Skip to content
Noroxi

CWE-89 · 17,923 records

SQL injection

Why does it happen?

The query text is built by concatenating user input. The database cannot tell where the data ends and the command begins.

How to prevent it

  1. 01Use parameterized queries or a trusted ORM for every query.
  2. 02Grant the database account privileges only on the tables it needs.
  3. 03Restrict dynamic column or sort names with an allowlist.

Vulnerable and fixed code

A representative teaching example. Highlighted lines mark where the bug and the fix are.

Vulnerable

ts
const owner = req.query.owner;const rows = await db.query(  "SELECT * FROM files WHERE owner = '" + owner + "'");

Fixed

ts
const owner = req.query.owner;const rows = await db.query(  "SELECT * FROM files WHERE owner = $1",  [owner]);

Is this pattern in your code?

We look for this class specifically as part of our Web and API penetration testing service. Findings are delivered with line numbers.

Web and API penetration testingRequest a quote

CVEs in this class

10,000 records

  • CVE-2023-34362
    99Now

    In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    progress · moveit cloudJun 2, 2023

  • CVE-2025-25257
    99Now

    An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    fortinet · fortiwebJul 17, 2025

  • CVE-2023-48788
    99Now

    A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    fortinet · forticlient enterprise management serverMar 12, 2024

  • CVE-2026-72898
    99Now

    Metabase SQL injection via password reset endpoint

    CriticalCVSS 10.0KEVWeaponizedEPSS 98%

    metabase · metabaseAug 10, 2026

  • CVE-2025-57819
    99Now

    FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

    CriticalCVSS 10.0KEVWeaponizedEPSS 95%

    sangoma · freepbxAug 28, 2025

  • CVE-2026-21643
    98Now

    An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may a

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    fortinet · forticlientemsFeb 6, 2026

  • CVE-2019-12989
    97Now

    Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow SQL Injection.

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    citrix · netscaler sd-wanJul 16, 2019

  • CVE-2024-6670
    97Now

    WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 92%

    progress · whatsup goldAug 29, 2024

  • CVE-2024-9465
    96Now

    Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

    CriticalCVSS 9.2KEVWeaponizedEPSS 99%

    paloaltonetworks · expeditionOct 9, 2024

  • CVE-2020-17463
    96Now

    FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.

    CriticalCVSS 9.8KEVWeaponizedEPSS 89%

    thedaylightstudio · fuel cmsAug 13, 2020

  • CVE-2026-9082
    96Now

    Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

    CriticalCVSS 9.8KEVWeaponizedEPSS 89%

    drupal · drupalMay 20, 2026

  • CVE-2024-29824
    95Now

    An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the sam

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    ivanti · endpoint managerMay 31, 2024

  • CVE-2017-18362
    95Now

    ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct ac

    CriticalCVSS 9.8KEVWeaponizedEPSS 86%

    connectwise · manageditsyncFeb 5, 2019

  • CVE-2026-42208
    94Now

    LiteLLM: SQL injection in Proxy API key verification

    CriticalCVSS 9.3KEVWeaponizedEPSS 89%

    litellm · litellmMay 8, 2026

  • CVE-2020-5722
    94Now

    The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.

    CriticalCVSS 9.8KEVWeaponizedEPSS 84%

    grandstream · ucm6200 firmwareMar 23, 2020

  • CVE-2024-43468
    93Now

    Microsoft Configuration Manager Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 81%

    microsoft · configuration manager 2403Oct 8, 2024

  • CVE-2021-42258
    92Now

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th

    CriticalCVSS 9.8KEVWeaponizedEPSS 75%

    bqe · billquick web suiteOct 22, 2021

  • CVE-2018-7841
    91Now

    A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an i

    CriticalCVSS 9.8KEVWeaponizedEPSS 72%

    schneider-electric · u.motion builderMay 22, 2019

  • CVE-2019-7481
    90Now

    Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources.

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    sonicwall · sma 100 firmwareDec 17, 2019

  • CVE-2016-2386
    90Now

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v

    CriticalCVSS 9.8KEVWeaponizedEPSS 71%

    sap · netweaver application server javaFeb 16, 2016

  • CVE-2021-44026
    90Now

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    CriticalCVSS 9.8KEVWeaponizedEPSS 69%

    roundcube · webmailNov 19, 2021

  • CVE-2020-12271
    82Now

    A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild

    CriticalCVSS 9.8KEVWeaponizedEPSS 43%

    sophos · sfosApr 27, 2020

  • CVE-2026-76461
    81Now

    Cisco Secure Email Gateway SQL Injection Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 40%

    cisco · asyncosSep 14, 2026

  • CVE-2021-20016
    81Now

    A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access

    CriticalCVSS 9.8KEVWeaponizedEPSS 40%

    sonicwall · sma 100 firmwareFeb 4, 2021

  • CVE-2021-20028
    78This week

    Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, s

    CriticalCVSS 9.8KEVWeaponizedEPSS 30%

    sonicwall · sma 210 firmwareAug 4, 2021

All vulnerability classes