CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Abstraction: Base · CVEs in our corpus: 21,290

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Last updated: 16 October 2026 10:19 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 2 mapping(s) from 1 framework(s): CSF 2.0 2 (mostly)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A05:2025 Injection.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

CA-8 Penetration Testing
SI-10 Information Input Validation
SA-11 Developer Testing and Evaluation
PR.AT-02

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

V6.2.5

NIST 800-53 r5 controls PROPOSED for this weakness (2)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
`SI-10`	Information Input Validation	SI	graded mostly Validates query inputs to prevent SQL syntax or command manipulation.
`CA-8`	Penetration Testing	CA	Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2018-12464`	10.0	10.0	0.8067	2018-06-29
`CVE-2026-72898` KEV	10.0	10.0	0.9734	2026-08-10
`CVE-2016-2386` KEV	9.9	9.8	0.7152	2016-02-16
`CVE-2016-10134`	9.9	9.8	0.8341	2017-02-17
`CVE-2016-2555`	9.9	9.8	0.7976	2017-04-13
`CVE-2017-8917`	9.9	9.8	0.9983	2017-05-17
`CVE-2018-17243`	9.9	9.8	0.7550	2018-09-20
`CVE-2018-17254`	9.9	9.8	0.8298	2018-09-20
`CVE-2018-17552`	9.9	9.8	0.8406	2018-10-03
`CVE-2017-18362` KEV	9.9	9.8	0.8682	2019-02-05
`CVE-2019-10692`	9.9	9.8	0.7870	2019-04-02
`CVE-2018-7841` KEV	9.9	9.8	0.7268	2019-05-22
`CVE-2019-12989` KEV	9.9	9.8	0.9496	2019-07-16
`CVE-2019-17602`	9.9	9.8	0.8108	2019-10-15
`CVE-2013-5743`	9.9	9.8	0.7999	2019-12-11
`CVE-2019-20361`	9.9	9.8	0.8511	2020-01-08
`CVE-2020-8656`	9.9	9.8	0.8460	2020-02-07
`CVE-2020-9465`	9.9	9.8	0.8224	2020-02-28
`CVE-2020-10220`	9.9	9.8	0.9970	2020-03-07
`CVE-2020-5722` KEV	9.9	9.8	0.8441	2020-03-23
`CVE-2020-12271` KEV	9.9	9.8	0.4243	2020-04-27
`CVE-2020-12720`	9.9	9.8	0.8895	2020-05-08
`CVE-2020-11530`	9.9	9.8	0.9566	2020-05-08
`CVE-2020-10546`	9.9	9.8	0.8733	2020-06-04
`CVE-2020-14092`	9.9	9.8	0.9453	2020-07-02