CWE-89 · SQL Injection (page 16)
Page 16 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7391 | Medium | 6.3 | 2026-04-29 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supp… |
CVE-2026-7389 | High | 7.3 | 2026-04-29 | A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The man… |
CVE-2026-42646 | High | 7.6 | 2026-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Burge TaxoPress simple-tags allows Blind SQL Inject… |
CVE-2026-3325 | | 2026-04-29 | SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerabili… | |
CVE-2026-42167 | High | 8.1 | 2026-04-28 | mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an… |
CVE-2026-7293 | Medium | 4.7 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of the file /admin/ajax.php?action=delete… |
CVE-2026-7290 | Medium | 6.3 | 2026-04-28 | A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/or… |
CVE-2026-7283 | Medium | 4.7 | 2026-04-28 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function save_expired of the file /ajax.php?act… |
CVE-2026-7282 | Medium | 4.7 | 2026-04-28 | A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete_expired of the file /ajax.php?action… |
CVE-2026-7268 | Medium | 6.3 | 2026-04-28 | A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_… |
CVE-2026-7267 | Medium | 6.3 | 2026-04-28 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This manipulation of the arg… |
CVE-2026-7266 | Medium | 6.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. The impacted element is the function save_order of the file /admin/ajax.php?action… |
CVE-2026-7265 | Medium | 6.3 | 2026-04-28 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/inde… |
CVE-2026-7264 | Medium | 6.3 | 2026-04-28 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_c… |
CVE-2026-40978 | High | 8.8 | 2026-04-28 | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions… |
CVE-2026-7229 | Medium | 6.3 | 2026-04-28 | A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/reply.php of the co… |
CVE-2026-7228 | High | 7.3 | 2026-04-28 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_count of the file /admin/ajax.php?action=ge… |
CVE-2026-7227 | High | 7.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function Login of the file /admin/ajax.php?action=login. The manip… |
CVE-2026-7226 | High | 7.3 | 2026-04-28 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?a… |
CVE-2026-7225 | High | 7.3 | 2026-04-28 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function delete_menu of the file /admin/ajax.php?… |
CVE-2026-7224 | High | 7.3 | 2026-04-28 | A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_cart of the file /admin/ajax.php?action=de… |
CVE-2026-7206 | High | 7.3 | 2026-04-28 | A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/entry.py. Performing… |
CVE-2026-7199 | High | 7.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-7196 | Medium | 6.3 | 2026-04-28 | A security vulnerability has been detected in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /guestdetails. Such manipulation of t… |
CVE-2026-7194 | High | 7.3 | 2026-04-27 | A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_pr… |
CVE-2024-46636 | Critical | 9.4 | 2026-04-27 | NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter |
CVE-2026-5394 | | 2026-04-27 | An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger un… | |
CVE-2026-7148 | Medium | 6.3 | 2026-04-27 | A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation of the argument fnam… |
CVE-2021-36438 | Medium | 6.5 | 2026-04-27 | SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php. |
CVE-2026-7143 | Medium | 6.3 | 2026-04-27 | A vulnerability was identified in 1000 Projects Portfolio Management System MCA up to 1.0. This affects an unknown function of the file /admin/block_status.php… |
CVE-2026-41462 | Critical | 9.8 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly co… |
CVE-2026-7131 | High | 7.3 | 2026-04-27 | A vulnerability has been found in code-projects Online Lot Reservation System up to 1.0. The impacted element is an unknown function of the file /loginuser.php… |
CVE-2026-7130 | High | 7.3 | 2026-04-27 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delet… |
CVE-2026-7128 | High | 7.3 | 2026-04-27 | A security vulnerability has been detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /a… |
CVE-2026-7127 | High | 7.3 | 2026-04-27 | A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=… |
CVE-2026-7126 | High | 7.3 | 2026-04-27 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_c… |
CVE-2026-7118 | Medium | 6.3 | 2026-04-27 | A security vulnerability has been detected in code-projects Employee Management System 1.0. The affected element is an unknown function of the file 370project/… |
CVE-2026-7117 | Medium | 6.3 | 2026-04-27 | A weakness has been identified in code-projects Employee Management System 1.0. Impacted is an unknown function of the file 370project/approve.php. Executing a… |
CVE-2026-7115 | Medium | 6.3 | 2026-04-27 | A vulnerability was identified in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file 370project/delete.php. Such… |
CVE-2026-7114 | Medium | 6.3 | 2026-04-27 | A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. This manipulation… |
CVE-2026-22336 | Critical | 9.3 | 2026-04-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affec… |
CVE-2026-7088 | High | 7.3 | 2026-04-27 | A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?act… |
CVE-2026-7087 | High | 7.3 | 2026-04-27 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=sav… |
CVE-2026-7083 | Medium | 4.7 | 2026-04-27 | A vulnerability has been found in likeadmin-likeshop likeadmin_php up to 1.9.6. Affected by this issue is the function queryResult of the file server\app\admin… |
CVE-2026-7077 | High | 7.3 | 2026-04-27 | A vulnerability was identified in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /edit_parcel.php. The man… |
CVE-2026-7076 | High | 7.3 | 2026-04-27 | A vulnerability was determined in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /edit_branch.php. Executing a manipul… |
CVE-2026-7075 | High | 7.3 | 2026-04-27 | A vulnerability was found in itsourcecode Construction Management System 1.0. This issue affects some unknown processing of the file /locations.php. Performing… |
CVE-2026-7074 | High | 7.3 | 2026-04-27 | A vulnerability has been found in itsourcecode Construction Management System 1.0. This vulnerability affects unknown code of the file /execute1.php. Such mani… |
CVE-2026-7073 | High | 7.3 | 2026-04-27 | A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /execute.php. This manipulation of the argum… |
CVE-2026-7072 | High | 7.3 | 2026-04-27 | A vulnerability was detected in CodePanda Source canteen_management_system 1.0. Affected by this issue is some unknown functionality of the file /api/login.php… |
CVE-2026-7070 | High | 7.3 | 2026-04-27 | A weakness has been identified in code-projects Inventory Management System 1.0. Affected is an unknown function of the component Login. Executing a manipulati… |
CVE-2026-7063 | High | 7.3 | 2026-04-26 | A vulnerability was detected in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file /370project/process/eprocess… |
CVE-2026-7060 | High | 7.3 | 2026-04-26 | A vulnerability was determined in liyupi yu-picture up to a053632c41340152bf75b66b3c543d129123d8ec. This impacts the function PageRequest of the file yu-pictur… |
CVE-2026-7028 | Medium | 4.7 | 2026-04-26 | A security flaw has been discovered in CodeAstro Online Job Portal 1.0. The affected element is an unknown function of the file /admin/jobs-admins/delete-jobs… |
CVE-2026-7023 | Medium | 6.3 | 2026-04-26 | A vulnerability was detected in ByteDance coze-studio up to 0.5.1. Affected by this vulnerability is the function ExecuteSQL of the file backend/domain/memory/… |
CVE-2026-7002 | High | 7.3 | 2026-04-25 | A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_message_ajax.php of th… |
CVE-2026-6991 | Medium | 6.3 | 2026-04-25 | A vulnerability was determined in colinhacks Zod up to 4.3.6. The impacted element is an unknown function of the file packages/zod/src/v4/core/regexes.ts of th… |
CVE-2026-6982 | Medium | 6.3 | 2026-04-25 | A vulnerability was determined in star7th ShowDoc up to 2.10.10/3.6.2/3.8.0. Affected by this vulnerability is an unknown functionality of the file server/Appl… |
CVE-2026-6978 | Medium | 4.7 | 2026-04-25 | A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.h… |
CVE-2026-41478 | Critical | 9.9 | 2026-04-24 | Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.6, 1.5.6, and 1.6.0-beta.5, a SQL injection vulnerability in Saltcor… |
CVE-2026-33078 | Critical | 9.8 | 2026-04-24 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the hapr… |
CVE-2026-31952 | High | 7.6 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Versions 1.7 through 4.4.0 have an SQ… |
CVE-2025-50229 | Critical | 9.8 | 2026-04-23 | Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module. |
CVE-2026-41460 | Critical | 9.8 | 2026-04-23 | SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via… |
CVE-2026-6887 | Critical | 9.8 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to in… |
CVE-2026-40529 | Medium | 4.7 | 2026-04-23 | CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored in the database may be obtained or altered by an attacker with… |
CVE-2026-29198 | Critical | 9.8 | 2026-04-23 | In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account takeover of the firs… |
CVE-2026-41167 | Critical | 9.1 | 2026-04-22 | Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolatin… |
CVE-2026-6833 | Medium | 6.5 | 2026-04-22 | The a+HRD developed by aEnrich has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database con… |
CVE-2026-41457 | | 2026-04-22 | OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL… | |
CVE-2026-40906 | Critical | 9.9 | 2026-04-21 | Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injec… |
CVE-2026-41320 | Medium | 6.5 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain en… |
CVE-2026-40887 | Critical | 9.1 | 2026-04-21 | Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection… |
CVE-2026-40871 | High | 7.2 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the… |
CVE-2025-41029 | | 2026-04-21 | SQL injection vulnerability in Zeon Academy Pro by Zeon Global Tech. This vulnerability allows an attacker to retrieve, create, update, and delete databases by… | |
CVE-2026-6674 | Medium | 6.5 | 2026-04-21 | The Plugin: CMS für Motorrad Werkstätten plugin for WordPress is vulnerable to SQL Injection via the 'arttype' parameter in all versions up to, and including… |
CVE-2026-39946 | Medium | 4.9 | 2026-04-21 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL databas… |
CVE-2026-35588 | Medium | 6.3 | 2026-04-21 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module (`glances/exports/glances_cassandra/__init… |
CVE-2026-39111 | High | 7.5 | 2026-04-20 | SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the email parameter of the forgot password pag… |
CVE-2026-39110 | High | 8.2 | 2026-04-20 | SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of the forgot password… |
CVE-2026-39109 | Critical | 9.4 | 2026-04-20 | SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (… |
CVE-2025-66335 | Medium | 5.3 | 2026-04-20 | Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling that may allow execution of unint… |
CVE-2026-6629 | High | 7.3 | 2026-04-20 | A vulnerability has been found in Metasoft 美特软件 MetaCRM up to 6.4.0. This vulnerability affects the function Statement.executeUpdate of the file sql.jsp of the… |
CVE-2026-6628 | Medium | 6.3 | 2026-04-20 | A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. This affects the function ValidateInput of the file /v2/query/view/ of the component Query Viewer Co… |
CVE-2026-5964 | Critical | 9.8 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modif… |
CVE-2026-5963 | Critical | 9.8 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modif… |
CVE-2026-6595 | High | 7.3 | 2026-04-20 | A vulnerability was identified in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. This vulnerability affects unkno… |
CVE-2026-6562 | High | 7.3 | 2026-04-19 | A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Search/index.html. Executing a manipulation… |
CVE-2026-40482 | | 2026-04-18 | ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString() via unsanitized $… | |
CVE-2026-40285 | High | 8.8 | 2026-04-17 | WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usu… |
CVE-2026-37749 | Critical | 9.8 | 2026-04-17 | A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authentication via the us… |
CVE-2026-6490 | High | 7.3 | 2026-04-17 | A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file admin/deletecourse… |
CVE-2026-6488 | Medium | 6.3 | 2026-04-17 | A vulnerability was identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. This vulnerability affects unknown code of the file admin/editc… |
CVE-2025-15625 | Critical | 9.8 | 2026-04-17 | Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases. |
CVE-2026-34018 | Critical | 9.8 | 2026-04-17 | An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the product. |
CVE-2026-6080 | Medium | 6.5 | 2026-04-17 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' par… |
CVE-2026-3330 | Medium | 4.9 | 2026-04-17 | The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_sear… |
CVE-2026-4817 | Medium | 6.5 | 2026-04-17 | The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and… |
CVE-2026-40900 | High | 8.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetDa… |
CVE-2026-33207 | High | 8.8 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTa… |