CWE-89
MITRE ↗Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-detail
FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_o
FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.
FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.
FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id p
FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.
FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.
FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or se
FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id param
FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.
FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.
FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.
FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.
FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter.
FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.
FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.
FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter.
FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or c
FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id par
FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parame
FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.
Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.
Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.
DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.
Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.
Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.
Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.
Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.
Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter
Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.
Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.
Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.
Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_
Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.
Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.
Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.
CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.
Child Care Script 1.0 has SQL Injection via the /list city parameter.
Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.
E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid paramet
Doctor Search Script 1.0 has SQL Injection via the /list city parameter.
Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.
Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php cati
Food Order Script 1.0 has SQL Injection via the /list city parameter.
Event Search Script 1.0 has SQL Injection via the /event-list city parameter.
Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.
Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter.
Laundry Booking Script 1.0 has SQL Injection via the /list city parameter.
Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.
Frequently Asked Questions
What is CWE-89?
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)) is a weakness category in the Common Weakness Enumeration (CWE) system maintained by MITRE. It describes a class of software or hardware vulnerability that can lead to security issues.
How many CVEs are classified as CWE-89?
There are 24,110 CVE records associated with CWE-89 in our database. Of these, 4444 are critical severity, 7116 are high severity, and 4287 are medium severity.
How can I protect against CWE-89 vulnerabilities?
Protection strategies depend on the specific weakness type. General measures include input validation, secure coding practices, regular security testing, and keeping software up to date. CyberStrike can help by automatically scanning your infrastructure for vulnerabilities related to CWE-89 using AI-powered security agents.
Detect CWE-89 Vulnerabilities
CyberStrike's AI agents automatically detect improper neutralization of special elements used in an sql command (sql injection) vulnerabilities across your infrastructure.
Get Started