CWE-89 · SQL Injection (page 14)
Page 14 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9082 | Critical | 9.8 | 2026-05-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affe… |
CVE-2026-44923 | Medium | 6.5 | 2026-05-20 | SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges. |
CVE-2026-42383 | High | 7.6 | 2026-05-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL In… |
CVE-2026-9065 | | 2026-05-20 | SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider')… | |
CVE-2026-9059 | | 2026-05-20 | NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleri… | |
CVE-2026-9010 | High | 7.5 | 2026-05-20 | The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0… |
CVE-2026-9003 | High | 7.5 | 2026-05-20 | E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands… |
CVE-2026-8685 | Medium | 6.5 | 2026-05-20 | The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16… |
CVE-2026-7472 | Medium | 4.9 | 2026-05-20 | The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including… |
CVE-2026-3985 | High | 7.5 | 2026-05-20 | The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all… |
CVE-2026-31069 | High | 8.8 | 2026-05-19 | BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and ag… |
CVE-2026-8912 | High | 7.5 | 2026-05-19 | The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6. This is due to… |
CVE-2026-8827 | | 2026-05-19 | The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not inv… | |
CVE-2026-8726 | | 2026-05-19 | The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL thro… | |
CVE-2026-8851 | High | 8.1 | 2026-05-18 | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to ex… |
CVE-2026-6379 | High | 8.6 | 2026-05-18 | The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthent… |
CVE-2026-8785 | High | 7.3 | 2026-05-18 | A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file up… |
CVE-2026-8772 | Medium | 4.7 | 2026-05-18 | A weakness has been identified in linlinjava litemall up to 1.8.0. Affected is an unknown function of the component Admin Endpoint. Executing a manipulation ca… |
CVE-2026-8771 | High | 7.3 | 2026-05-18 | A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava… |
CVE-2018-25339 | High | 8.2 | 2026-05-17 | Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database information using time-based bli… |
CVE-2018-25338 | High | 8.2 | 2026-05-17 | Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-ba… |
CVE-2018-25333 | High | 8.2 | 2026-05-17 | Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries… |
CVE-2018-25330 | High | 8.2 | 2026-05-17 | Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code throug… |
CVE-2018-25319 | High | 7.1 | 2026-05-17 | Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL cod… |
CVE-2026-8734 | High | 7.3 | 2026-05-17 | A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryL… |
CVE-2026-8724 | Medium | 4.7 | 2026-05-17 | A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component D… |
CVE-2021-47980 | High | 7.1 | 2026-05-16 | Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2021-47956 | High | 8.2 | 2026-05-16 | EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code th… |
CVE-2021-47954 | High | 8.2 | 2026-05-16 | LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the se… |
CVE-2020-37244 | High | 8.2 | 2026-05-16 | Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou… |
CVE-2020-37243 | High | 8.2 | 2026-05-16 | Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQ… |
CVE-2020-37242 | High | 8.2 | 2026-05-16 | Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2026-46364 | Critical | 9.8 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods t… |
CVE-2026-46359 | High | 7.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injec… |
CVE-2026-45800 | | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injecti… | |
CVE-2021-47966 | High | 8.2 | 2026-05-15 | PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that allows unauthentic… |
CVE-2026-7046 | Medium | 4.9 | 2026-05-15 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'table' parameter in all versi… |
CVE-2026-42847 | | 2026-05-14 | ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitabl… | |
CVE-2026-22599 | High | 7.2 | 2026-05-14 | Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-qu… |
CVE-2026-6638 | Low | 3.7 | 2026-05-14 | SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the… |
CVE-2026-6637 | High | 8.8 | 2026-05-14 | Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the dat… |
CVE-2026-6476 | High | 7.2 | 2026-05-14 | SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack take… |
CVE-2025-11024 | Critical | 9.8 | 2026-05-14 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce… |
CVE-2026-6225 | Medium | 6.5 | 2026-05-14 | The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'pro… |
CVE-2026-5486 | Medium | 6.5 | 2026-05-14 | The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX act… |
CVE-2026-46446 | High | 7.1 | 2026-05-14 | SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in chang… |
CVE-2026-46445 | High | 7.1 | 2026-05-14 | SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. |
CVE-2026-29206 | High | 8.1 | 2026-05-13 | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled. |
CVE-2026-44447 | High | 8.8 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted… |
CVE-2026-44446 | High | 8.8 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through spe… |
CVE-2026-45054 | Medium | 4.9 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=orders&node=transactions) builds a raw ORD… |
CVE-2026-44418 | | 2026-05-13 | EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-su… | |
CVE-2026-44381 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled orde… |
CVE-2026-39358 | High | 7.2 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting paramet… |
CVE-2026-42550 | High | 8.8 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by con… |
CVE-2026-42031 | Critical | 9.8 | 2026-05-13 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_s… |
CVE-2026-0242 | | 2026-05-13 | A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. S… | |
CVE-2020-37226 | High | 7.1 | 2026-05-13 | Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL… |
CVE-2020-37224 | High | 7.1 | 2026-05-13 | Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL… |
CVE-2020-37218 | High | 8.2 | 2026-05-13 | Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries… |
CVE-2026-4608 | Medium | 6.5 | 2026-05-13 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to… |
CVE-2026-37429 | Medium | 6.5 | 2026-05-13 | qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. This vulnerability… |
CVE-2026-37428 | Medium | 6.5 | 2026-05-13 | qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. This vulnerability… |
CVE-2026-4798 | High | 7.5 | 2026-05-13 | The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1… |
CVE-2026-6929 | High | 7.5 | 2026-05-13 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'sortf' paramet… |
CVE-2026-7619 | Medium | 6.5 | 2026-05-13 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via th… |
CVE-2026-6888 | High | 7.2 | 2026-05-13 | Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, … |
CVE-2026-1250 | High | 7.5 | 2026-05-12 | The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in all versions up… |
CVE-2026-44864 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44863 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44862 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44861 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44860 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44204 | Medium | 6.5 | 2026-05-12 | Shelf is a platform for tracking physical assets. From 1.12 to before 1.20.1, a SQL injection vulnerability in the sortBy query parameter on the /assets route… |
CVE-2026-25088 | Medium | 5.4 | 2026-05-12 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0… |
CVE-2025-53681 | High | 7.2 | 2026-05-12 | An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 throu… |
CVE-2026-34187 | Critical | 9.8 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora… |
CVE-2026-8111 | High | 8.8 | 2026-05-12 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. |
CVE-2026-43937 | High | 8.8 | 2026-05-12 | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewri… |
CVE-2026-32687 | High | 7.8 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' mod… |
CVE-2026-27851 | High | 7.4 | 2026-05-12 | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to b… |
CVE-2026-45218 | High | 7.7 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection… |
CVE-2026-45214 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows B… |
CVE-2026-45213 | High | 7.6 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injectio… |
CVE-2026-45211 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare al… |
CVE-2026-42742 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blin… |
CVE-2026-42741 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views – Display & Edit Ninja F… |
CVE-2026-41125 | Medium | 6.0 | 2026-05-12 | A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions), bluepla… |
CVE-2025-6577 | Critical | 9.8 | 2026-05-12 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce… |
CVE-2026-5028 | Medium | 6.5 | 2026-05-12 | The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the `pp-get-articles` AJAX… |
CVE-2026-2993 | High | 7.5 | 2026-05-12 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient e… |
CVE-2026-40131 | Low | 3.4 | 2026-05-12 | SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization o… |
CVE-2026-34260 | Critical | 9.6 | 2026-05-12 | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements th… |
CVE-2026-38567 | Critical | 9.8 | 2026-05-11 | HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without paramet… |
CVE-2026-36962 | High | 7.3 | 2026-05-11 | SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, an… |
CVE-2026-7815 | High | 8.8 | 2026-05-11 | SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_… |
CVE-2026-6093 | | 2026-05-11 | Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects… | |
CVE-2021-47941 | High | 8.2 | 2026-05-10 | WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inject… |
CVE-2021-47930 | High | 8.2 | 2026-05-10 | Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execu… |
CVE-2021-47928 | High | 8.2 | 2026-05-10 | Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting… |