CWE-89 · SQL Injection (page 2)
Page 2 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15351 | Medium | 4.9 | 2026-08-16 | The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status'… |
CVE-2026-16079 | Medium | 6.5 | 2026-08-16 | The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including… |
CVE-2026-15963 | Medium | 6.5 | 2026-08-16 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in… |
CVE-2026-15602 | Medium | 4.9 | 2026-08-16 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all ve… |
CVE-2026-19926 | High | 7.3 | 2026-08-16 | A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 o… |
CVE-2026-19925 | Medium | 4.7 | 2026-08-16 | A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete… |
CVE-2026-19923 | Medium | 6.3 | 2026-08-16 | A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkout_process.php. Executing a manipul… |
CVE-2026-19921 | Medium | 6.3 | 2026-08-16 | A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction… |
CVE-2026-19920 | Medium | 6.3 | 2026-08-16 | A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the a… |
CVE-2026-19919 | High | 7.3 | 2026-08-16 | A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The mani… |
CVE-2026-19917 | Medium | 6.3 | 2026-08-15 | A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing… |
CVE-2026-19905 | High | 7.3 | 2026-08-15 | A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This man… |
CVE-2026-19899 | High | 7.3 | 2026-08-15 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.p… |
CVE-2026-19894 | Medium | 6.3 | 2026-08-15 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a… |
CVE-2026-12248 | Medium | 6.5 | 2026-08-15 | The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to in… |
CVE-2026-16007 | | 2026-08-15 | AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrat… | |
CVE-2026-18387 | Medium | 6.5 | 2026-08-15 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all ve… |
CVE-2026-16586 | Medium | 6.5 | 2026-08-15 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles… |
CVE-2026-16146 | Medium | 4.9 | 2026-08-15 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Value… |
CVE-2026-16094 | Medium | 4.9 | 2026-08-15 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in… |
CVE-2026-15993 | Medium | 5.3 | 2026-08-15 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placehold… |
CVE-2026-15453 | Medium | 6.5 | 2026-08-15 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versi… |
CVE-2026-16080 | Medium | 6.5 | 2026-08-15 | The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up to, and including… |
CVE-2026-15162 | High | 7.5 | 2026-08-15 | The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-sa… |
CVE-2026-71571 | | 2026-08-14 | Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to… | |
CVE-2026-67365 | | 2026-08-14 | Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda)… | |
CVE-2026-17227 | Medium | 5.4 | 2026-08-14 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special el… |
CVE-2026-18403 | | 2026-08-14 | LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey… | |
CVE-2026-73850 | | 2026-08-14 | Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php. | |
CVE-2026-48528 | Critical | 9.8 | 2026-08-14 | Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated… |
CVE-2026-19680 | High | 7.1 | 2026-08-14 | A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. |
CVE-2026-19631 | Medium | 4.9 | 2026-08-14 | A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting… |
CVE-2026-19825 | High | 7.3 | 2026-08-14 | A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /clas… |
CVE-2026-72811 | Critical | 10.0 | 2026-08-14 | SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored bloc… |
CVE-2026-16810 | Medium | 6.5 | 2026-08-14 | The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via… |
CVE-2026-15205 | High | 8.6 | 2026-08-14 | The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its publ… |
CVE-2026-12743 | Medium | 4.9 | 2026-08-14 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' param… |
CVE-2026-19787 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_… |
CVE-2026-19785 | Medium | 6.3 | 2026-08-14 | A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medica… |
CVE-2026-19767 | Medium | 6.3 | 2026-08-14 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Ex… |
CVE-2026-19764 | High | 7.3 | 2026-08-14 | A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/us… |
CVE-2026-73663 | | 2026-08-13 | FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From h… | |
CVE-2026-73408 | High | 7.6 | 2026-08-13 | Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped… |
CVE-2026-72853 | High | 7.6 | 2026-08-13 | Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in id… |
CVE-2026-72851 | Critical | 10.0 | 2026-08-13 | Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST at… |
CVE-2026-16961 | High | 7.6 | 2026-08-13 | IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, a… |
CVE-2024-58374 | High | 7.5 | 2026-08-13 | Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to acce… |
CVE-2019-25765 | High | 7.5 | 2026-08-13 | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipula… |
CVE-2026-59109 | High | 8.8 | 2026-08-13 | SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-inv… |
CVE-2026-73670 | High | 7.2 | 2026-08-13 | A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLU… |
CVE-2026-19710 | High | 7.3 | 2026-08-13 | A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin… |
CVE-2026-73346 | High | 7.6 | 2026-08-13 | Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. |
CVE-2026-66658 | High | 8.5 | 2026-08-13 | Subscriber SQL Injection in Reviewer <= 3.14.2 versions. |
CVE-2026-66478 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. |
CVE-2026-66472 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. |
CVE-2026-66458 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in RealPress <= 1.1.2 versions. |
CVE-2026-66446 | Critical | 9.3 | 2026-08-13 | Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions. |
CVE-2026-66436 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. |
CVE-2026-66430 | High | 8.5 | 2026-08-13 | Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions. |
CVE-2026-61969 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. |
CVE-2026-61966 | Critical | 9.3 | 2026-08-13 | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. |
CVE-2026-28168 | High | 8.5 | 2026-08-13 | Subscriber SQL Injection in CubeWP <= 1.1.30 versions. |
CVE-2026-28156 | High | 8.5 | 2026-08-13 | Subscriber SQL Injection in Do Lasso <= 358 versions. |
CVE-2026-28142 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. |
CVE-2026-28002 | High | 8.5 | 2026-08-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issu… |
CVE-2026-28001 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
CVE-2026-27538 | High | 7.5 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. |
CVE-2026-15741 | High | 8.8 | 2026-08-13 | SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect e… |
CVE-2026-11840 | High | 8.8 | 2026-08-13 | Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection. |
CVE-2026-73332 | High | 8.7 | 2026-08-12 | CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject a… |
CVE-2026-73331 | High | 7.1 | 2026-08-12 | CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit… |
CVE-2026-72807 | High | 8.0 | 2026-08-12 | SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view template columns that expose the queryBlocks function, which… |
CVE-2026-67579 | High | 7.4 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pag… |
CVE-2026-17111 | High | 7.6 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to vi… |
CVE-2026-73300 | Critical | 9.6 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enablin… |
CVE-2026-44741 | High | 8.8 | 2026-08-12 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translatio… |
CVE-2026-17419 | Medium | 6.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL… |
CVE-2026-17418 | High | 8.5 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in… |
CVE-2026-17222 | Medium | 4.3 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special element… |
CVE-2025-41771 | Medium | 4.3 | 2026-08-12 | An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability a… |
CVE-2026-66659 | Critical | 9.3 | 2026-08-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This… |
CVE-2026-18474 | High | 8.6 | 2026-08-12 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection expl… |
CVE-2026-18230 | High | 8.1 | 2026-08-12 | The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated… |
CVE-2026-18057 | High | 8.1 | 2026-08-12 | The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with… |
CVE-2026-16977 | High | 8.1 | 2026-08-12 | The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query bu… |
CVE-2026-13613 | High | 8.8 | 2026-08-12 | The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authentic… |
CVE-2026-73211 | Critical | 9.8 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub… |
CVE-2026-48381 | Critical | 9.0 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2022-50997 | High | 7.5 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attack… |
CVE-2016-20097 | High | 7.5 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbit… |
CVE-2026-65673 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate p… |
CVE-2026-73069 | Critical | 9.1 | 2026-08-11 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permiss… |
CVE-2026-46670 | Critical | 9.8 | 2026-08-11 | YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allo… |
CVE-2026-72775 | | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier paramet… | |
CVE-2026-72750 | | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression v… | |
CVE-2026-72610 | Medium | 4.3 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers… |
CVE-2026-72609 | High | 7.1 | 2026-08-11 | An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive perm… |
CVE-2026-72608 | Medium | 6.5 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator perm… |
CVE-2026-72607 | High | 7.1 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod per… |
CVE-2026-72599 | Critical | 9.8 | 2026-08-11 | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The paramete… |