CWE-89 · SQL Injection (page 13)
Page 13 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-62528 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2… |
CVE-2026-62527 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that are affected are 12… |
CVE-2026-62516 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are… |
CVE-2026-61294 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Calendar Synchronizations). Supported versions that ar… |
CVE-2026-61266 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite (component: Copy Inventory Organization). Supported versions that ar… |
CVE-2026-60582 | High | 8.3 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected… |
CVE-2026-16484 | High | 7.3 | 2026-07-21 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_sub… |
CVE-2026-63080 | Medium | 6.5 | 2026-07-21 | Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data a… |
CVE-2026-52476 | High | 7.5 | 2026-07-21 | SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java… |
CVE-2026-52472 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file |
CVE-2026-52470 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file |
CVE-2026-52469 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file |
CVE-2026-64880 | High | 7.1 | 2026-07-21 | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enab… |
CVE-2026-55084 | High | 8.8 | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in t… |
CVE-2026-55082 | | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticat… | |
CVE-2016-20096 | Critical | 9.8 | 2026-07-21 | Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQ… |
CVE-2026-15829 | High | 8.1 | 2026-07-21 | A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapi… |
CVE-2026-16449 | Medium | 6.3 | 2026-07-21 | A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/Order… |
CVE-2026-1617 | Critical | 9.8 | 2026-07-21 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Log… |
CVE-2026-8082 | High | 7.5 | 2026-07-21 | The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submis… |
CVE-2026-16334 | Medium | 6.3 | 2026-07-21 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such… |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-57308 | Critical | 9.8 | 2026-07-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitleme… |
CVE-2026-16252 | High | 7.3 | 2026-07-20 | A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function… |
CVE-2026-57309 | | 2026-07-20 | A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP head… | |
CVE-2026-16244 | Medium | 6.3 | 2026-07-20 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2026-11349 | High | 8.6 | 2026-07-20 | The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request p… |
CVE-2026-16228 | High | 7.3 | 2026-07-19 | A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_schoolyr.php. Performin… |
CVE-2026-16227 | High | 7.3 | 2026-07-19 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /edit_subject… |
CVE-2026-16154 | High | 7.3 | 2026-07-18 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-16152 | High | 7.3 | 2026-07-18 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a ma… |
CVE-2026-16131 | Medium | 6.3 | 2026-07-18 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manip… |
CVE-2026-52348 | Critical | 9.8 | 2026-07-17 | cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java. |
CVE-2026-60137 | Medium | 5.9 | 2026-07-17 | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow… |
CVE-2026-44739 | High | 8.7 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBun… |
CVE-2026-12283 | Medium | 6.8 | 2026-07-17 | Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feat… |
CVE-2026-9586 | Critical | 9.8 | 2026-07-17 | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <Pol… |
CVE-2026-8297 | Critical | 9.8 | 2026-07-17 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and… |
CVE-2026-16014 | High | 7.3 | 2026-07-17 | A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulat… |
CVE-2026-16009 | Medium | 6.3 | 2026-07-17 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The mani… |
CVE-2026-62238 | High | 8.8 | 2026-07-17 | OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by c… |
CVE-2026-14782 | Medium | 4.9 | 2026-07-16 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, an… |
CVE-2026-38158 | Critical | 9.8 | 2026-07-16 | A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via… |
CVE-2025-45868 | High | 8.8 | 2026-07-16 | LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate S… |
CVE-2026-58078 | | 2026-07-16 | Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable t… | |
CVE-2026-15727 | Medium | 4.9 | 2026-07-16 | The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in all versions up to, and including, 1.4… |
CVE-2026-15651 | Medium | 4.9 | 2026-07-16 | The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all versions up to, and includ… |
CVE-2026-15022 | Medium | 6.5 | 2026-07-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions u… |
CVE-2026-13767 | Medium | 6.5 | 2026-07-16 | The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to ins… |
CVE-2026-13754 | Medium | 6.5 | 2026-07-16 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and includi… |
CVE-2026-12395 | Medium | 6.5 | 2026-07-16 | The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users… |
CVE-2026-15458 | Medium | 4.9 | 2026-07-16 | The SEO Booster plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_field' parameter in all versions up to, and including, 7.3.1 due to i… |
CVE-2026-15445 | Medium | 4.9 | 2026-07-16 | The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to i… |
CVE-2026-12941 | Medium | 6.5 | 2026-07-16 | The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' para… |
CVE-2026-12753 | High | 7.5 | 2026-07-16 | The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter i… |
CVE-2026-15907 | High | 7.3 | 2026-07-16 | A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a m… |
CVE-2026-62361 | Medium | 5.5 | 2026-07-15 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-co… |
CVE-2026-52887 | Critical | 10.0 | 2026-07-15 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-not… |
CVE-2026-50030 | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck throu… | |
CVE-2026-45535 | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultVal… | |
CVE-2026-45417 | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSc… | |
CVE-2026-45320 | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by Sqlparse… | |
CVE-2026-57821 | High | 8.1 | 2026-07-15 | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request p… |
CVE-2026-56287 | High | 8.1 | 2026-07-15 | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The ord… |
CVE-2026-35152 | High | 8.8 | 2026-07-15 | A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter v… |
CVE-2026-57832 | | 2026-07-15 | Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated S… | |
CVE-2026-57831 | | 2026-07-15 | Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extension DP Calendar is vulnerable to a… | |
CVE-2026-15804 | High | 8.8 | 2026-07-15 | The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compro… |
CVE-2026-12512 | High | 8.6 | 2026-07-15 | The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthe… |
CVE-2026-11851 | | 2026-07-15 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a rem… | |
CVE-2026-48324 | Critical | 9.1 | 2026-07-14 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary… |
CVE-2026-47992 | High | 7.2 | 2026-07-14 | Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitr… |
CVE-2026-45073 | High | 7.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doCl… |
CVE-2026-47295 | High | 8.8 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2026-47296 | High | 7.5 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2026-15703 | High | 7.3 | 2026-07-14 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproduct… |
CVE-2026-15736 | High | 8.3 | 2026-07-14 | Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in mer… |
CVE-2026-62390 | Critical | 9.8 | 2026-07-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may… |
CVE-2026-15183 | | 2026-07-14 | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth cl… | |
CVE-2026-15676 | High | 7.3 | 2026-07-14 | A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php… |
CVE-2026-15675 | High | 7.3 | 2026-07-14 | A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipu… |
CVE-2026-15672 | Medium | 6.3 | 2026-07-14 | A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This m… |
CVE-2026-44769 | Medium | 5.5 | 2026-07-14 | SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database… |
CVE-2026-51821 | Critical | 9.8 | 2026-07-13 | SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endp… |
CVE-2026-15597 | High | 7.3 | 2026-07-13 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /edit_exam2.php… |
CVE-2026-15559 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.p… |
CVE-2026-15558 | Medium | 6.3 | 2026-07-13 | A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the… |
CVE-2026-61955 | High | 7.6 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blin… |
CVE-2026-59515 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL… |
CVE-2026-57810 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare al… |
CVE-2026-57787 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Inj… |
CVE-2026-57773 | High | 7.6 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-adva… |
CVE-2026-57772 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager al… |
CVE-2026-57771 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows B… |
CVE-2026-57739 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acy… |
CVE-2026-57726 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue… |
CVE-2026-57714 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection… |
CVE-2026-57707 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-busines… |
CVE-2026-57702 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blin… |
CVE-2026-57385 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.Th… |