

 9.8
CVE-2022-33880

hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the t

 9.8
CVE-2022-40315

A limited SQL injection risk was identified in the "browse list of users" site administration page.

 9.8
CVE-2022-40944

Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.

 9.8
CVE-2022-35156

Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /

 9.8
CVE-2022-40943

Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.

 9.8
CVE-2022-40824

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40825

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40826

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40827

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40828

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40829

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40830

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40831

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40832

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

 9.8
CVE-2022-40833

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.ph

Frequently Asked Questions

What is CWE-89?

CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.

How many CVEs are classified as CWE-89?

There are 24,110 CVE records associated with CWE-89 in our database. Of these, 4444 are critical severity, 7116 are high severity, and 4287 are medium severity.

How can I protect against CWE-89 vulnerabilities?

Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-89 using AI-powered security agents.

Detect CWE-89 Vulnerabilities

CyberStrike's AI agents automatically detect improper neutralization of special elements used in an sql command (sql injection) vulnerabilities across your infrastructure.

Get Started