SQL injection is still common, and in vulnerability data it is getting more common: 3,904 CVEs published in 2025 mention it, up 133% from 1,676 in 2022, and MITRE’s 2025 list ranks it the second most dangerous software weakness. CISA’s catalog of exploited vulnerabilities holds 33 SQL injection flaws, 9 of them added in 2026 against 4 in 2025, including a WordPress core flaw patched in July. Those numbers count different things. A published CVE, a tested application, an attack attempt, an exploited vulnerability and a confirmed breach are five different units, and most of the statistics quoted online mix them or come from pages that are more than a decade old. This research keeps each unit separate, shows how ScanTitan counted from public data, labels vendor figures as vendor-only, and says where a popular number does not hold up. Data last checked: 9 November 2026.
Key SQL Injection Statistics for 2026
Executive Benchmark: SQL Injection Statistics for 2026
| Metric | Latest figure | Period | Trend / context | Source |
|---|---|---|---|---|
| CVEs mentioning SQL injection | 3,904 | 2025 | 1,676 in 2022; 2,508 in 2024; 7.8% of all CVEs | NVD API, counted by ScanTitan |
| CVEs mentioning SQL injection | 3,731 | 1 Jan to 7 Nov 2026 | 2026 total CVEs are 95,671, almost double 2025 | NVD API, counted by ScanTitan |
| CVEs tagged CWE-89, rated critical | 923 of 1,305 (71%) | 2025 | 27% of all 3,365 critical CVEs that year carry the tag | NVD API, counted by ScanTitan |
| Rank in the CWE Top 25 | #2, score 28.72 | 2025 list | #3 in 2022 to 2024; #6 in 2019 to 2021 | MITRE |
| CWE Top 25 KEV CVEs for CWE-89 | 4 | Jun 2024 to Jun 2025 window | 7 in the 2022 list | MITRE |
| OWASP injection category | #5, 62,445 CVEs | OWASP Top 10:2025 | #3 in 2021 with 32,078 CVEs; includes XSS | OWASP |
| Exploited SQL injection flaws in KEV | 33 | Catalog version 2026.11.06 | 9 added in 2026, 4 in 2025; 11 with known ransomware use | CISA KEV feed, counted by ScanTitan |
| KEV SQL injection flaws exploitable without login | 19 of 33 (58%) | Catalog version 2026.11.06 | Based on each entry’s description | CISA KEV feed, counted by ScanTitan |
| Most common critical web vulnerability | SQL injection (CWE-89) | Edgescan 2026 report (2025 data) | Has been first since 2022; vendor-only | Edgescan |
| Share of critical and high web findings | 19.52% in text, 28.28% in table | Edgescan 2025 edition | Two figures on the same page; vendor-only | Edgescan 2025 report |
| SQL injection in open-source vulnerabilities | 6.7% (10% in closed-source) | 2024, partial year | Share down 14% on 2023; vendor-only | Aikido |
| Security pass rate for SQL injection in AI-generated code | 83.7% | October 2026 | 83% in July 2026; flat; vendor-only | Veracode |
| Applications with SQL injection in scanned targets | 7% | 2020 data, 3,500 targets | 26% in 2015; the latest edition found; vendor-only | Invicti |
| WordPress core fix for SQL injection and RCE | WordPress 7.0.2 | 17 July 2026 | Forced auto-updates; both flaws added to KEV 21 July | WordPress.org |
Methodology: What Counts as SQL Injection Statistics?
“SQL injection statistics” is used for five different measurements. Each answers a different question, comes from a different kind of source, and can be wrong in a different way.
| Unit | What it counts | Example 2026 figure | Source type | What it cannot tell you |
|---|---|---|---|---|
| CVE record | A published vulnerability whose description or tag points to SQL injection | 3,904 CVEs mention it in 2025 | Public vulnerability database | How many applications or sites are affected |
| Tested application | An application found vulnerable when scanned or tested | Most common critical web finding (Edgescan) | Testing data from vendors | How many applications exist, or whether they were attacked |
| Attack attempt | A request that looks like SQL injection at a firewall | Dated: 7.0% of mitigated requests (Cloudflare, 2022) | Vendor traffic data | Whether the attack succeeded |
| Exploited vulnerability | A flaw with reliable evidence of exploitation | 33 entries in CISA’s catalog | Government catalog | How many organizations were hit |
| Confirmed breach | An incident with confirmed data disclosure | No current neutral count (see below) | Incident data | Which technique, unless the source records it |
How ScanTitan counted. The CVE figures come from the National Vulnerability Database API, queried on 8 November 2026 in 90-day windows by publication date. Two counts are shown. The description count is the number of CVEs whose description mentions “SQL injection.” The tag count is the number NVD has tagged with the CWE-89 weakness. They differ because the NVD API’s weakness filter returns only the tag NVD itself assigns, and most CVEs carry only the tag their publisher supplied. In 2025 the tag count shows more tagged SQL injection CVEs (1,305) than tagged cross-site scripting CVEs (875), which contradicts MITRE’s ranking, so tag counts are not used for yearly trends. The description count agrees in size with other sources: 403 in 2020 and 2,508 in 2024 against 464 and 2,645 from CVEdetails as quoted by StackHawk, and 2,264 open-source SQL injection CVEs in 2023 from Aikido.
Source confidence. MITRE and OWASP are non-profit and publish their methods. CISA’s catalog is a floor of confirmed exploitation, not a census. Edgescan, Invicti, Aikido and Veracode describe their own customers and scans, so their figures are labeled vendor-only. Verizon’s 2026 DBIR does not publish a count for SQL injection: the term appears only as an example of a hacking variety in its glossary.
How Many SQL Injection Vulnerabilities Are Published Each Year?
| Year | CVEs mentioning SQL injection | All CVEs published | Share | CVEs tagged CWE-89 |
|---|---|---|---|---|
| 2020 | 403 | 19,222 | 2.1% | 443 |
| 2021 | 678 | 21,950 | 3.1% | 606 |
| 2022 | 1,676 | 26,431 | 6.3% | 1,494 |
| 2023 | 1,899 | 30,949 | 6.1% | 955 |
| 2024 | 2,508 | 40,704 | 6.2% | 649 |
| 2025 | 3,904 | 49,972 | 7.8% | 1,305 |
| 2026 to 7 Nov | 3,731 | 95,671 | 3.9% | 678 |
Source: NVD API, queried 8 November 2026 and counted by ScanTitan.
Three readings matter. First, the count has grown every year: up 133% from 2022 to 2025 and almost tenfold from 2020. Second, the share of all CVEs doubled between 2021 and 2022 and has stayed between 6% and 8% since, so SQL injection is growing roughly in step with total vulnerability disclosure. Third, 2026 is unusual: NVD recorded 95,671 CVEs by 7 November, almost double 2025, so the 3.9% share reflects a much larger denominator, not fewer SQL injection flaws. Edgescan independently reports a record 48,185 CVEs for 2025.
How severe are they?
NVD’s severity data covers the tagged CVEs. Of 11,941 CVEs tagged CWE-89 across the database’s history, 4,183 (35.0%) are rated critical and 2,671 (22.4%) high on CVSS v3, and the tag covers 2.8% of all 421,173 CVEs. In 2025, 923 of the 1,305 tagged CVEs (70.7%) are critical, 312 (23.9%) high and 25 (1.9%) medium. Those 923 are 27.4% of all 3,365 critical CVEs published in 2025.
SQL Injection in the CWE Top 25 and OWASP Top 10
MITRE CWE Top 25
| List year | Rank | Score | KEV CVEs for CWE-89 in the window |
|---|---|---|---|
| 2019 | 6 | 24.54 | Not listed |
| 2020 | 6 | 20.69 | Not listed |
| 2021 | 6 | 19.54 | Not listed |
| 2022 | 3 | 22.11 | 7 |
| 2023 | 3 | Not recorded | 6 |
| 2024 | 3 | Not recorded | 4 |
| 2025 | 2 | 28.72 | 4 |
Source: MITRE CWE Top 25 archive pages, 2019 to 2025. MITRE’s score combines how often a weakness is mapped to a CVE with the average severity of those CVEs. In 2025 cross-site scripting (60.38) ranked first and cross-site request forgery third (13.64).
OWASP Top 10
| Measure | OWASP 2021, A03 Injection | OWASP 2025, A05 Injection |
|---|---|---|
| Rank | 3 | 5 |
| CWEs mapped | 33 | 37 |
| Total occurrences | 274,228 | 1,404,249 |
| Total CVEs | 32,078 | 62,445 |
| Average incidence rate | 3.37% | 3.08% |
| Maximum incidence rate | 19.09% | 13.77% |
| Applications tested for injection | 94.04% | 100% |
Sources: OWASP Top 10:2021 A03 and OWASP Top 10:2025 A05.
OWASP’s injection category includes cross-site scripting, which OWASP puts at more than 30,000 CVEs against more than 14,000 for SQL injection, so its totals are not SQL injection alone. OWASP describes SQL injection as “low frequency, high impact” and cross-site scripting as “high frequency, low impact.” The fall from third to fifth is a ranking inside a blended category, not evidence that SQL injection declined: MITRE’s list moved the other way over the same period.
Exploited in the Wild: CISA’s Known Exploited Vulnerabilities
ScanTitan counted the CISA catalog’s weakness tags in feed version 2026.11.06, which lists 1,769 entries.
| KEV SQL injection measure | Count |
|---|---|
| Entries tagged CWE-89 | 33 (1.9% of the catalog) |
| Added in 2021 | 6 |
| Added in 2022 | 6 |
| Added in 2023 | 3 |
| Added in 2024 | 5 |
| Added in 2025 | 4 |
| Added in 2026 to 6 November | 9 |
| With known ransomware campaign use | 11 (33%) |
| Described as exploitable by an unauthenticated attacker | 19 (58%) |
Source: CISA KEV feed, counted by ScanTitan.
Nine additions in 2026 is more than double 2025’s four and the most in any single year of the series. Many sit in network and security products: SonicWall (3 entries), Sophos (2), Fortinet (3), Citrix, F5, Cisco, Arista, Palo Alto Networks and Ivanti, which means a SQL injection flaw in an internet-facing appliance can be a route into an organization, not only a flaw in a website.
SQL injection flaws added to KEV in 2026
| Date added | Vendor and product | CVE |
|---|---|---|
| 12 Feb | Microsoft Configuration Manager | CVE-2024-43468 |
| 13 Apr | Fortinet FortiClient EMS | CVE-2026-21643 |
| 8 May | BerriAI LiteLLM | CVE-2026-42208 |
| 22 May | Drupal core | CVE-2026-9082 |
| 21 Jul | WordPress core | CVE-2026-60137 |
| 11 Aug | Metabase | CVE-2026-72898 |
| 2 Sep | Sangoma Switchvox | CVE-2026-9586 |
| 14 Sep | Cisco Secure Email Gateway | CVE-2026-76461 |
| 23 Oct | Arista VeloCloud Orchestrator | CVE-2026-114625 |
Source: CISA KEV feed. The BerriAI entry is an AI proxy that holds credentials for model providers, a reminder that SQL injection reaches new kinds of software.
SQL Injection in WordPress and Other CMS
On 17 July 2026 WordPress released version 7.0.2, a security release for one critical and one high severity issue, and enabled forced updates through its auto-update system for affected sites. The critical issue was a REST API batch-route confusion and SQL injection flaw leading to remote code execution; the high severity one was a separate SQL injection issue. WordPress 6.9 was affected by both and received 6.9.5; WordPress 6.8 was affected by the second only and received 6.8.6; versions before 6.8 were not affected. The CVEs are CVE-2026-63030 and CVE-2026-60137. CISA added both to its catalog on 21 July 2026. Source: WordPress.org and the CISA KEV feed.
For the wider WordPress ecosystem, ScanTitan counted CVEs whose NVD descriptions mention WordPress, and how many of those also mention SQL injection.
| Year | CVEs mentioning WordPress | Of which mention SQL injection |
|---|---|---|
| 2020 | 256 | 21 |
| 2021 | 981 | 125 |
| 2022 | 1,660 | 155 |
| 2023 | 2,113 | 177 |
| 2024 | 4,483 | 205 |
| 2025 | 4,245 | 284 |
| 2026 to 7 Nov | 6,410 | 485 |
Source: NVD API, queried 8 November 2026 and counted by ScanTitan. Counts are approximate because some API calls were retried.
The WordPress-related count grew about 13 times from 2020 to 2025, and the 485 in 2026 is already 71% above all of 2025. Most of these are plugin and theme flaws, not core. For plugin-level data, see ScanTitan’s WordPress plugin vulnerability statistics, for the CMS comparison its CMS vulnerability statistics, and for how these attacks work, the guide to WordPress SQL injection. Drupal core’s May 2026 flaw (CVE-2026-9082) is in KEV for privilege escalation and remote code execution through the database abstraction API; see also Joomla SQL injection.
How Common Is SQL Injection in Tested Applications?
No neutral source publishes how many applications are vulnerable. The best evidence is testing data from vendors, labeled here as vendor-only.
| Source | Finding | Period | Sample |
|---|---|---|---|
| Edgescan 2026 report | SQL injection is the most common critical web application vulnerability, as it has been since 2022 | 2025 data | Over 250 companies, 30 industry verticals |
| Edgescan 2025 report | SQL injection first among critical and high severity web and API findings: 28.28% in the table, 19.52% in the text | 2025 edition | Web and API layers; 14.8% of findings were critical or high |
| Aikido | 6.7% of open-source vulnerabilities and 10% of closed-source vulnerabilities it found were SQL injection | 2024, partial year | Open-source CVEs; Aikido’s own scans |
| Aikido | Over 20% of closed-source projects are vulnerable when they first start scanning; nearly 30 injectable locations on average | 2024 | Aikido customers |
| Invicti | 26% of scanned targets had SQL injection in 2015; 14% in 2018; 8% in 2019; 7% in 2020 | 2015 to 2020 | 3,500 targets in the 2020 edition |
| Veracode | 83.7% of AI-generated code samples passed the SQL injection test | October 2026 | 18 models, four languages |
Sources: Edgescan 2026, Edgescan 2025, Aikido, Invicti and Veracode. All vendor-only.
Three details matter. Edgescan’s 2025 report gives two different figures for SQL injection’s share on the same page, so quote it as “first among critical and high findings” unless you cite which figure. Invicti’s series shows the share of scanned targets falling from 26% to 7%, but the last edition found covers 2020, and the sample changed across editions. Veracode’s 83.7% means about one in six AI-generated code samples failed the SQL injection test, and the pass rate has not improved since July.
Attack Attempts and Breaches: What Is Known
Attack attempts
There is no current neutral count of SQL injection attempts. The most recent public breakdown we could verify is dated: Cloudflare’s managed web application firewall rules, December 2021 to March 2022, put SQL injection at 7.0% of mitigated requests, behind HTTP anomalies at 54.5%, vendor-specific CVE attacks at 11.8% and information disclosure at 10.4%. Cloudflare’s own text noted that attack types such as XSS and SQL injection together were about 13% of mitigated requests. Source: Cloudflare, vendor-only and from 2022. The 2022 data is not a 2026 attack share.
Breaches
Verizon’s 2026 DBIR does not report SQL injection as a separate statistic. In its Basic Web Application Attacks pattern, 10% of all breaches (2,281 confirmed breaches), stolen credentials were the top action at 56% and exploited vulnerabilities followed at 53% (n=2,193). For those figures and the wider web picture, see ScanTitan’s web application attack statistics.
The clearest documented breach of recent years is MOVEit Transfer. CISA and the FBI reported that the CL0P ransomware gang exploited a SQL injection flaw, CVE-2023-34362, from 27 May 2023 to install a web shell and steal data. CISA added it to its catalog on 2 June 2023 and published advisory AA23-158A on 7 June 2023. Source: CISA.
SQL Injection Statistics Commonly Misquoted
| Common claim | Correct context |
|---|---|
| “40% of data breaches are linked to SQL injection.” | This comes from a LinuxSecurity page dated 2010. Its body cites sources from the same era: 19% of breaches examined in one database and 60% in a 2010 report. No current source supports it. |
| “SQL injection attacks cost companies $8.7 million on average.” | The only source found is a developer blog anecdote about one company, not an average or a study. |
| “65% of organizations had a SQL injection attack get past their defenses.” | That is a 2014 Ponemon survey, not current data and not breach data. |
| “Only 7% of sites have SQL injection, so it is dying.” | 7% is Invicti’s 2020 scan sample. NVD descriptions mention SQL injection in 3,904 CVEs in 2025, the highest count in the series. |
| “SQL injection is the number one OWASP risk.” | It is not its own category. Injection, which includes XSS, was first in 2017, third in 2021 and fifth in 2025. |
| “SQL injection fell out of the top weaknesses.” | MITRE ranks it second in 2025, up from third. |
| “SQL injection is 6.7% of all vulnerabilities.” | That is Aikido’s share of open-source vulnerabilities for part of 2024. NVD descriptions give 6.2% for 2024 and 7.8% for 2025. |
| “There were 2,645 SQL injection vulnerabilities in 2024.” | A CVEdetails count quoted by a vendor. ScanTitan’s NVD description count is 2,508 for 2024. |
What the Numbers Mean for a Lean Team
Three facts shape the work: the flaw is published more often every year, the ones that get exploited sit in internet-facing products, and the fix is well known.
- Use parameterized queries. OWASP’s preferred defense is a safe API that avoids the interpreter, provides a parameterized interface, or uses an object-relational mapper. OWASP warns that stored procedures can still introduce SQL injection if they concatenate queries and data, and that table and column names cannot be escaped.
- Do not rely on a firewall alone. The July 2026 WordPress flaw was reachable by an anonymous attacker, and 58% of exploited SQL injection flaws in CISA’s catalog need no login. Patch first; WordPress forced the update for a reason.
- Keep every internet-facing product on the patch list. SQL injection in appliances, management consoles and AI proxies has been exploited, so the list is wider than your own website.
- Scan your own applications on a schedule. Edgescan lists SQL injection as the most common critical web finding, and Aikido found over 20% of closed-source projects vulnerable at first scan. Detection is straightforward; a website vulnerability scanner can test for it, and the CVE priority checker shows whether a flaw is exploited.
- Check generated code. About one in six AI-generated samples failed Veracode’s SQL injection test, so review it as you would any untrusted input.
- Know the neighbors. Injection also includes cross-site scripting and command injection, and the wider picture is in ScanTitan’s vulnerability statistics.
How We Compiled and Verified These Statistics
- Used: the NVD API, CISA’s Known Exploited Vulnerabilities feed and advisory AA23-158A, MITRE’s CWE Top 25 archive, OWASP Top 10 pages for 2021 and 2025, the WordPress.org 7.0.2 release notice, Edgescan’s 2025 report and 2026 page, Aikido, Invicti, Veracode and Cloudflare pages, and Verizon’s 2026 DBIR (full report). Vendor figures are labeled vendor-only.
- Method: NVD counts were queried on 8 November 2026 in 90-day windows by publication date, using the description text and the CWE-89 tag separately. KEV counts come from feed version 2026.11.06. Every other figure was read on its own page.
- Excluded: figures that trace only to pages from 2010, an anecdote presented as an average, and CVEdetails counts, which could not be opened without passing a bot check. Vendor figures that could not be read on the vendor’s own page, including a web attack share attributed to Akamai’s 2026 report, were left out.
- Refresh: reviewed every 90 days. NVD and KEV counts change daily; MITRE and OWASP update on their own cycles.
How to cite this research. ScanTitan, “SQL Injection Statistics 2026: CVEs, Exploits & Rankings,” 9 November 2026. For single figures, cite the primary source beside each number and state the NVD query date.
Primary Sources
- NVD CVE API
- CISA Known Exploited Vulnerabilities catalog data feed
- CISA advisory AA23-158A, MOVEit Transfer
- MITRE 2025 CWE Top 25
- OWASP Top 10:2025, A05 Injection and OWASP Top 10:2021, A03 Injection
- WordPress.org, WordPress 7.0.2 release
- Edgescan 2026 Vulnerability Statistics Report and 2025 report
- Aikido, the state of SQL injection
- Invicti AppSec Indicator, Spring 2021
- Veracode, GenAI code security, Fall 2026
- Cloudflare, application security
- Verizon 2026 Data Breach Investigations Report
Frequently Asked Questions
How common is SQL injection nowadays?
CVEs that mention SQL injection grew from 1,676 in 2022 to 3,904 in 2025, 7.8% of all CVEs published that year, and MITRE ranks it second in its 2025 weakness list. Counts are for published vulnerabilities, not attacks.
Is SQL injection dead?
No. It is rising in vulnerability data, 33 SQL injection flaws are in CISA’s exploited catalog, and 9 of them were added in 2026. Invicti’s decline from 26% to 7% of scanned targets covers only 2015 to 2020.
Is SQL injection an active attack?
Yes. CISA lists 33 SQL injection flaws with evidence of exploitation, 11 of them with known ransomware use, including a WordPress core flaw added on 21 July 2026 and MOVEit Transfer in 2023.
How many SQL injection vulnerabilities are there each year?
ScanTitan’s count of NVD descriptions mentioning SQL injection was 403 in 2020, 1,676 in 2022, 2,508 in 2024 and 3,904 in 2025. The count of CVEs tagged CWE-89 is lower (1,305 in 2025) because the NVD filter counts only the tag NVD itself assigns, and most CVEs carry only their publisher’s tag.
Where does SQL injection rank in the OWASP Top 10?
It has no separate rank. Injection, which includes cross-site scripting, was third in the 2021 list and fifth in 2025. In MITRE’s CWE Top 25, SQL injection itself ranks second in 2025.
How many SQL injection flaws are being exploited?
CISA’s catalog holds 33 entries tagged CWE-89, 1.9% of 1,769 entries. Nineteen are described as exploitable without authentication. A related WordPress flaw tagged differently is not in that count.
Is WordPress vulnerable to SQL injection?
Yes, mostly through plugins and themes. WordPress core had two flaws fixed in version 7.0.2 in July 2026, one of them chaining to remote code execution. NVD descriptions mention both WordPress and SQL injection in 485 CVEs from January to 7 November 2026.
How common is SQL injection in tested applications?
Edgescan’s 2026 report calls it the most common critical web application vulnerability, as it has been since 2022. Aikido found over 20% of closed-source projects vulnerable when they first start scanning. These are vendor-only figures.
Does AI-generated code have SQL injection?
Veracode found that 83.7% of AI-generated code samples passed its SQL injection test in October 2026, so about one in six failed. The rate has not improved since July.
How much does a SQL injection breach cost?
No current neutral source reports an average cost for SQL injection alone. Figures such as “$8.7 million” trace to anecdotes, and a 2014 Ponemon survey is outdated.
What is the most effective defense against SQL injection?
OWASP’s preferred defense is to keep data separate from commands: use a safe API, parameterized queries or an object-relational mapper, then server-side validation and escaping for what remains. Stored procedures can still be vulnerable if they concatenate input.
What percentage of breaches involve SQL injection?
There is no reliable current figure. Verizon’s 2026 DBIR does not report SQL injection separately, and older claims such as 40% trace to 2010. In the DBIR’s Basic Web Application Attacks pattern, 53% of breaches involved exploited vulnerabilities.
