CWE-89 · SQL Injection (page 16)
Page 16 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13526 | High | 7.3 | 2026-06-29 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_class.php. This manipulation o… |
CVE-2026-13525 | Medium | 6.3 | 2026-06-29 | A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/E… |
CVE-2026-13521 | High | 7.3 | 2026-06-29 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-13520 | Medium | 6.3 | 2026-06-29 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /appointmentapproval.php of the comp… |
CVE-2026-49048 | Critical | 9.8 | 2026-06-28 | The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter in… |
CVE-2026-13498 | High | 7.3 | 2026-06-28 | A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unknown function of the file /forgotpassword.php of the compon… |
CVE-2026-13497 | Medium | 6.3 | 2026-06-28 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /appointment.php. This m… |
CVE-2026-13496 | Medium | 6.3 | 2026-06-28 | A vulnerability was found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /ajaxmedicine.php. The manipu… |
CVE-2026-13495 | Medium | 4.7 | 2026-06-28 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminprofile.php. The manipulation… |
CVE-2026-13488 | High | 7.3 | 2026-06-28 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-13487 | High | 7.3 | 2026-06-28 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive.php. The manipulat… |
CVE-2026-13486 | High | 7.3 | 2026-06-28 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This impacts an unknown function of the file /preview6.php. Execu… |
CVE-2026-13485 | High | 7.3 | 2026-06-28 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /preview.php. Performing a mani… |
CVE-2026-13333 | Medium | 6.5 | 2026-06-27 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via 'query[select]' Parameter in all ve… |
CVE-2026-13331 | Medium | 6.5 | 2026-06-27 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versi… |
CVE-2026-54350 | Critical | 10.0 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing M… |
CVE-2026-52785 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection in timestamps functionality. OpenProjec… |
CVE-2026-57667 | High | 8.5 | 2026-06-26 | Sales Representative SQL Injection in Groundhogg <= 4.5 versions. |
CVE-2026-57663 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions. |
CVE-2026-57662 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Contest Gallery <= 30.0.0 versions. |
CVE-2026-57653 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in WP Job Portal <= 2.5.2 versions. |
CVE-2026-57644 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions. |
CVE-2026-57643 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in WP Post Author <= 3.9.1 versions. |
CVE-2026-57642 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Gallery <= 4.7.8 versions. |
CVE-2026-57636 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. |
CVE-2026-57631 | High | 7.6 | 2026-06-26 | Administrator SQL Injection in Popup box <= 6.0.1 versions. |
CVE-2026-57628 | High | 7.6 | 2026-06-26 | Administrator SQL Injection in WP All Import <= 4.0.1 versions. |
CVE-2026-56070 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. |
CVE-2026-56068 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. |
CVE-2026-56067 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. |
CVE-2026-56064 | High | 8.5 | 2026-06-26 | Subscriber SQL Injection in Tourfic <= 2.22.5 versions. |
CVE-2026-56062 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. |
CVE-2026-56036 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. |
CVE-2026-56034 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. |
CVE-2026-54831 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. |
CVE-2026-54827 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-54825 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. |
CVE-2026-54820 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. |
CVE-2026-13226 | Medium | 6.5 | 2026-06-26 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versio… |
CVE-2026-40083 | High | 7.2 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in man… |
CVE-2026-37149 | High | 7.7 | 2026-06-25 | GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/… |
CVE-2026-57588 | Low | 3.3 | 2026-06-25 | A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQ… |
CVE-2026-57587 | Medium | 5.3 | 2026-06-25 | A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL i… |
CVE-2026-54849 | Critical | 9.3 | 2026-06-25 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. |
CVE-2026-54843 | Critical | 9.3 | 2026-06-25 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. |
CVE-2026-54838 | High | 8.5 | 2026-06-25 | Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions. |
CVE-2026-54836 | Critical | 9.3 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC… |
CVE-2026-54829 | High | 7.5 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL I… |
CVE-2026-54822 | High | 8.5 | 2026-06-25 | Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions. |
CVE-2026-12937 | High | 7.5 | 2026-06-25 | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_… |
CVE-2026-2508 | Medium | 6.5 | 2026-06-25 | The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7… |
CVE-2026-12079 | Medium | 6.5 | 2026-06-25 | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to ins… |
CVE-2026-12077 | High | 7.5 | 2026-06-25 | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and inclu… |
CVE-2026-9786 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-9785 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9784 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9783 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2026-9782 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2026-9781 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-7570 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-39951 | High | 7.6 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_rege… |
CVE-2026-39955 | Critical | 9.8 | 2026-06-24 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALID… |
CVE-2026-39948 | Critical | 9.8 | 2026-06-24 | Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw access… |
CVE-2026-39893 | Critical | 9.8 | 2026-06-24 | Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQ… |
CVE-2026-56351 | High | 8.2 | 2026-06-24 | n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitra… |
CVE-2025-71332 | Medium | 6.5 | 2026-06-24 | Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authentica… |
CVE-2026-56052 | High | 7.6 | 2026-06-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL In… |
CVE-2026-9179 | High | 7.5 | 2026-06-24 | The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions… |
CVE-2026-8705 | High | 7.5 | 2026-06-24 | The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in… |
CVE-2026-47384 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, an authenticated user with column-create permission can inject SQL into the bulk… | |
CVE-2026-47375 | Medium | 6.0 | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, an authenticated user with columnAdd permission on a Postgres-backed base can in… |
CVE-2025-61029 | High | 7.5 | 2026-06-23 | An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61024 | High | 7.5 | 2026-06-23 | An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2026-44792 | Critical | 9.0 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access to the git repository connected to an… |
CVE-2026-34914 | High | 8.3 | 2026-06-23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid para… |
CVE-2025-61028 | High | 7.5 | 2026-06-23 | An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61027 | High | 7.5 | 2026-06-23 | An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61025 | High | 7.5 | 2026-06-23 | An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61023 | High | 7.5 | 2026-06-23 | An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61022 | High | 7.5 | 2026-06-23 | An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2025-61021 | High | 7.5 | 2026-06-23 | An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL st… |
CVE-2025-61020 | High | 7.5 | 2026-06-23 | An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2025-61019 | High | 7.5 | 2026-06-23 | An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2025-61018 | High | 7.5 | 2026-06-23 | An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2026-54313 | High | 7.7 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in t… |
CVE-2026-54310 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could suppl… |
CVE-2026-52673 | Medium | 6.5 | 2026-06-23 | SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component |
CVE-2026-56221 | Medium | 6.5 | 2026-06-22 | Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated d… |
CVE-2026-44272 | High | 8.8 | 2026-06-22 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') v… |
CVE-2026-44271 | High | 8.1 | 2026-06-22 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') v… |
CVE-2026-7253 | Medium | 6.0 | 2026-06-22 | IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send specially crafted SQL statements, which… |
CVE-2025-66336 | High | 8.1 | 2026-06-22 | Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL qu… |
CVE-2026-12789 | Medium | 4.7 | 2026-06-21 | A vulnerability was identified in ILIAS Learning Management System 11.0. This issue affects the function ilTrQuery::executeQueries of the file components/ILIAS… |
CVE-2026-12776 | Medium | 6.3 | 2026-06-21 | A flaw has been found in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. This affects an unknown part of the file /index.php?p… |
CVE-2026-12775 | High | 7.3 | 2026-06-21 | A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. Affected by this issue is some unknown functio… |
CVE-2019-25761 | High | 7.1 | 2026-06-19 | Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malic… |
CVE-2019-25759 | High | 7.1 | 2026-06-19 | Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2019-25757 | High | 7.1 | 2026-06-19 | Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2019-25756 | High | 8.2 | 2026-06-19 | Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting ma… |
CVE-2019-25755 | High | 8.2 | 2026-06-19 | Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |