SQL injection
Named by 56 kept items in this workspace.
48 items name it under techniques and 8 under classification.key entities.
Search every workspace for SQL injection. It matches the name as written, so it can find other things that share it.
The items that name it 56
CVE-2026-9082, a highly critical flaw in Drupal core's database abstraction API affecting PostgreSQL-backed sites, drew exploitation attempts in May.
Used in attacks on CVE-2026-9082 in Drupal's database abstraction API, which could lead to privilege escalation, information disclosure and remote code execution
Vulnerability class patched in ASUS router firmware using AI.
Vulnerability class discussed as example mitigated by AWS WAF blocking-mode rules
Used by agents against government websites (US Department of Education, Library and Archives Canada, Australian government health website)
First step of example AI-driven chain: SQLi, MFA bypass, file upload, RCE, privilege escalation, AWS Secrets Manager dump, database decryption
error-based, union, boolean, time-based, OAST-assisted
Recurring injection flaw found in AI-generated code due to missing input sanitization
Named as a predictable/named-in-advance risk class an agent can be told to avoid before writing code
illustrative vulnerability pattern (Flask endpoint querying a database) used to show models pattern-match even when parameterized statements close the exploit path
Found among the 68 reportable vulnerabilities in the 'Exposed by design' study of internet-facing MCP servers.
CWE-89, an injection flaw from unvalidated input, cited as a common AI-generated code weakness
SQLi
Vulnerability check performed by the scanner
Boolean-based, union-based, time-based blind, error-based, stacked queries; 38+ payloads
Example vulnerability class used in Golden Test Python sample: code builds a query by concatenating user input; security test sends an injection payload and asserts the database does not leak every row
In the author__not_in parameter of WordPress, reached through recursive batch calls
Tainted/untrusted parameter (e.g., from a request header) flowing through several unrelated functions before reaching a database call sink; cited as an example SAST can flag via pattern matching but often can't trace when the path isn't direct.
SQLi
A Claude model compromised an application this way after scanning 9,000 targets during an evaluation.
Attacker exploited unvalidated input in a public-facing Tomcat application form to inject SQL commands into the Oracle backend via JDBC connection; described as a classic SQLi from mishandled input rather than a novel vulnerability, reaching PL/SQL via an autocomplete search feature.
Focus area selectable via FOCUS flag for bug bounty/pentest scans
Used by the internal research model to compromise one company's internet-facing application
Heuristic-detectable vulnerability reliably caught by deterministic scanners
attacker-controlled input inserted into SQL queries without cleaning, allowing control over query logic; publicly written up in 1998 by researcher rainforest puppy
Payload coverage for BountyForge web/API agents
Example threat identified against the Order Service: constructing SQL queries via string concatenation with user-supplied input, allowing an attacker to extract customer data, modify orders, or drop tables
Injection in a web framework; includes 'SQL Injection-1', an indirect injection through a column alias the ORM never escapes, traced only by gpt-5.5 and the strongest GPT-5.6 models (sol & terra)
Injection attack tested by Strix
Example vulnerability class found by SAST scanners and grouped/fixed via a shared parameterized-query helper
Threat actor exploited an SQL injection vulnerability via a web page with improperly validated user input to gain access to the MSSQL instance/endpoint.
High-signal exploit shape often found cleanly; in js-project-tigerteam all 25 model runs falsely reported SQL injection on a non-executable SQL-shaped mock helper (dbQuery() logs the string and returns an empty array, no executable sink); in js-project-nightowl all 25 model runs reported SQL injecti
Classic vulnerability from concatenating unchecked strings into SQL queries
Vulnerability category detected via database library usage, SQL-like strings, and user-controlled input in queries; AI-native solution showed at least three times higher true positive rates than traditional SAST due to needing cross-file data flow analysis
CWE-89
Injection attack category detected by the tool
Database query manipulation
Example vulnerability class (e.g. string concatenation into a SQL query at user.go:142) used to illustrate that flagging the exploit class is easy, while determining reachability from internet-facing routes, attacker control of input, and data sensitivity of the affected table is the hard, context-d
Vulnerability class: untrusted input reaches execSQL() or raw query construction.
CWE-89
Used in CVE-2026-42208, exploited within 36 hours of public disclosure.
Conducting SQL injection attacks against affected devices (e.g., CVE-2026-76423 group, CVE-2026-20282/20283/20284, CVE-2026-20340 group).
All techniques in this workspace.