CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Abstraction: Base · CVEs in our corpus: 20,339

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 7 mapping(s) from 2 framework(s): CAPEC 5 (full) · CSF 2.0 2 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

CA-8 Penetration Testing
SI-10 Information Input Validation
SA-11 Developer Testing and Evaluation
PR.AT-02

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V6.2.5

NIST 800-53 r5 controls that address this weakness (2)AI-assisted

Control	Title	Family	Why it addresses this CWE
`CA-8`	Penetration Testing	CA	Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.
`SI-10`	Information Input Validation	SI	Validates query inputs to prevent SQL syntax or command manipulation.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2018-12464`	10.0	10.0	0.8067	2018-06-29
`CVE-2026-72898` KEV	10.0	10.0	0.1040	2026-08-10
`CVE-2016-2386` KEV	9.9	9.8	0.7106	2016-02-16
`CVE-2016-10134`	9.9	9.8	0.8341	2017-02-17
`CVE-2016-2555`	9.9	9.8	0.7962	2017-04-13
`CVE-2017-8917`	9.9	9.8	0.9983	2017-05-17
`CVE-2018-17243`	9.9	9.8	0.7443	2018-09-20
`CVE-2018-17254`	9.9	9.8	0.8298	2018-09-20
`CVE-2018-17552`	9.9	9.8	0.8406	2018-10-03
`CVE-2017-18362` KEV	9.9	9.8	0.8682	2019-02-05
`CVE-2019-10692`	9.9	9.8	0.7870	2019-04-02
`CVE-2018-7841` KEV	9.9	9.8	0.7268	2019-05-22
`CVE-2019-12989` KEV	9.9	9.8	0.9413	2019-07-16
`CVE-2019-17602`	9.9	9.8	0.8155	2019-10-15
`CVE-2013-5743`	9.9	9.8	0.7999	2019-12-11
`CVE-2019-20361`	9.9	9.8	0.8511	2020-01-08
`CVE-2020-8656`	9.9	9.8	0.8460	2020-02-07
`CVE-2020-9465`	9.9	9.8	0.8224	2020-02-28
`CVE-2020-10220`	9.9	9.8	0.9968	2020-03-07
`CVE-2020-5722` KEV	9.9	9.8	0.8441	2020-03-23
`CVE-2020-12271` KEV	9.9	9.8	0.4243	2020-04-27
`CVE-2020-12720`	9.9	9.8	0.8895	2020-05-08
`CVE-2020-11530`	9.9	9.8	0.9566	2020-05-08
`CVE-2020-10546`	9.9	9.8	0.8733	2020-06-04
`CVE-2020-14092`	9.9	9.8	0.9453	2020-07-02