CWE-89 · SQL Injection (page 18)
Page 18 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40798 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. |
CVE-2026-40771 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. |
CVE-2026-40766 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions. |
CVE-2026-40762 | High | 7.5 | 2026-06-15 | Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions. |
CVE-2026-39530 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. |
CVE-2026-39519 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. |
CVE-2026-39512 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. |
CVE-2026-39511 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. |
CVE-2026-39502 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. |
CVE-2026-39493 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. |
CVE-2026-39492 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. |
CVE-2026-39441 | Critical | 9.3 | 2026-06-15 | Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. |
CVE-2026-24637 | High | 8.5 | 2026-06-15 | Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions. |
CVE-2026-50890 | Critical | 9.8 | 2026-06-15 | Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability… |
CVE-2026-48114 | Critical | 9.8 | 2026-06-15 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL inje… |
CVE-2026-39196 | Critical | 9.8 | 2026-06-15 | Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. T… |
CVE-2026-38812 | Critical | 9.8 | 2026-06-15 | RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated… |
CVE-2026-36670 | High | 8.8 | 2026-06-15 | A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticat… |
CVE-2019-25746 | High | 7.1 | 2026-06-15 | WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by inj… |
CVE-2016-20073 | High | 8.2 | 2026-06-15 | Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2016-20072 | High | 8.2 | 2026-06-15 | BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by in… |
CVE-2016-20071 | High | 8.2 | 2026-06-15 | The 404 Redirection Manager plugin version 1.0 for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute ar… |
CVE-2016-20069 | High | 8.2 | 2026-06-15 | WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize t… |
CVE-2016-20068 | High | 8.2 | 2026-06-15 | WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute ar… |
CVE-2026-12206 | Medium | 6.3 | 2026-06-15 | A vulnerability was identified in Grit42 Grit up to 0.11.0. This issue affects the function Grit::Assays::DataTableEntity of the file modules/assays/backend/ap… |
CVE-2026-12188 | Medium | 6.3 | 2026-06-14 | A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the file modules/core/backend/app/controllers… |
CVE-2026-12175 | Medium | 4.7 | 2026-06-13 | A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of the file /attendance-php/Admin/createStu… |
CVE-2026-6428 | High | 7.6 | 2026-06-13 | SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05… |
CVE-2026-9848 | High | 7.5 | 2026-06-13 | The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The pl… |
CVE-2026-12131 | Medium | 6.3 | 2026-06-12 | A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\cont… |
CVE-2026-44172 | Critical | 9.1 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping i… |
CVE-2026-41581 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has b… | |
CVE-2026-48613 | Medium | 5.9 | 2026-06-12 | SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution… |
CVE-2026-45418 | High | 8.8 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles… |
CVE-2026-45060 | Critical | 9.8 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injec… |
CVE-2026-42647 | Critical | 9.3 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue… |
CVE-2026-39494 | Critical | 9.3 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Inject… |
CVE-2026-11945 | Medium | 6.4 | 2026-06-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a… |
CVE-2026-38581 | Critical | 9.8 | 2026-06-11 | SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain para… |
CVE-2026-53474 | Critical | 9.6 | 2026-06-10 | A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Du… |
CVE-2026-52758 | High | 8.8 | 2026-06-10 | Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping… |
CVE-2026-49498 | High | 8.8 | 2026-06-10 | Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase that fails to escape double quotes in… |
CVE-2026-3018 | High | 7.5 | 2026-06-10 | The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13… |
CVE-2026-3326 | High | 8.6 | 2026-06-10 | The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to un… |
CVE-2026-50636 | High | 8.8 | 2026-06-09 | The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which conca… |
CVE-2026-8025 | Critical | 9.8 | 2026-06-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQ… |
CVE-2026-7486 | Critical | 9.8 | 2026-06-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection. This i… |
CVE-2017-20249 | High | 8.2 | 2026-06-09 | Apptha Slider Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2017-20247 | High | 8.2 | 2026-06-09 | WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injec… |
CVE-2017-20246 | High | 8.2 | 2026-06-09 | KittyCatfish 2.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to read database contents by exploiting an… |
CVE-2017-20245 | High | 8.2 | 2026-06-09 | Wow Viral Signups 2.1 WordPress plugin contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by exploit… |
CVE-2017-20244 | High | 8.2 | 2026-06-09 | Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary database information by… |
CVE-2017-20243 | High | 8.2 | 2026-06-09 | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attackers to manipulate d… |
CVE-2016-20065 | High | 8.2 | 2026-06-09 | Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by in… |
CVE-2016-20063 | High | 7.1 | 2026-06-09 | Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious c… |
CVE-2016-20062 | High | 8.2 | 2026-06-09 | Simply Poll 1.4.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecti… |
CVE-2026-49741 | | 2026-06-09 | Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler… | |
CVE-2026-10731 | | 2026-06-09 | SQL injection in the ‘two_steps_auth_code’ parameter processed by the ‘twoStepsAuthVerification’ function within the ‘/user-login’ endpoint. The two-factor aut… | |
CVE-2026-44744 | Medium | 6.5 | 2026-06-09 | SAP S/4HANA(On-Premise) contains SQL injection vulnerability in a remote-enabled function module component that could be exploited by an authenticated attacker… |
CVE-2026-11585 | Medium | 6.3 | 2026-06-08 | A vulnerability was determined in CodeAstro Student Attendance Management System 1.0. Affected is an unknown function of the file /attendance-php/Admin/createC… |
CVE-2026-11584 | Medium | 6.3 | 2026-06-08 | A vulnerability was found in CodeAstro Student Attendance Management System 1.0. This impacts an unknown function of the file /attendance-php/Admin/createClass… |
CVE-2026-11583 | Medium | 6.3 | 2026-06-08 | A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendance-php/Admin/create… |
CVE-2026-11582 | High | 7.3 | 2026-06-08 | A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php… |
CVE-2026-11559 | Medium | 6.3 | 2026-06-08 | A vulnerability was detected in CodeAstro Payroll System 1.0. This affects an unknown function of the file /view_account.php. The manipulation of the argument… |
CVE-2026-11558 | Medium | 6.3 | 2026-06-08 | A security vulnerability has been detected in CodeAstro Payroll System 1.0. The impacted element is an unknown function of the file /home_salary.php. The manip… |
CVE-2026-11531 | High | 7.3 | 2026-06-08 | A security flaw has been discovered in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This impacts an unknown function of t… |
CVE-2026-11530 | High | 7.3 | 2026-06-08 | A vulnerability was identified in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This affects an unknown function of the fi… |
CVE-2026-11529 | Medium | 6.3 | 2026-06-08 | A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function read_resource of the file src/mysql_mcp_ser… |
CVE-2026-11514 | Medium | 6.3 | 2026-06-08 | A flaw has been found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /addpatient.php. This manipulatio… |
CVE-2026-11513 | Medium | 6.3 | 2026-06-08 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminaccount.php. The manipulation of… |
CVE-2026-11510 | Medium | 6.3 | 2026-06-08 | A security flaw has been discovered in CodeAstro Leave Management System 1.0. This affects an unknown part of the file /admin/add_leave.php. Performing a manip… |
CVE-2026-11509 | Medium | 6.3 | 2026-06-08 | A vulnerability was identified in CodeAstro Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/search_staff_f… |
CVE-2026-11508 | Medium | 6.3 | 2026-06-08 | A vulnerability was determined in CodeAstro Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/search_s… |
CVE-2026-11507 | Medium | 6.3 | 2026-06-08 | A vulnerability was found in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /admin/delete_leave_type.php. The manipulation… |
CVE-2026-11506 | Medium | 6.3 | 2026-06-08 | A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/search_staff_for_deletion.php. The… |
CVE-2026-11501 | High | 7.3 | 2026-06-08 | A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /… |
CVE-2026-11495 | Medium | 6.3 | 2026-06-08 | A vulnerability was detected in CodeAstro Ingredients Stock Management System 1.0. This impacts an unknown function of the file /Ingredients-Stock/add_stock.ph… |
CVE-2026-11490 | High | 7.3 | 2026-06-08 | A vulnerability was determined in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Frontend/Search.php. This manipu… |
CVE-2026-11489 | High | 7.3 | 2026-06-08 | A vulnerability was found in code-projects Online Music Site 1.0. This vulnerability affects unknown code of the file /Administrator/PHP/AdminDeleteAlbum.php… |
CVE-2026-11488 | High | 7.3 | 2026-06-08 | A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown part of the file checkUser.php of the componen… |
CVE-2026-11486 | High | 7.3 | 2026-06-08 | A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /a… |
CVE-2026-11485 | High | 7.3 | 2026-06-08 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive2.php… |
CVE-2026-11484 | High | 7.3 | 2026-06-08 | A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /archive3.php. This manipu… |
CVE-2026-11483 | High | 7.3 | 2026-06-08 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /archive4.php. The ma… |
CVE-2026-11482 | High | 7.3 | 2026-06-08 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /archive5.php… |
CVE-2026-11480 | Medium | 6.3 | 2026-06-08 | A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admi… |
CVE-2026-11475 | Medium | 6.3 | 2026-06-08 | A weakness has been identified in Kushan2k student-management-system up to f16a4ceaddd6729c4b306ed4641cda3176c1ef2a. Affected by this vulnerability is the func… |
CVE-2026-11473 | Medium | 6.3 | 2026-06-08 | A vulnerability was identified in jflyfox jfinal_cms up to 5.1.0. This impacts the function list of the file AdvicefeedbackController.java. Such manipulation o… |
CVE-2026-11472 | High | 7.3 | 2026-06-08 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /index1.php. This manipula… |
CVE-2026-11471 | High | 7.3 | 2026-06-08 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is an unknown function of the file /index2.php. The man… |
CVE-2026-11456 | High | 7.3 | 2026-06-07 | A vulnerability was identified in Chanjet CRM 1.0. This affects an unknown part of the file /tools/jxf_dump_systable.php of the component HTTP GET Request Hand… |
CVE-2026-11453 | Medium | 6.3 | 2026-06-07 | A vulnerability was found in Tiobon Employee Self-Service System up to 7.2. Affected by this vulnerability is an unknown functionality of the file /Blog/BlogSe… |
CVE-2026-11435 | High | 7.3 | 2026-06-06 | A security vulnerability has been detected in Jinher OA 1.0. This affects an unknown function of the file nextselectplan.aspx. Such manipulation of the argumen… |
CVE-2026-11412 | Medium | 6.3 | 2026-06-06 | A weakness has been identified in Jinher OA C6. The affected element is an unknown function of the file /C6/JHSoft.Web.ModuleCount/GetFormSn.aspx. Executing a… |
CVE-2026-9829 | Medium | 6.5 | 2026-06-06 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'compact_album_order_by' Shortcod… |
CVE-2026-8978 | Medium | 4.9 | 2026-06-06 | The OptinCraft – Drag & Drop Optins & Popup Builder for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in a… |
CVE-2026-6448 | Medium | 4.9 | 2026-06-06 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in… |
CVE-2026-45779 | Critical | 9.8 | 2026-06-05 | OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerability exists in Open XDMoD versions prior to 10.0.3 that allo… |
CVE-2026-11342 | High | 7.3 | 2026-06-05 | A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manip… |
CVE-2026-11334 | High | 7.3 | 2026-06-05 | A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This a… |