CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-108 · CAPEC-109 · CAPEC-110 · CAPEC-470 · CAPEC-66 · CAPEC-7
CVEs mapped to this weakness (20,200)
page 938 of 1,010| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-57643 | Hig | 0.00 | 8.5 | 0.00 | Jun 26, 2026 | Contributor SQL Injection in WP Post Author <= 3.9.1 versions. | ||
| CVE-2026-57642 | Hig | 0.00 | 8.5 | 0.00 | Jun 26, 2026 | Contributor SQL Injection in Gallery <= 4.7.8 versions. | ||
| CVE-2026-57636 | Hig | 0.00 | 8.5 | 0.00 | Jun 26, 2026 | Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. | ||
| CVE-2026-57631 | Hig | 0.00 | 7.6 | 0.00 | Jun 26, 2026 | Administrator SQL Injection in Popup box <= 6.0.1 versions. | ||
| CVE-2026-57628 | Hig | 0.00 | 7.6 | 0.00 | Jun 26, 2026 | Administrator SQL Injection in WP All Import <= 4.0.1 versions. | ||
| CVE-2026-56070 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. | ||
| CVE-2026-56068 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. | ||
| CVE-2026-56067 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. | ||
| CVE-2026-56064 | Hig | 0.00 | 8.5 | 0.00 | Jun 26, 2026 | Subscriber SQL Injection in Tourfic <= 2.22.5 versions. | ||
| CVE-2026-56062 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. | ||
| CVE-2026-56036 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. | ||
| CVE-2026-56034 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. | ||
| CVE-2026-54831 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. | ||
| CVE-2026-54827 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. | ||
| CVE-2026-54825 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. | ||
| CVE-2026-54820 | Cri | 0.00 | 9.3 | 0.00 | Jun 26, 2026 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | ||
| CVE-2026-13226 | Med | 0.00 | 6.5 | 0.00 | Jun 26, 2026 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient… | ||
| CVE-2026-37149 | Hig | 0.00 | 7.7 | 0.00 | Jun 25, 2026 | GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL… | ||
| CVE-2026-57587 | Med | 0.00 | 5.3 | 0.00 | Jun 25, 2026 | A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data. | ||
| CVE-2026-54849 | Cri | 0.00 | 9.3 | 0.00 | Jun 25, 2026 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. |
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in WP Post Author <= 3.9.1 versions.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in Gallery <= 4.7.8 versions.
- risk 0.00cvss 8.5epss 0.00
Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.
- risk 0.00cvss 7.6epss 0.00
Administrator SQL Injection in Popup box <= 6.0.1 versions.
- risk 0.00cvss 7.6epss 0.00
Administrator SQL Injection in WP All Import <= 4.0.1 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.
- risk 0.00cvss 8.5epss 0.00
Subscriber SQL Injection in Tourfic <= 2.22.5 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.
- risk 0.00cvss 6.5epss 0.00
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versions up to, and including, 4.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient…
- risk 0.00cvss 7.7epss 0.00
GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/search_products.php. This vulnerability allows attackers to access sensitive database information via a crafted SQL…
- risk 0.00cvss 5.3epss 0.00
A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.