CWE-89 · SQL Injection (page 10)
Page 10 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72851 | Critical | 10.0 | 2026-08-13 | Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST at… |
CVE-2026-16961 | High | 7.6 | 2026-08-13 | IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, a… |
CVE-2024-58374 | High | 7.5 | 2026-08-13 | Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to acce… |
CVE-2019-25765 | High | 7.5 | 2026-08-13 | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipula… |
CVE-2026-59109 | High | 8.8 | 2026-08-13 | SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-inv… |
CVE-2026-73670 | High | 7.2 | 2026-08-13 | A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLU… |
CVE-2026-19710 | High | 7.3 | 2026-08-13 | A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin… |
CVE-2026-73346 | High | 7.6 | 2026-08-13 | Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. |
CVE-2026-66658 | High | 8.5 | 2026-08-13 | Subscriber SQL Injection in Reviewer <= 3.14.2 versions. |
CVE-2026-66478 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. |
CVE-2026-66472 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. |
CVE-2026-66458 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in RealPress <= 1.1.2 versions. |
CVE-2026-66446 | Critical | 9.3 | 2026-08-13 | Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions. |
CVE-2026-66436 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. |
CVE-2026-66430 | High | 8.5 | 2026-08-13 | Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. |
CVE-2026-61969 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. |
CVE-2026-61966 | Critical | 9.3 | 2026-08-13 | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. |
CVE-2026-28168 | High | 8.5 | 2026-08-13 | Subscriber SQL Injection in CubeWP <= 1.1.30 versions. |
CVE-2026-28156 | High | 8.5 | 2026-08-13 | Subscriber SQL Injection in Do Lasso <= 358 versions. |
CVE-2026-28142 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. |
CVE-2026-28002 | High | 8.5 | 2026-08-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issu… |
CVE-2026-28001 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
CVE-2026-27538 | High | 7.5 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
CVE-2026-15741 | High | 8.8 | 2026-08-13 | SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect e… |
CVE-2026-11840 | High | 8.8 | 2026-08-13 | Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection. |
CVE-2026-73332 | High | 8.7 | 2026-08-12 | CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject a… |
CVE-2026-73331 | High | 7.1 | 2026-08-12 | CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit… |
CVE-2026-72807 | High | 8.0 | 2026-08-12 | SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which… |
CVE-2026-67579 | High | 7.4 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pag… |
CVE-2026-17111 | High | 7.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to vi… |
CVE-2026-73300 | Critical | 9.6 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enablin… |
CVE-2026-44741 | High | 8.8 | 2026-08-12 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translatio… |
CVE-2026-17419 | Medium | 6.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL… |
CVE-2026-17418 | High | 8.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in… |
CVE-2026-17222 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special element… |
CVE-2025-41771 | Medium | 4.3 | 2026-08-12 | An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability a… |
CVE-2026-66659 | Critical | 9.3 | 2026-08-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This… |
CVE-2026-18474 | High | 8.6 | 2026-08-12 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection expl… |
CVE-2026-18230 | High | 8.1 | 2026-08-12 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated… |
CVE-2026-18057 | High | 8.1 | 2026-08-12 | The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with… |
CVE-2026-16977 | High | 8.1 | 2026-08-12 | The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query bu… |
CVE-2026-13613 | High | 8.8 | 2026-08-12 | The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authentic… |
CVE-2026-73211 | Critical | 9.8 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub… |
CVE-2026-48381 | Critical | 9.0 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2022-50997 | High | 7.5 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attack… |
CVE-2016-20097 | High | 7.5 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbit… |
CVE-2026-65673 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate p… |
CVE-2026-73069 | Critical | 9.1 | 2026-08-11 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permiss… |
CVE-2026-46670 | Critical | 9.8 | 2026-08-11 | YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allo… |
CVE-2026-72775 | High | 8.8 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier paramet… |
CVE-2026-72750 | High | 8.8 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression v… |
CVE-2026-72610 | Medium | 4.3 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers… |
CVE-2026-72609 | High | 7.1 | 2026-08-11 | An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive perm… |
CVE-2026-72608 | Medium | 6.5 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator perm… |
CVE-2026-72607 | High | 7.1 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod per… |
CVE-2026-72599 | Critical | 9.8 | 2026-08-11 | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The paramete… |
CVE-2026-72562 | High | 8.8 | 2026-08-11 | An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataO… |
CVE-2026-72558 | High | 8.8 | 2026-08-11 | An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The c… |
CVE-2026-72550 | Critical | 9.8 | 2026-08-11 | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the… |
CVE-2026-19425 | Critical | 9.8 | 2026-08-11 | Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL… |
CVE-2026-66770 | Medium | 6.3 | 2026-08-11 | Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string… |
CVE-2026-72908 | Medium | 6.5 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/t… |
CVE-2025-13294 | | 2026-08-10 | An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controll… | |
CVE-2026-72899 | Critical | 10.0 | 2026-08-10 | Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter. |
CVE-2026-72898 | Critical | 10.0 | 2026-08-10 | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the con… |
CVE-2026-72731 | High | 7.1 | 2026-08-10 | Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameter… |
CVE-2026-63106 | Critical | 9.8 | 2026-08-10 | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products end… |
CVE-2026-72565 | Critical | 9.8 | 2026-08-10 | A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary da… |
CVE-2026-32227 | Critical | 9.8 | 2026-08-10 | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue. |
CVE-2026-19053 | Critical | 9.1 | 2026-08-10 | The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticate… |
CVE-2026-19049 | High | 8.6 | 2026-08-10 | The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every req… |
CVE-2026-18666 | Medium | 4.3 | 2026-08-10 | The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing… |
CVE-2026-16949 | Medium | 5.8 | 2026-08-10 | The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated att… |
CVE-2026-14238 | Medium | 4.1 | 2026-08-10 | The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in… |
CVE-2026-19384 | High | 7.3 | 2026-08-10 | A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php… |
CVE-2026-19364 | Medium | 6.3 | 2026-08-09 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancych… |
CVE-2026-19355 | High | 7.3 | 2026-08-09 | A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of th… |
CVE-2026-19354 | Medium | 6.3 | 2026-08-09 | A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers… |
CVE-2026-19351 | High | 7.3 | 2026-08-09 | A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.b… |
CVE-2026-19347 | Medium | 6.3 | 2026-08-09 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such man… |
CVE-2026-19344 | High | 7.3 | 2026-08-09 | A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/comment_coun… |
CVE-2026-19343 | High | 7.3 | 2026-08-09 | A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php… |
CVE-2026-18473 | Critical | 9.1 | 2026-08-09 | The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injec… |
CVE-2026-17044 | High | 8.6 | 2026-08-09 | The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL i… |
CVE-2026-17017 | High | 8.1 | 2026-08-09 | The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action… |
CVE-2026-16589 | High | 7.7 | 2026-08-08 | The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated… |
CVE-2026-19231 | High | 7.3 | 2026-08-07 | A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.ph… |
CVE-2026-64636 | High | 7.7 | 2026-08-07 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel databas… |
CVE-2026-19211 | High | 7.3 | 2026-08-07 | A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a… |
CVE-2026-66838 | High | 8.2 | 2026-08-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL Injection via the :commen… |
CVE-2026-19196 | High | 7.3 | 2026-08-07 | A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The… |
CVE-2026-15361 | High | 8.1 | 2026-08-07 | The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker-supplied… |
CVE-2026-67689 | Critical | 9.8 | 2026-08-06 | SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpo… |
CVE-2026-19071 | Medium | 6.3 | 2026-08-06 | A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of th… |
CVE-2026-19070 | Medium | 6.3 | 2026-08-06 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of t… |
CVE-2026-19069 | Medium | 6.3 | 2026-08-06 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. T… |
CVE-2026-19068 | Medium | 6.3 | 2026-08-06 | A weakness has been identified in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /treatmentdetail.php. Ex… |
CVE-2026-19067 | Medium | 6.3 | 2026-08-06 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Per… |
CVE-2026-19062 | High | 7.3 | 2026-08-06 | A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.ac… |
CVE-2026-3430 | High | 8.6 | 2026-08-06 | The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated… |