CWE-89 · SQL Injection (page 12)
Page 12 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-65336 | Critical | 9.8 | 2026-07-30 | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. |
CVE-2026-4978 | Critical | 9.8 | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection… |
CVE-2026-54368 | High | 8.8 | 2026-07-30 | CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arb… |
CVE-2026-17543 | Critical | 9.8 | 2026-07-30 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* bef… |
CVE-2026-22620 | High | 8.6 | 2026-07-30 | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass a… |
CVE-2026-58046 | Critical | 9.9 | 2026-07-30 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Pl… |
CVE-2026-15153 | Medium | 6.8 | 2026-07-30 | The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query… |
CVE-2026-13395 | High | 8.6 | 2026-07-30 | The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauth… |
CVE-2026-48448 | High | 8.6 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could le… |
CVE-2026-16092 | Medium | 6.5 | 2026-07-30 | The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all ve… |
CVE-2026-15929 | | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL Injection. This iss… | |
CVE-2025-69949 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email. |
CVE-2025-69945 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1. |
CVE-2025-69944 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter. |
CVE-2025-69943 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid. |
CVE-2025-69942 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. |
CVE-2025-67408 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status. |
CVE-2025-67407 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class. |
CVE-2025-67406 | High | 7.3 | 2026-07-29 | https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The compone… |
CVE-2025-67405 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password. |
CVE-2025-67404 | Critical | 9.8 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class. |
CVE-2025-67403 | Critical | 9.8 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name. |
CVE-2025-65340 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php. |
CVE-2026-5490 | High | 8.8 | 2026-07-29 | DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Driv… |
CVE-2026-8339 | | 2026-07-29 | A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat… | |
CVE-2026-65890 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in querie… |
CVE-2026-33385 | | 2026-07-29 | A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields… | |
CVE-2026-12895 | | 2026-07-29 | SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation us… | |
CVE-2026-11973 | Medium | 4.9 | 2026-07-29 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8… |
CVE-2026-63234 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint… |
CVE-2026-63233 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpo… |
CVE-2026-63232 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoi… |
CVE-2026-63231 | High | 8.1 | 2026-07-29 | A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs u… |
CVE-2026-63230 | Critical | 9.1 | 2026-07-29 | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including… |
CVE-2026-63229 | Critical | 9.1 | 2026-07-29 | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endp… |
CVE-2026-15344 | Medium | 4.9 | 2026-07-29 | The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002… |
CVE-2026-54658 | Critical | 9.8 | 2026-07-28 | Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes befo… |
CVE-2026-6881 | | 2026-07-28 | A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive informatio… | |
CVE-2026-11391 | Medium | 6.3 | 2026-07-28 | Tanium addressed a SQL injection vulnerability in Patch. |
CVE-2026-7769 | High | 8.1 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6… |
CVE-2026-50736 | High | 7.5 | 2026-07-28 | The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the su… |
CVE-2026-15304 | Medium | 6.5 | 2026-07-28 | The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is d… |
CVE-2026-15444 | Medium | 4.9 | 2026-07-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all version… |
CVE-2026-16462 | Critical | 9.8 | 2026-07-28 | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands. |
CVE-2026-14785 | High | 7.5 | 2026-07-28 | The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due… |
CVE-2026-10207 | High | 7.5 | 2026-07-28 | The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitiz… |
CVE-2026-15267 | Medium | 6.5 | 2026-07-28 | The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' pa… |
CVE-2026-14516 | High | 7.5 | 2026-07-28 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in a… |
CVE-2026-13161 | High | 7.5 | 2026-07-28 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parame… |
CVE-2026-12800 | High | 7.5 | 2026-07-28 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/… |
CVE-2026-15673 | Medium | 4.4 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'check… |
CVE-2026-15671 | Medium | 4.9 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'i… |
CVE-2026-15670 | Medium | 4.9 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the… |
CVE-2026-12741 | High | 7.5 | 2026-07-28 | The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all vers… |
CVE-2026-6251 | Medium | 6.5 | 2026-07-28 | The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetc… |
CVE-2026-16811 | Medium | 4.9 | 2026-07-28 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' para… |
CVE-2026-51077 | High | 7.5 | 2026-07-27 | SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php… |
CVE-2026-17191 | Critical | 9.1 | 2026-07-27 | An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, wh… |
CVE-2025-50455 | Critical | 9.1 | 2026-07-27 | SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability… |
CVE-2026-66427 | High | 7.6 | 2026-07-27 | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. |
CVE-2026-59551 | High | 8.5 | 2026-07-27 | Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59550 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. |
CVE-2026-59549 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59538 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. |
CVE-2026-59537 | High | 7.6 | 2026-07-27 | Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions. |
CVE-2026-59533 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. |
CVE-2026-59527 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-65877 | | 2026-07-27 | Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager se… | |
CVE-2026-65876 | | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles… | |
CVE-2026-65766 | | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content… | |
CVE-2026-14189 | Low | 3.8 | 2026-07-27 | The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with adm… |
CVE-2026-65707 | Medium | 6.5 | 2026-07-24 | Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting… |
CVE-2026-15663 | Medium | 4.9 | 2026-07-24 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in al… |
CVE-2026-16765 | High | 7.3 | 2026-07-23 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkad… |
CVE-2026-63359 | Critical | 9.8 | 2026-07-23 | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted reque… |
CVE-2026-65761 | | 2026-07-23 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unau… | |
CVE-2026-65532 | High | 7.6 | 2026-07-23 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. |
CVE-2026-65526 | High | 8.5 | 2026-07-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This is… |
CVE-2026-65494 | High | 7.1 | 2026-07-23 | Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. |
CVE-2026-65462 | High | 7.6 | 2026-07-23 | Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. |
CVE-2026-65454 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions. |
CVE-2026-65451 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-65450 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-61950 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. |
CVE-2026-61949 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in Bookly <= 27.7 versions. |
CVE-2026-61948 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. |
CVE-2026-59526 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-59525 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. |
CVE-2026-59514 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. |
CVE-2026-25405 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in eRoom <= 1.7.1 versions. |
CVE-2026-24552 | High | 8.5 | 2026-07-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blin… |
CVE-2026-15906 | Medium | 6.5 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions u… |
CVE-2026-15761 | Medium | 6.5 | 2026-07-23 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up t… |
CVE-2026-15448 | Medium | 6.5 | 2026-07-23 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versio… |
CVE-2026-13119 | Medium | 6.5 | 2026-07-23 | The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_rec… |
CVE-2026-13009 | Medium | 6.5 | 2026-07-23 | The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and includi… |
CVE-2026-9713 | High | 7.5 | 2026-07-23 | The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON f… |
CVE-2026-2395 | Critical | 9.8 | 2026-07-22 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platfor… |
CVE-2026-12987 | High | 7.5 | 2026-07-22 | The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-suppli… |
CVE-2026-16490 | Medium | 6.3 | 2026-07-22 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipula… |