CWE-89 · SQL Injection (page 19)
Page 19 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5606 | Medium | 6.3 | 2026-04-06 | A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /order-details.ph… |
CVE-2026-5596 | Medium | 6.3 | 2026-04-05 | A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools/sql/tool.py of the… |
CVE-2019-25704 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the filter_user_m… |
CVE-2019-25702 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_project pa… |
CVE-2019-25700 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the sort_directio… |
CVE-2019-25698 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_to_delete… |
CVE-2019-25696 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the language_tag… |
CVE-2019-25694 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2019-25692 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id_to_modify… |
CVE-2019-25690 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the mng_profile_i… |
CVE-2019-25688 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2019-25684 | High | 8.2 | 2026-04-05 | OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2019-25680 | High | 8.2 | 2026-04-05 | Advance Gift Shop Pro Script 2.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2019-25678 | High | 8.2 | 2026-04-05 | C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL comma… |
CVE-2019-25676 | High | 8.2 | 2026-04-05 | Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipu… |
CVE-2019-25675 | High | 8.2 | 2026-04-05 | eDirectory contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to bypass administrator authentication and disclose sensitive f… |
CVE-2019-25674 | High | 8.2 | 2026-04-05 | CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pos… |
CVE-2019-25672 | High | 8.2 | 2026-04-05 | PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the '… |
CVE-2019-25669 | High | 8.2 | 2026-04-05 | qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[]… |
CVE-2019-25668 | High | 8.2 | 2026-04-05 | News Website Script 2.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code th… |
CVE-2019-25664 | High | 7.1 | 2026-04-05 | SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attac… |
CVE-2019-25663 | High | 7.1 | 2026-04-05 | SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the par… |
CVE-2019-25662 | High | 8.2 | 2026-04-05 | ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code th… |
CVE-2026-5587 | Medium | 6.3 | 2026-04-05 | A vulnerability was identified in wbbeyourself MAC-SQL up to 31a9df5e0d520be4769be57a4b9022e5e34a14f4. This affects the function _execute_sql of the file core/… |
CVE-2026-5586 | Medium | 6.3 | 2026-04-05 | A vulnerability was determined in zhongyu09 openchatbi up to 0.2.1. The impacted element is an unknown function of the component Multi-stage Text2SQL Workflow… |
CVE-2026-5583 | Medium | 6.3 | 2026-04-05 | A security vulnerability has been detected in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /my-profile.php of the co… |
CVE-2026-5580 | Medium | 6.3 | 2026-04-05 | A vulnerability was identified in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/addvideos.php of the component P… |
CVE-2026-5579 | Medium | 6.3 | 2026-04-05 | A vulnerability was determined in CodeAstro Online Classroom 1.0. This issue affects some unknown processing of the file /OnlineClassroom/updatedetailsfromfacu… |
CVE-2026-5578 | Medium | 6.3 | 2026-04-05 | A vulnerability was found in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /OnlineClassroom/addassessment.php of the comp… |
CVE-2026-5577 | High | 7.3 | 2026-04-05 | A vulnerability has been found in Song-Li cross_browser up to ca690f0fe6954fd9bcda36d071b68ed8682a786a. This affects an unknown part of the file flask/uniquema… |
CVE-2026-5575 | High | 7.3 | 2026-04-05 | A vulnerability was detected in SourceCodester/jkev Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file index… |
CVE-2026-5565 | High | 7.3 | 2026-04-05 | A security vulnerability has been detected in code-projects Simple Laundry System 1.0. Affected by this issue is some unknown functionality of the file /delmem… |
CVE-2026-5564 | High | 7.3 | 2026-04-05 | A weakness has been identified in code-projects Simple Laundry System 1.0. Affected by this vulnerability is an unknown functionality of the file /searchguest… |
CVE-2026-5563 | Medium | 6.3 | 2026-04-05 | A security flaw has been discovered in AutohomeCorp frostmourne up to 1.0. Affected is the function httpTest of the file /api/monitor-api/alarm/previewData of… |
CVE-2026-5560 | Medium | 6.3 | 2026-04-05 | A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /payment-method.php of the… |
CVE-2026-5558 | Medium | 6.3 | 2026-04-05 | A flaw has been found in PHPGurukul PHPGurukul Online Shopping Portal Project up to 2.1. Impacted is an unknown function of the file /pending-orders.php of the… |
CVE-2026-5555 | High | 7.3 | 2026-04-05 | A weakness has been identified in code-projects Concert Ticket Reservation System 1.0. This affects an unknown part of the file /ConcertTicketReservationSystem… |
CVE-2026-5554 | High | 7.3 | 2026-04-05 | A security flaw has been discovered in code-projects Concert Ticket Reservation System 1.0. Affected by this issue is some unknown functionality of the file /C… |
CVE-2026-5553 | Medium | 6.3 | 2026-04-05 | A vulnerability was identified in itsourcecode Online Cellphone System 1.0. Affected by this vulnerability is an unknown functionality of the file /cp/availabl… |
CVE-2026-5552 | Medium | 6.3 | 2026-04-05 | A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This issue affects some unknown processing of the file /sub-category.php of th… |
CVE-2026-5551 | High | 7.3 | 2026-04-05 | A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/login.p… |
CVE-2026-5543 | Medium | 6.3 | 2026-04-05 | A vulnerability was identified in PHPGurukul User Registration & Login and User Management System 3.3. The affected element is an unknown function of the file… |
CVE-2026-5540 | High | 7.3 | 2026-04-05 | A vulnerability has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modifymember.php of the compone… |
CVE-2026-5537 | Medium | 6.3 | 2026-04-05 | A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the file Apps/Index/Cont… |
CVE-2026-5534 | High | 7.3 | 2026-04-05 | A vulnerability was identified in itsourcecode Online Enrollment System 1.0. This affects an unknown function of the file /sms/user/index.php?view=edit&id=10 o… |
CVE-2026-34934 | Critical | 9.8 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped t… |
CVE-2026-34788 | Medium | 6.5 | 2026-04-03 | Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168… |
CVE-2026-34612 | Critical | 9.9 | 2026-04-03 | Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vuln… |
CVE-2026-27885 | High | 7.2 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the A… |
CVE-2026-27834 | High | 7.2 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Serv… |
CVE-2026-27634 | Critical | 9.8 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_avai… |
CVE-2026-25773 | High | 8.1 | 2026-04-03 | ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering cat… |
CVE-2026-34825 | Medium | 6.5 | 2026-04-02 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workf… |
CVE-2026-5368 | High | 7.3 | 2026-04-02 | A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Par… |
CVE-2026-34717 | Critical | 9.9 | 2026-04-02 | OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177… |
CVE-2026-5334 | High | 7.3 | 2026-04-02 | A weakness has been identified in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view=edit&id=3 o… |
CVE-2026-35168 | High | 8.8 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in Ope… |
CVE-2026-28805 | High | 8.8 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAM… |
CVE-2026-5328 | Medium | 6.3 | 2026-04-02 | A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the… |
CVE-2026-33616 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of s… |
CVE-2026-33615 | Critical | 9.1 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special… |
CVE-2026-33614 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special… |
CVE-2026-5322 | High | 7.3 | 2026-04-02 | A vulnerability has been found in AlejandroArciniegas mcp-data-vis bc597e391f184d2187062fd567599a3cb72adf51/de5a51525a69822290eaee569a1ab447b490746d. This affe… |
CVE-2026-34747 | High | 8.5 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker… |
CVE-2026-34455 | High | 8.8 | 2026-04-01 | Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes p… |
CVE-2026-30273 | High | 7.3 | 2026-04-01 | pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component. |
CVE-2026-21630 | High | 8.8 | 2026-04-01 | Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint. |
CVE-2026-5257 | High | 7.3 | 2026-04-01 | A vulnerability has been found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /delstaffinfo.php of the comp… |
CVE-2026-5256 | High | 7.3 | 2026-04-01 | A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modify.php of the component Parameter Ha… |
CVE-2025-13855 | High | 7.6 | 2026-04-01 | IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements… |
CVE-2026-5238 | High | 7.3 | 2026-04-01 | A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /view_employee.p… |
CVE-2026-4668 | Medium | 6.5 | 2026-04-01 | The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the `sort` parameter in the payments listing… |
CVE-2026-5237 | High | 7.3 | 2026-03-31 | A security flaw has been discovered in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /mana… |
CVE-2026-34400 | Critical | 9.8 | 2026-03-31 | Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which buil… |
CVE-2026-5206 | Medium | 6.3 | 2026-03-31 | A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the component Payment… |
CVE-2026-30520 | Medium | 5.4 | 2026-03-31 | A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the s… |
CVE-2026-34220 | Critical | 9.8 | 2026-03-31 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injec… |
CVE-2026-5198 | High | 7.3 | 2026-03-31 | A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the… |
CVE-2026-5197 | Medium | 6.3 | 2026-03-31 | A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of the file /delete_user.php. The manipul… |
CVE-2026-4317 | | 2026-03-31 | SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to… | |
CVE-2026-5196 | Medium | 6.3 | 2026-03-31 | A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.php. The manipulation… |
CVE-2026-5195 | High | 7.3 | 2026-03-31 | A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the component User Registration Handler. Ex… |
CVE-2026-5182 | High | 7.3 | 2026-03-31 | A vulnerability was found in SourceCodester Teacher Record System 1.0. Impacted is an unknown function of the file Teacher Record System of the component Param… |
CVE-2026-5180 | High | 7.3 | 2026-03-31 | A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login… |
CVE-2026-5179 | High | 7.3 | 2026-03-31 | A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This affects an unknown part of the file /admin/login.php. The manipulati… |
CVE-2026-32714 | Critical | 9.8 | 2026-03-31 | SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection be… |
CVE-2026-27697 | Critical | 9.8 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in v… |
CVE-2026-5150 | High | 7.3 | 2026-03-30 | A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /viewin_costumer.php… |
CVE-2026-5148 | Medium | 4.7 | 2026-03-30 | A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This m… |
CVE-2026-31799 | Medium | 4.9 | 2026-03-30 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after"… |
CVE-2026-5147 | High | 7.3 | 2026-03-30 | A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The… |
CVE-2026-33643 | High | 7.4 | 2026-03-30 | SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the mysqlColumnAsInsert function in file plugins/mysql/lib/column.go. |
CVE-2026-29953 | High | 7.4 | 2026-03-30 | SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins/postgres/lib/column.go. |
CVE-2026-5035 | High | 7.3 | 2026-03-29 | A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_work.php of the component Parameter Handl… |
CVE-2026-5034 | High | 7.3 | 2026-03-29 | A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of the file /edit_costumer.php of the compon… |
CVE-2026-5033 | High | 7.3 | 2026-03-29 | A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_costumer.php… |
CVE-2026-5019 | High | 7.3 | 2026-03-29 | A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2026-5018 | High | 7.3 | 2026-03-28 | A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.php of the component… |
CVE-2026-5017 | High | 7.3 | 2026-03-28 | A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of the file /all-tickets.php of the compone… |
CVE-2026-4996 | High | 7.3 | 2026-03-28 | A vulnerability was identified in Sinaptik AI PandasAI up to 0.1.4. Affected by this issue is the function delete_question_and_answers/delete_docs/update_quest… |