CWE-89 · SQL Injection (page 17)
Page 17 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25754 | High | 8.2 | 2026-06-19 | Joomla Component vRestaurant 1.9.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2019-25753 | High | 8.2 | 2026-06-19 | Joomla! Component VMap 1.9.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malici… |
CVE-2019-25752 | High | 8.2 | 2026-06-19 | Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2019-25751 | High | 8.2 | 2026-06-19 | Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2019-25750 | High | 8.2 | 2026-06-19 | Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL querie… |
CVE-2019-25749 | High | 7.1 | 2026-06-19 | Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2019-25748 | High | 8.2 | 2026-06-19 | Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2017-20282 | High | 8.2 | 2026-06-19 | Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by inject… |
CVE-2017-20281 | High | 8.2 | 2026-06-19 | Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2017-20280 | High | 8.2 | 2026-06-19 | Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQ… |
CVE-2017-20279 | High | 8.2 | 2026-06-19 | Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2017-20278 | High | 8.2 | 2026-06-19 | Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL… |
CVE-2017-20277 | High | 8.2 | 2026-06-19 | Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author parameter on the search results page. Attackers can inject… |
CVE-2017-20276 | High | 8.2 | 2026-06-19 | Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2017-20275 | High | 8.2 | 2026-06-19 | Joomla! Component PHP-Bridge 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2017-20274 | High | 8.2 | 2026-06-19 | Joomla LMS King Professional 3.2.4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2017-20273 | High | 8.2 | 2026-06-19 | Joomla Event Registration Pro Calendar 4.1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by… |
CVE-2017-20272 | High | 8.2 | 2026-06-19 | Joomla Ultimate Property Listing 1.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inject… |
CVE-2017-20271 | High | 8.2 | 2026-06-19 | Joomla StreetGuessr Game 1.1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2017-20270 | High | 8.2 | 2026-06-19 | Joomla! Component Twitch Tv 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2017-20269 | High | 8.2 | 2026-06-19 | Joomla! Component KissGallery 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the component… |
CVE-2017-20268 | High | 8.2 | 2026-06-19 | Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inj… |
CVE-2017-20267 | High | 8.2 | 2026-06-19 | Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the categ… |
CVE-2017-20266 | High | 8.2 | 2026-06-19 | Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malici… |
CVE-2017-20265 | High | 7.1 | 2026-06-19 | Joomla! Component Flip Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2017-20264 | High | 7.1 | 2026-06-19 | Joomla! Component Sponsor Wall 8.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2017-20263 | High | 8.2 | 2026-06-19 | Joomla! Component FocalPoint Pro/Free 1.2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2017-20262 | High | 8.2 | 2026-06-19 | Joomla! Component Ajax Quiz 1.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2017-20261 | High | 8.2 | 2026-06-19 | Joomla! Component Bargain Product VM3 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inj… |
CVE-2017-20260 | High | 8.2 | 2026-06-19 | Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2017-20259 | High | 8.2 | 2026-06-19 | Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2017-20258 | High | 8.2 | 2026-06-19 | Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries… |
CVE-2017-20257 | High | 8.2 | 2026-06-19 | Joomla! Component Quiz Deluxe 3.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the… |
CVE-2017-20256 | High | 8.2 | 2026-06-19 | Joomla Survey Force Deluxe 3.2.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting ma… |
CVE-2017-20255 | High | 8.2 | 2026-06-19 | Joomla! Component JB Visa 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malic… |
CVE-2017-20254 | High | 8.2 | 2026-06-19 | Joomla! Component User Bench 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting ma… |
CVE-2017-20253 | High | 8.2 | 2026-06-19 | Joomla! Component My Projects 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting m… |
CVE-2017-20252 | High | 8.2 | 2026-06-19 | Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands through the plname… |
CVE-2026-12050 | Medium | 4.3 | 2026-06-19 | SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated di… |
CVE-2026-12045 | Critical | 9.0 | 2026-06-19 | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary… |
CVE-2026-12044 | High | 8.8 | 2026-06-19 | SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-supplied description field. The Jinja tem… |
CVE-2026-56012 | High | 8.5 | 2026-06-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows Blind SQL In… |
CVE-2026-54419 | Critical | 9.8 | 2026-06-18 | claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multip… |
CVE-2026-54222 | | 2026-06-18 | UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access to the Members in Control Panel to interact with the underlying database. Due… | |
CVE-2026-40455 | | 2026-06-18 | An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the "tarifflist.php" module due to insufficient sanitization… | |
CVE-2026-55740 | Critical | 9.8 | 2026-06-18 | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in… |
CVE-2026-11777 | Medium | 4.9 | 2026-06-18 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'name' parameter… |
CVE-2026-11776 | Medium | 4.9 | 2026-06-18 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to generic SQL Injection via the 'groupids' param… |
CVE-2026-11360 | Medium | 4.9 | 2026-06-18 | The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_direction' parameter in all versions up to… |
CVE-2026-10736 | Medium | 4.9 | 2026-06-18 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to… |
CVE-2026-35069 | Medium | 5.7 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2026-35068 | Low | 3.5 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2026-54812 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-li… |
CVE-2026-54819 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webilia Inc. Listdom allows Blind SQL Injection. This is… |
CVE-2026-54818 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs Slimstat Analytics allows Blind SQL Injection… |
CVE-2026-54815 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cargo RD Cargo Shipping Location for WooCommerce allows B… |
CVE-2026-54813 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. Th… |
CVE-2026-54809 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme GIFT4U allows Blind SQL Injection. This issue… |
CVE-2026-54808 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Inj… |
CVE-2025-59554 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions. |
CVE-2026-54811 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. |
CVE-2026-54187 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. |
CVE-2026-54186 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. |
CVE-2026-54185 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. |
CVE-2026-49084 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. |
CVE-2026-49080 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. |
CVE-2026-49079 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. |
CVE-2026-49076 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows Blind SQL Injectio… |
CVE-2026-49073 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpWax Directorist Booking allows Blind SQL Injection. Th… |
CVE-2026-48967 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. |
CVE-2026-48875 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. |
CVE-2026-39596 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. |
CVE-2026-39438 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. |
CVE-2026-28576 | Medium | 5.5 | 2026-06-17 | In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no add… |
CVE-2026-22340 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. |
CVE-2026-22335 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions. |
CVE-2026-22332 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. |
CVE-2026-12360 | High | 7.5 | 2026-06-17 | The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a fi… |
CVE-2025-69135 | High | 8.5 | 2026-06-17 | Subscriber SQL Injection in Events Schedule - WordPress Events Calendar Plugin <= 2.7.2 versions. |
CVE-2026-52715 | Critical | 9.3 | 2026-06-16 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. |
CVE-2026-52712 | High | 7.6 | 2026-06-16 | Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions. |
CVE-2026-49772 | Critical | 9.3 | 2026-06-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind S… |
CVE-2026-39581 | High | 8.5 | 2026-06-16 | Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions. |
CVE-2026-39574 | Critical | 9.3 | 2026-06-16 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. |
CVE-2026-8444 | High | 8.8 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions… |
CVE-2026-8443 | High | 8.8 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data A… |
CVE-2026-52700 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions. |
CVE-2026-52697 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions. |
CVE-2026-52693 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. |
CVE-2026-49776 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions. |
CVE-2026-49067 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. |
CVE-2026-48964 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions. |
CVE-2026-48886 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. |
CVE-2026-48882 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions. |
CVE-2026-48874 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in GamiPress <= 7.8.7 versions. |
CVE-2026-45439 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. |
CVE-2026-42665 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. |
CVE-2026-42639 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. |
CVE-2026-42386 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. |
CVE-2026-42381 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. |