CWE-89 · SQL Injection (page 10)
Page 10 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54815 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows B… |
CVE-2026-54813 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. Th… |
CVE-2026-54809 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue… |
CVE-2026-54808 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Inj… |
CVE-2025-59554 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions. |
CVE-2026-54811 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. |
CVE-2026-54187 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. |
CVE-2026-54186 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. |
CVE-2026-54185 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. |
CVE-2026-49084 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. |
CVE-2026-49080 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. |
CVE-2026-49079 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. |
CVE-2026-49076 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.9.1 versions. |
CVE-2026-49073 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. Th… |
CVE-2026-48967 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. |
CVE-2026-48875 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. |
CVE-2026-39596 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. |
CVE-2026-39438 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. |
CVE-2026-28576 | Medium | 5.5 | 2026-06-17 | In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no add… |
CVE-2026-22340 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. |
CVE-2026-22335 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions. |
CVE-2026-22332 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. |
CVE-2026-12360 | High | 7.5 | 2026-06-17 | The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a fi… |
CVE-2025-69135 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions. |
CVE-2026-52715 | Critical | 9.3 | 2026-06-16 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. |
CVE-2026-52712 | High | 7.6 | 2026-06-16 | Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions. |
CVE-2026-49772 | Critical | 9.3 | 2026-06-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind S… |
CVE-2026-39581 | High | 8.5 | 2026-06-16 | Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions. |
CVE-2026-39574 | Critical | 9.3 | 2026-06-16 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. |
CVE-2026-8444 | High | 8.8 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions… |
CVE-2026-8443 | High | 8.8 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data A… |
CVE-2026-52700 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions. |
CVE-2026-52697 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions. |
CVE-2026-52693 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. |
CVE-2026-49776 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions. |
CVE-2026-49067 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. |
CVE-2026-48964 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions. |
CVE-2026-48886 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. |
CVE-2026-48882 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions. |
CVE-2026-48874 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in GamiPress <= 7.8.7 versions. |
CVE-2026-45439 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. |
CVE-2026-42665 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. |
CVE-2026-42639 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. |
CVE-2026-42386 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. |
CVE-2026-42381 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. |
CVE-2026-40798 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. |
CVE-2026-40771 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. |
CVE-2026-40766 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions. |
CVE-2026-40762 | High | 7.5 | 2026-06-15 | Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions. |
CVE-2026-39530 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. |
CVE-2026-39519 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. |
CVE-2026-39512 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. |
CVE-2026-39511 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. |
CVE-2026-39502 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. |
CVE-2026-39493 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. |
CVE-2026-39492 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. |
CVE-2026-39441 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. |
CVE-2026-24637 | High | 8.5 | 2026-06-15 | Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions. |
CVE-2026-50890 | Critical | 9.8 | 2026-06-15 | Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability… |
CVE-2026-48114 | Critical | 9.8 | 2026-06-15 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL inje… |
CVE-2026-39196 | Critical | 9.8 | 2026-06-15 | Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. T… |
CVE-2026-38812 | Critical | 9.8 | 2026-06-15 | RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated… |
CVE-2026-36670 | High | 8.8 | 2026-06-15 | A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticat… |
CVE-2019-25746 | High | 7.1 | 2026-06-15 | WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by inj… |
CVE-2016-20073 | High | 8.2 | 2026-06-15 | Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2016-20072 | High | 8.2 | 2026-06-15 | BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by in… |
CVE-2016-20071 | High | 8.2 | 2026-06-15 | The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute ar… |
CVE-2016-20069 | High | 8.2 | 2026-06-15 | WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize t… |
CVE-2016-20068 | High | 8.2 | 2026-06-15 | WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute ar… |
CVE-2026-12206 | Medium | 6.3 | 2026-06-15 | A vulnerability was identified in Grit42 Grit up to 0.11.0. This issue affects the function Grit::Assays::DataTableEntity of the file modules/assays/backend/ap… |
CVE-2026-12188 | Medium | 6.3 | 2026-06-14 | A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the file modules/core/backend/app/controllers… |
CVE-2026-12175 | Medium | 4.7 | 2026-06-13 | A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStu… |
CVE-2026-6428 | High | 7.6 | 2026-06-13 | SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05… |
CVE-2026-9848 | High | 7.5 | 2026-06-13 | The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The pl… |
CVE-2026-12131 | Medium | 6.3 | 2026-06-12 | A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\cont… |
CVE-2026-44172 | Critical | 9.1 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping i… |
CVE-2026-41581 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has b… | |
CVE-2026-48613 | Medium | 5.9 | 2026-06-12 | SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution… |
CVE-2026-45418 | High | 8.8 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles… |
CVE-2026-45060 | Critical | 9.8 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injec… |
CVE-2026-42647 | Critical | 9.3 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue… |
CVE-2026-39494 | Critical | 9.3 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Inject… |
CVE-2026-11945 | Medium | 6.4 | 2026-06-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a… |
CVE-2026-38581 | Critical | 9.8 | 2026-06-11 | SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain para… |
CVE-2026-53474 | Critical | 9.6 | 2026-06-10 | A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Du… |
CVE-2026-52758 | High | 8.8 | 2026-06-10 | Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping… |
CVE-2026-49498 | High | 8.8 | 2026-06-10 | Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in… |
CVE-2026-3018 | High | 7.5 | 2026-06-10 | The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13… |
CVE-2026-3326 | High | 8.6 | 2026-06-10 | The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to un… |
CVE-2026-50636 | High | 8.8 | 2026-06-09 | The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which conca… |
CVE-2026-8025 | Critical | 9.8 | 2026-06-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQ… |
CVE-2026-7486 | Critical | 9.8 | 2026-06-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection. This i… |
CVE-2017-20249 | High | 8.2 | 2026-06-09 | Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2017-20247 | High | 8.2 | 2026-06-09 | WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injec… |
CVE-2017-20246 | High | 8.2 | 2026-06-09 | KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an… |
CVE-2017-20245 | High | 8.2 | 2026-06-09 | Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploit… |
CVE-2017-20244 | High | 8.2 | 2026-06-09 | Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by… |
CVE-2017-20243 | High | 8.2 | 2026-06-09 | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate d… |
CVE-2016-20065 | High | 8.2 | 2026-06-09 | Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by in… |
CVE-2016-20063 | High | 7.1 | 2026-06-09 | Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious c… |