CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
We have discovered 30,500 live websites that are affected by CWE-89.
CVEs
- Count - 10
CWE References
Countries
 United States | 6,087 websites |
 Germany | 4,830 websites |
 France | 2,023 websites |
 Italy | 1,272 websites |
 GB | 1,095 websites |
 Iran | 1,073 websites |
 Netherlands | 933 websites |
 Poland | 923 websites |
 Japan | 882 websites |
 Spain | 727 websites |
TLDs
| .com | 10,130 websites |
| .de | 3,371 websites |
| .org | 2,267 websites |
| .fr | 967 websites |
| .it | 822 websites |
| .nl | 733 websites |
| .net | 715 websites |
| .pl | 685 websites |
| .com.br | 582 websites |
| .co.uk | 510 websites |
Newest CVEs
List of the most recent CVEs that are part of CWE-89| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Feb, 2024 | CVE-2024-25910 | WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection | 49 |
| Jan, 2024 | CVE-2023-0224 | GiveWP < 2.24.1 - Unauthenticated SQLi | 2,488 |
| Jun, 2023 | CVE-2023-2592 | FormCraft Premium < 3.9.7 - Admin+ SQLi | 7,675 |
| Mar, 2023 | CVE-2023-0955 | WP Statistics < 14.0 - Authenticated SQLi | 20,339 |
| Mar, 2023 | CVE-2022-38074 | WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection | 14,244 |
| Jan, 2023 | CVE-2022-4230 | WP Statistics < 13.2.9 - Authenticated SQLi | 13,313 |
| Feb, 2022 | CVE-2022-0651 | WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type | 185 |
| Feb, 2022 | CVE-2022-25149 | WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP | 185 |
| Feb, 2022 | CVE-2022-25148 | WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id | 185 |
| Feb, 2022 | CVE-2022-0513 | WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason | 117 |
The most widespread CVEs
List of the most common CVEs that are part of CWE-89| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Mar, 2023 | CVE-2023-0955 | WP Statistics < 14.0 - Authenticated SQLi | 20,339 |
| Mar, 2023 | CVE-2022-38074 | WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection | 14,244 |
| Jan, 2023 | CVE-2022-4230 | WP Statistics < 13.2.9 - Authenticated SQLi | 13,313 |
| Jun, 2023 | CVE-2023-2592 | FormCraft Premium < 3.9.7 - Admin+ SQLi | 7,675 |
| Jan, 2024 | CVE-2023-0224 | GiveWP < 2.24.1 - Unauthenticated SQLi | 2,488 |
| Feb, 2022 | CVE-2022-0651 | WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type | 185 |
| Feb, 2022 | CVE-2022-25148 | WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id | 185 |
| Feb, 2022 | CVE-2022-25149 | WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP | 185 |
| Feb, 2022 | CVE-2022-0513 | WP Statistics <= 13.1.4 Unauthenticated Blind SQL Injection via exclusion_reason | 117 |
| Feb, 2024 | CVE-2024-25910 | WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection | 49 |
Websites affected by CWE-89
Top websites that are affected by CWE-89. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ********.com | United States | *,*** | |
| ************.com | United States | *,*** | |
| ***.******************.org | United States | *,*** | |
| ***.************.com |  Bulgaria | **,*** | |
| ************.***.in |  India | **,*** | |
| ***.***********.fr | France | **,*** | |
| ***.******************.org | United States | **,*** | |
| ***.*****************.org | United States | **,*** | |
| *****.org | United States | **,*** | |
| ****.org |  Australia | **,*** |