CWE-89 · SQL Injection (page 13)
Page 13 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40832 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDevicegroups function due to improper neutralization of… |
CVE-2026-40831 | Medium | 6.5 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the Easy View due to improper neutralization of special element… |
CVE-2026-40830 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the admin.mbnetj.php files UpdateParam function due to improper… |
CVE-2026-40829 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper ne… |
CVE-2026-40828 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DeleteSysLogEntry function due to improper neutralization o… |
CVE-2026-40827 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of s… |
CVE-2025-30028 | High | 8.6 | 2026-05-27 | A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. |
CVE-2026-7618 | Medium | 4.9 | 2026-05-27 | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versio… |
CVE-2026-40826 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dsgvo_contracts view due to improper neutralization of spec… |
CVE-2026-40825 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutra… |
CVE-2026-40824 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view userid parameter due to improper neutral… |
CVE-2026-40823 | Medium | 5.5 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of s… |
CVE-2026-40822 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of s… |
CVE-2026-40821 | Medium | 4.9 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of s… |
CVE-2026-40819 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the sync_data24 task due to improper neutralization of special… |
CVE-2026-40818 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralizati… |
CVE-2026-40817 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization o… |
CVE-2026-40816 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to… |
CVE-2026-40815 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24api_getUserAccount function due to improper neutraliz… |
CVE-2026-40814 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _mb24confi_getTagAlarm function due to i… |
CVE-2026-40813 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions tagid parameter due to improper ne… |
CVE-2026-40812 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutr… |
CVE-2026-40811 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of speci… |
CVE-2026-40810 | High | 7.5 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of specia… |
CVE-2026-9607 | Medium | 6.3 | 2026-05-27 | A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcel_list.php. Performing a… |
CVE-2026-9606 | High | 7.3 | 2026-05-27 | A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation o… |
CVE-2026-9584 | High | 7.3 | 2026-05-26 | A security vulnerability has been detected in code-projects Project Management System 1.0. Affected is an unknown function of the file chk.php of the component… |
CVE-2026-9575 | High | 7.3 | 2026-05-26 | A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the file /admin/modules/… |
CVE-2026-9574 | High | 7.3 | 2026-05-26 | A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code of the file /admin/modules/student/tran… |
CVE-2026-9573 | High | 7.3 | 2026-05-26 | A vulnerability was detected in itsourcecode Student Transcript Processing System 1.0. This affects an unknown part of the file /admin/modules/student/index.ph… |
CVE-2026-46624 | Critical | 9.9 | 2026-05-26 | Twenty is an open source CRM. From 1.7.7 through 1.16.7, a critical Remote Code Execution (RCE) vulnerability exists in Twenty CRM via a chained SQL Injection… |
CVE-2026-44706 | High | 8.5 | 2026-05-26 | Chatwoot is a customer engagement suite. From 2.2.0 to before 4.11.2, a SQL injection vulnerability exists in the conversation and contact filter APIs. When fi… |
CVE-2026-44680 | High | 7.6 | 2026-05-26 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.1… |
CVE-2026-35222 | Critical | 9.8 | 2026-05-26 | Improperly validated order clauses lead to a SQL injection vulnerability in com_tags. |
CVE-2026-35221 | Critical | 9.8 | 2026-05-26 | Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder. |
CVE-2025-36220 | Medium | 4.3 | 2026-05-26 | IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could… |
CVE-2026-9552 | High | 7.3 | 2026-05-26 | A security flaw has been discovered in Das Parking Management System 停车场管理系统 6.2.0. This vulnerability affects unknown code of the component Search API Endpoin… |
CVE-2026-9551 | High | 7.3 | 2026-05-26 | A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0. This affects the function xp_cmdshell of the file ParkingRecord/ExportParkingRec… |
CVE-2026-42425 | High | 7.2 | 2026-05-26 | OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against t… |
CVE-2026-9544 | High | 7.3 | 2026-05-26 | A vulnerability was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 10. Affected by this vulnerability is an unknown functiona… |
CVE-2026-9542 | Medium | 6.3 | 2026-05-26 | A weakness has been identified in CodeAstro Leave Management System 1.0. The affected element is an unknown function of the file /admin/add_staff.php. Executin… |
CVE-2026-48136 | Medium | 4.1 | 2026-05-26 | When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can mod… |
CVE-2026-48134 | Medium | 5.6 | 2026-05-26 | When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access… |
CVE-2026-9528 | High | 7.3 | 2026-05-26 | A vulnerability was identified in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /admin/delete_judge.php. Such manipul… |
CVE-2026-9526 | High | 7.3 | 2026-05-26 | A vulnerability was found in itsourcecode Electronic Judging System 1.0. This vulnerability affects unknown code of the file /admin/edit_team.php. The manipula… |
CVE-2026-9525 | High | 7.3 | 2026-05-26 | A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /admin/edit_judge.php. The manipulation… |
CVE-2026-9524 | Medium | 6.3 | 2026-05-26 | A flaw has been found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is the function execute of the component REST Endpoint. Executing… |
CVE-2026-9523 | High | 7.3 | 2026-05-26 | A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Affected by this vulnerability is an… |
CVE-2026-48837 | High | 8.5 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injecti… |
CVE-2026-42774 | Critical | 9.3 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue af… |
CVE-2026-42773 | Critical | 9.3 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Inject… |
CVE-2026-48842 | High | 8.1 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash e… |
CVE-2026-9474 | High | 7.3 | 2026-05-25 | A vulnerability was found in yashpokharna2555 StudentManagementSystem up to cb2f558ddf8d19396de0f92abf2d224d46a0a203. Affected by this issue is the function co… |
CVE-2026-27768 | Medium | 6.6 | 2026-05-25 | SQL Injection affecting the Access Manager role. |
CVE-2026-9470 | High | 7.3 | 2026-05-25 | A security vulnerability has been detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This affects the function conf… |
CVE-2026-9469 | High | 7.3 | 2026-05-25 | A weakness has been identified in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. The impacted element is an unknown functio… |
CVE-2026-9465 | High | 7.3 | 2026-05-25 | A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/Get… |
CVE-2018-25381 | High | 7.1 | 2026-05-25 | Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through multipl… |
CVE-2018-25380 | High | 7.1 | 2026-05-25 | Joomla Component eXtroForms 2.1.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through the fil… |
CVE-2018-25379 | High | 8.2 | 2026-05-25 | Collectric CMU 1.0 contains a boolean-based blind SQL injection vulnerability in the lang parameter that allows unauthenticated attackers to manipulate databas… |
CVE-2018-25372 | High | 8.2 | 2026-05-25 | MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injectin… |
CVE-2018-25371 | High | 8.2 | 2026-05-25 | mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the produc… |
CVE-2018-25364 | High | 8.2 | 2026-05-25 | Twitter-Clone 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25362 | High | 8.2 | 2026-05-25 | Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL code through the use… |
CVE-2026-9451 | Medium | 6.3 | 2026-05-25 | A weakness has been identified in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /process… |
CVE-2026-9450 | Medium | 6.3 | 2026-05-25 | A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.php. The manipulation… |
CVE-2026-9449 | Medium | 6.3 | 2026-05-25 | A vulnerability was identified in code-projects Employee Management System 1.0. This impacts an unknown function of the file /changepassemp.php. The manipulati… |
CVE-2026-9447 | High | 7.3 | 2026-05-25 | A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /user/search.php. Perf… |
CVE-2026-9446 | Medium | 4.7 | 2026-05-25 | A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit_custo… |
CVE-2026-9444 | Medium | 4.7 | 2026-05-25 | A vulnerability was detected in SourceCodester Simple POS and Inventory System 1.0. This issue affects the function delete of the file /admin/deleteproduct.php… |
CVE-2026-9411 | Medium | 6.3 | 2026-05-25 | A vulnerability was found in SourceCodester Indian Invoicing System 1.0. This issue affects some unknown processing of the file /Invoicing/IGST_Invoice.php of… |
CVE-2026-9383 | High | 7.3 | 2026-05-24 | A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/admin/login.php. The manipulati… |
CVE-2026-9364 | High | 7.3 | 2026-05-24 | A flaw has been found in projectworlds Online Art Gallery Shop 1.0. Impacted is an unknown function of the file /admin/adminHome.php. Executing a manipulation… |
CVE-2026-9356 | High | 7.3 | 2026-05-24 | A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. This affects an unknown function of the file /admin/patients/… |
CVE-2026-9355 | High | 7.3 | 2026-05-24 | A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /classes/Maste… |
CVE-2026-9342 | Medium | 6.3 | 2026-05-23 | A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. Impacted is an unknown function of the file /admin/patie… |
CVE-2018-25352 | High | 7.1 | 2026-05-23 | WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate d… |
CVE-2018-25351 | High | 8.2 | 2026-05-23 | Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2018-25348 | High | 8.2 | 2026-05-23 | Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL… |
CVE-2018-25347 | High | 7.1 | 2026-05-23 | WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through th… |
CVE-2018-25346 | High | 7.1 | 2026-05-23 | WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injec… |
CVE-2018-25342 | High | 8.2 | 2026-05-23 | Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2018-25341 | High | 8.2 | 2026-05-23 | Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2018-25340 | High | 8.2 | 2026-05-23 | Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2026-9305 | Medium | 6.3 | 2026-05-23 | A weakness has been identified in QuantumNous new-api up to 0.12.1. The impacted element is the function SearchUserTopUps/SearchAllTopUps of the file model/top… |
CVE-2026-41075 | High | 8.8 | 2026-05-22 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerab… |
CVE-2026-25606 | | 2026-05-22 | A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Inject… | |
CVE-2026-4834 | High | 7.5 | 2026-05-22 | The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to i… |
CVE-2026-48240 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated… |
CVE-2026-48239 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clau… |
CVE-2026-48238 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause… |
CVE-2026-48237 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated… |
CVE-2026-48236 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser… |
CVE-2026-48235 | High | 8.2 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestam… |
CVE-2026-48234 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated… |
CVE-2026-48233 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT… |
CVE-2026-48232 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LI… |
CVE-2026-48231 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are conc… |
CVE-2026-39531 | Critical | 9.3 | 2026-05-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Inject… |
CVE-2026-44047 | High | 8.8 | 2026-05-21 | An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access t… |