Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

SQL Injection vulnerabilities

CWE-89 · 12 tracked

SQL injection (CWE-89) is a flaw where untrusted input is concatenated into a database query, letting an attacker change the query’s logic to read, modify, or destroy data.

How it’s exploited

An attacker submits input like ’ OR 1=1 -- in a form field or URL parameter; because the app builds the SQL string by concatenation, the payload becomes part of the executed query — bypassing authentication, dumping tables, or in some cases running OS commands.

How to prevent it

Use parameterized queries / prepared statements everywhere (never string concatenation), apply least-privilege database accounts, and validate input at the boundary. Reachability analysis then confirms which SQL sinks are actually reachable from untrusted input.

Tracked sql injection vulnerabilities

12 CVEs in this class, each with severity, exploit status, EPSS, and remediation.

Frequently asked questions

What is SQL Injection?
SQL injection (CWE-89) is a flaw where untrusted input is concatenated into a database query, letting an attacker change the query’s logic to read, modify, or destroy data.
How is sql injection exploited?
An attacker submits input like ’ OR 1=1 -- in a form field or URL parameter; because the app builds the SQL string by concatenation, the payload becomes part of the executed query — bypassing authentication, dumping tables, or in some cases running OS commands.
How do you prevent sql injection?
Use parameterized queries / prepared statements everywhere (never string concatenation), apply least-privilege database accounts, and validate input at the boundary. Reachability analysis then confirms which SQL sinks are actually reachable from untrusted input.
How many sql injection vulnerabilities are there?
O3 tracks 12 vulnerabilities classified as CWE-89 (SQL Injection), each with severity, exploit status, EPSS exploitation probability, and remediation. The full list is below.