CWE-89 · SQL Injection (page 12)
Page 12 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10251 | High | 7.3 | 2026-06-01 | A weakness has been identified in itsourcecode Online House Rental System 1.0. The impacted element is an unknown function of the file /ajax.php?action=login… |
CVE-2026-10250 | High | 7.3 | 2026-06-01 | A security flaw has been discovered in itsourcecode Online Blood Bank Management System 1.0. The affected element is an unknown function of the file /admin/cam… |
CVE-2026-10249 | High | 7.3 | 2026-06-01 | A vulnerability was identified in itsourcecode Online Blood Bank Management System 1.0. Impacted is an unknown function of the file /admin/viewrequest.php. Suc… |
CVE-2026-40546 | | 2026-06-01 | SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially… | |
CVE-2026-10242 | Medium | 6.3 | 2026-06-01 | A weakness has been identified in itsourcecode Content Management System 1.0. This impacts an unknown function of the file /instructions.php. This manipulation… |
CVE-2026-10237 | Medium | 4.7 | 2026-06-01 | A vulnerability was found in SourceCodester Water Billing Management System 1.0. Impacted is an unknown function of the file /admin/?page=user/manage_user of t… |
CVE-2026-10235 | Medium | 6.3 | 2026-06-01 | A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of the file /Ingredients-Stock/stock_manage… |
CVE-2026-10227 | High | 7.3 | 2026-06-01 | A vulnerability has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. The affected element is an unk… |
CVE-2026-10226 | High | 7.3 | 2026-06-01 | A flaw has been found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. Impacted is an unknown function of the… |
CVE-2026-10225 | High | 7.3 | 2026-06-01 | A vulnerability was detected in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. This issue affects some unknown… |
CVE-2026-10209 | Medium | 6.3 | 2026-06-01 | A vulnerability has been found in code-projects Online Hospital Management System 1.0. Affected is an unknown function of the file appointmentdetail.php of the… |
CVE-2026-10208 | High | 7.3 | 2026-06-01 | A flaw has been found in code-projects Online Hospital Management System 1.php. This impacts the function login_user of the file login_1.php. Executing a manip… |
CVE-2026-10204 | Medium | 6.3 | 2026-06-01 | A weakness has been identified in OFCMS 1.1.3. The affected element is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controlle… |
CVE-2026-10203 | Medium | 6.3 | 2026-06-01 | A security flaw has been discovered in OFCMS 1.1.3. Impacted is the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\syste… |
CVE-2026-10202 | Medium | 6.3 | 2026-06-01 | A vulnerability was identified in OFCMS 1.1.3. This issue affects the function Query of the file \ofcms-admin\src\main\java\com\ofsoft\cms\admin\controller\sys… |
CVE-2026-10193 | Medium | 6.3 | 2026-05-31 | A security flaw has been discovered in OFCMS up to 1.1.3. The impacted element is the function Query of the file ofcms-admin\src\main\java\com\ofsoft\cms\admin… |
CVE-2026-10186 | High | 7.3 | 2026-05-31 | A security vulnerability has been detected in code-projects Online Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-10185 | High | 7.3 | 2026-05-31 | A weakness has been identified in SourceCodester Hospitals Patient Records Management System 1.0. Affected is an unknown function of the file /classes/Users.ph… |
CVE-2026-10184 | High | 7.3 | 2026-05-31 | A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This impacts an unknown function of the file /classes/Us… |
CVE-2026-49490 | High | 8.1 | 2026-05-31 | OpenCATS from version 0.9.1a contains an SQL injection vulnerability in DataGrid filter handling that allows authenticated attackers to inject SQL through craf… |
CVE-2026-49489 | High | 8.5 | 2026-05-31 | OpenCATS through 0.9.7.4 contains a sql injection vulnerability in the sortDirection parameter of the DataGrid component that allows authenticated users to ext… |
CVE-2026-10178 | High | 7.3 | 2026-05-31 | A vulnerability was detected in code-projects Online Music Site 1.0. This vulnerability affects unknown code of the file /Administrator/PHP/AdminEditAlbum.php… |
CVE-2026-10176 | Medium | 6.3 | 2026-05-31 | A weakness has been identified in Aider-AI Aider 0.86.3. Affected by this issue is some unknown functionality of the component Code Generation Workflow. Execut… |
CVE-2026-10171 | Medium | 4.7 | 2026-05-31 | A vulnerability has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. Such m… |
CVE-2026-10170 | Medium | 6.3 | 2026-05-31 | A flaw has been found in code-projects Visitor Management System 1.0. Affected by this issue is some unknown functionality of the file /vms/php/phone_0.php. Th… |
CVE-2026-10155 | Medium | 4.7 | 2026-05-31 | A vulnerability was found in Bdtask Multi-Store Inventory Management System 1.0. The impacted element is the function accounts_report_search of the file applic… |
CVE-2018-25425 | High | 8.2 | 2026-05-30 | Yot CMS 3.3.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throug… |
CVE-2018-25424 | High | 8.2 | 2026-05-30 | Gate Pass Management System 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code th… |
CVE-2018-25422 | High | 8.2 | 2026-05-30 | MOGG web simulator Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands by injecting maliciou… |
CVE-2018-25420 | High | 8.2 | 2026-05-30 | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25419 | High | 8.2 | 2026-05-30 | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25418 | High | 8.2 | 2026-05-30 | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25417 | High | 8.2 | 2026-05-30 | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25416 | High | 8.2 | 2026-05-30 | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25415 | High | 8.2 | 2026-05-30 | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25414 | High | 8.2 | 2026-05-30 | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25413 | High | 8.2 | 2026-05-30 | AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25411 | High | 8.2 | 2026-05-30 | MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting ma… |
CVE-2018-25410 | High | 7.1 | 2026-05-30 | SIM-PKH 2.4.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25407 | High | 8.2 | 2026-05-30 | eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25406 | High | 8.2 | 2026-05-30 | eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25405 | High | 8.2 | 2026-05-30 | eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2026-9757 | High | 7.5 | 2026-05-30 | The GEO my WP plugin for WordPress is vulnerable to SQL Injection via the 'swlatlng' and 'nelatlng' parameters in all versions up to, and including, 4.5.5 The… |
CVE-2026-10111 | High | 7.3 | 2026-05-30 | A flaw has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0. This impacts an unknown function of the component Login Page. Executing a manipulation of the… |
CVE-2026-10110 | High | 7.3 | 2026-05-30 | A vulnerability was detected in code-projects Student Details Management System 1.0. This affects an unknown function of the file /index.php. Performing a mani… |
CVE-2026-10105 | High | 8.3 | 2026-05-29 | agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supply… |
CVE-2026-39229 | Medium | 6.5 | 2026-05-29 | Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level privileges can expl… |
CVE-2018-25404 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25403 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25402 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25401 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25400 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25399 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25398 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25395 | High | 8.2 | 2026-05-29 | Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code t… |
CVE-2018-25394 | High | 8.2 | 2026-05-29 | Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code t… |
CVE-2018-25392 | High | 7.1 | 2026-05-29 | MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, an… |
CVE-2018-25390 | High | 8.2 | 2026-05-29 | HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'de… |
CVE-2018-25389 | High | 8.2 | 2026-05-29 | HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'na… |
CVE-2018-25386 | High | 8.2 | 2026-05-29 | HaPe PKH 1.1 contains multiple SQL injection vulnerabilities in admin/media.php that allow attackers to manipulate database queries by injecting SQL code throu… |
CVE-2018-25385 | High | 8.2 | 2026-05-29 | E-Registrasi Pencak Silat 18.10 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2018-25382 | High | 8.2 | 2026-05-29 | Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the unam… |
CVE-2026-44238 | High | 8.8 | 2026-05-29 | FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.11, the CDR Reports module page allows SQL injection through the order and sort POST parameters. Au… |
CVE-2026-10039 | Medium | 4.9 | 2026-05-29 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3… |
CVE-2026-4776 | High | 7.1 | 2026-05-29 | An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an au… |
CVE-2026-45288 | Critical | 9.8 | 2026-05-28 | Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search APIs interpolated the user-supplied regCon… |
CVE-2026-7048 | Medium | 6.5 | 2026-05-28 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order_by' parameter in… |
CVE-2026-7797 | High | 7.5 | 2026-05-28 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'ap… |
CVE-2026-44886 | | 2026-05-27 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web application endpoint is vulnerable to SQL… | |
CVE-2026-44635 | High | 7.5 | 2026-05-27 | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.visitJSONPathLeg does not escape JSON-path metacharacters (… |
CVE-2026-44521 | High | 8.8 | 2026-05-27 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.68, an authenticated SQL injection vulnerability in the el… |
CVE-2026-38808 | Medium | 5.3 | 2026-05-27 | SQL Injection vulnerability in uzy-ssm-mall v1.1.0 allows a remote attacker to obtain sensitive information via the ProductMapper.xml and /OrderUtil.java compo… |
CVE-2026-38930 | Medium | 6.5 | 2026-05-27 | OpenRapid RapidCMS v1.3.1 was discovered to contain an authentication bypass in the /template/default/menu.php component. This vulnerability is exploited via i… |
CVE-2026-49046 | High | 8.5 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arjun Thakur Duplicate Page and Post allows Blind SQL Inj… |
CVE-2026-9617 | Medium | 6.8 | 2026-05-27 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a table and placing malicious code inside a column i… |
CVE-2026-42761 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-42755 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 TableOn posts-table-filterable allows Blind SQ… |
CVE-2026-42747 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows… |
CVE-2026-42740 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.Thi… |
CVE-2026-42730 | High | 8.5 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-managem… |
CVE-2026-42727 | Critical | 9.3 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 Active Products Tables for WooCommerce profit-… |
CVE-2026-8054 | | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/audi… | |
CVE-2026-40850 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of… |
CVE-2026-40849 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of sp… |
CVE-2026-40848 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements… |
CVE-2026-40847 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special e… |
CVE-2026-40846 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special eleme… |
CVE-2026-40845 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization o… |
CVE-2026-40844 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special el… |
CVE-2026-40843 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special ele… |
CVE-2026-40842 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of sp… |
CVE-2026-40841 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of s… |
CVE-2026-40840 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralizatio… |
CVE-2026-40839 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralizatio… |
CVE-2026-40838 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization o… |
CVE-2026-40837 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization… |
CVE-2026-40836 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special e… |
CVE-2026-40835 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization… |
CVE-2026-40834 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to i… |
CVE-2026-40833 | High | 7.1 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper… |