SQL Injection
0 confirmed incidents.
VERIS: hacking:SQLiMITRE ATT&CK: T1190 (Exploit Public-Facing Application)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
SQL injection covers an attack that inserts malicious database commands through an application input field that fails to separate user input from the query it builds, letting the attacker read, alter or delete data directly from the underlying database. It maps to one MITRE ATT&CK technique, T1190 (Exploit Public-Facing Application), the same technique behind the broader Code Injection classification -- SQL injection is tracked as its own attack type because it targets the database layer specifically and is common, and well documented, enough to identify from a source document on its own.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as SQL Injection on Breach Census?
0 confirmed incidents are currently classified as SQL Injection.
Which MITRE ATT&CK techniques does the SQL Injection classification cover?
This classification maps to MITRE ATT&CK technique T1190 (Exploit Public-Facing Application).
What counts as a confirmed incident for the SQL Injection classification?
An incident counts here once it carries the SQL Injection attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.