VYPR

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Hierarchy (View 1000)

Parents

Children

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7

CVEs mapped to this weakness (20,861)

page 368 of 1,044
  • CVE-2025-64092HigJan 9, 2026
    Zenitel
    Icx500 Firmware
    risk 0.49cvss 7.5epss 0.00

    This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.

  • CVE-2025-59379HigJan 6, 2026
    DwyerOmega
    Isensix Advanced Remote Monitoring System (ARMS)
    risk 0.49cvss 7.5epss 0.00

    DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Blind SQL Injection through the user parameter in the login page. This allows an attacker to steal credentials, which may…

  • CVE-2025-55065HigJan 1, 2026
    risk 0.49cvss 7.5epss 0.00

    CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  • CVE-2023-54163HigDec 30, 2025
    NLB MKlik Macedonia
    NLB mKlik Macedonia
    risk 0.49cvss 7.5epss 0.00

    NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries. Attackers can inject arbitrary SQL code through unsanitized input to potentially disclose sensitive information from the…

  • CVE-2025-59129HigDec 30, 2025
    WordPress
    Appointify
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injection.This issue affects Appointify: from n/a through <= 1.0.8.

  • CVE-2025-68590HigDec 24, 2025
    WordPress
    Integration for Contact Form 7 HubSpot
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Blind SQL Injection.This issue affects Integration for Contact Form 7 HubSpot: from n/a through <= 1.4.2.

  • CVE-2025-68570HigDec 24, 2025
    captivateaudio
    captivatesync-trade
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through <= 3.2.2.

  • CVE-2025-68496HigDec 24, 2025
    WordPress
    User Feedback
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind SQL Injection.This issue affects User Feedback: from n/a through <= 1.10.0.

  • CVE-2023-53982HigDec 23, 2025
    PMB
    PMB
    risk 0.49cvss 7.5epss 0.01

    PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries. Attackers can exploit the unsanitized 'id' parameter by injecting conditional sleep statements to extract information…

  • CVE-2025-68561HigDec 23, 2025
    WordPress
    Automatorwp
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows SQL Injection.This issue affects AutomatorWP: from n/a through <= 5.2.4.

  • CVE-2025-68550HigDec 23, 2025
    WordPress
    WPBulky
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme WPBulky wpbulky-wp-bulk-edit-post-types allows Blind SQL Injection.This issue affects WPBulky: from n/a through <= 1.1.13.

  • CVE-2023-53975HigDec 22, 2025
    Thedigitalcraft
    Atomcms
    risk 0.49cvss 7.5epss 0.00

    Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL…

  • CVE-2023-53972HigDec 22, 2025
    webTareas
    webTareas
    risk 0.49cvss 7.5epss 0.00

    WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries. Attackers can exploit error-based and time-based blind SQL injection techniques to extract database information and…

  • CVE-2025-67999HigDec 16, 2025
    WordPress
    Newsletter
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Injection.This issue affects Newsletter: from n/a through <= 9.0.9.

  • CVE-2025-67962HigDec 16, 2025
    WordPress
    Broken Link Checker
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AIOSEO Plugin Team Broken Link Checker broken-link-checker-seo allows SQL Injection.This issue affects Broken Link Checker: from n/a through <= 1.2.6.

  • CVE-2025-13126HigDec 14, 2025
    WordPress
    Wpforo Forum
    risk 0.49cvss 7.5epss 0.00

    The wpForo Forum plugin for WordPress is vulnerable to generic SQL Injection via the `post_args` and `topic_args` parameters in all versions up to, and including, 2.4.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…

  • CVE-2025-13089HigDec 13, 2025
    WordPress
    Wp Directory Kit
    risk 0.49cvss 7.5epss 0.00

    The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'hide_fields' and the 'attr_search' parameter in all versions up to, and including, 1.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…

  • CVE-2025-13077HigDec 13, 2025
    WordPress
    افزونه پیامک ووکامرس فوق حرفه ای (جدید)
    risk 0.49cvss 7.5epss 0.00

    The افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'columns' parameter in all versions up to, and including, 1.3.5. This is due to insufficient escaping…

  • CVE-2024-58316HigDec 12, 2025
    PuneethReddyHC
    Online Shopping System Advanced
    risk 0.49cvss 7.5epss 0.01

    Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject malicious SQL through the unfiltered 'cm' parameter. Attackers can exploit the vulnerability by sending crafted SQL queries to retrieve…

  • CVE-2025-14169HigDec 12, 2025
    WordPress
    Funnel Builder
    risk 0.49cvss 7.5epss 0.00

    The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient…