CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Description
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-89 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-r3rv-jm3r-62q2 | CVE-2026-107385 | HIGH |
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES |
2026-10-08 | |
| GHSA-v6pj-gxxw-phfw | CVE-2026-107384 | HIGH |
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) |
2026-10-08 | |
| GHSA-r223-96jv-q533 | CVE-2026-107375 | HIGH |
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort |
2026-10-08 | |
| GHSA-wf65-4jjx-q444 | CVE-2026-60090 | MODERATE |
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL |
2026-10-08 | |
| GHSA-q65p-7p84-495c | - | CRITICAL |
Duplicate Advisory: PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL |
2026-10-08 | |
| GHSA-pj7x-6wpf-pgvp | CVE-2026-105856 | HIGH |
Payload: SQL injection in SQLite/Postgres |
2026-10-07 | |
| GHSA-f46q-3v67-fmm4 | CVE-2026-62251 | HIGH |
Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query |
2026-10-07 | |
| GHSA-2p5w-cvg5-gc5c | CVE-2026-0603 | HIGH |
Hibernate vulnerable to SQL Injection |
2026-10-06 | |
| GHSA-v49j-62m6-pgrr | CVE-2026-105845 | CRITICAL |
Payload: SQL Injection in SQLite and Postgres |
2026-10-06 | |
| GHSA-r75f-5x8p-qvmc | CVE-2026-42208 | CRITICAL |
LiteLLM has SQL Injection in Proxy API key verification |
2026-10-05 | |
| GHSA-9q4r-4842-93vw | - | HIGH |
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name |
2026-10-02 | |
| GHSA-6mcc-q3mg-3qg6 | CVE-2025-1750 | CRITICAL |
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id |
2026-10-02 | |
| GHSA-33jq-p8c2-q3q4 | CVE-2026-69085 | CRITICAL |
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking |
2026-10-01 | |
| GHSA-5w4j-hchp-r332 | - | CRITICAL |
Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking |
2026-10-01 | |
| GHSA-rw77-vq4g-x3hp | CVE-2026-56738 | HIGH | - |
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion |
2026-09-24 |
| GHSA-6pvm-2vjj-rx4w | CVE-2026-47132 | MODERATE | - |
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration |
2026-09-24 |
| GHSA-vjqc-q4mp-2rvf | CVE-2026-79752 | CRITICAL | - |
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection |
2026-09-24 |
| GHSA-wmw4-mw6x-6vfm | CVE-2026-61685 | HIGH |
ReactPress has SQL injection via dynamic column names in TypeORM query builders |
2026-09-23 | |
| GHSA-jg26-q8hg-3pq4 | CVE-2026-92692 | MODERATE | - |
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) |
2026-09-23 |
| GHSA-rfx3-98h7-v3xp | CVE-2026-75513 | CRITICAL |
Marten's LINQ provider has SQL injection via unescaped string literals |
2026-09-17 | |
| GHSA-r8cr-4f9w-7r75 | CVE-2026-32599 | MODERATE |
Netmaker has a boolean‑based SQL Injection |
2026-09-15 | |
| GHSA-pqrj-4gwg-h5f7 | CVE-2025-66336 | HIGH |
Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path |
2026-09-11 | |
| GHSA-23rh-xw42-fq82 | CVE-2026-55416 | HIGH | - |
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration |
2026-09-10 |
| GHSA-fxf7-vhh8-7vpq | CVE-2026-77635 | CRITICAL | - |
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver |
2026-09-08 |
| GHSA-x67c-8pwr-m8g3 | CVE-2026-72807 | HIGH |
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel |
2026-09-03 |