CWE-89 · SQL Injection (page 2)
Page 2 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-95865 | Medium | 6.5 | 2026-10-03 | The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in al… |
CVE-2026-94539 | Medium | 6.5 | 2026-10-03 | The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort_by' para… |
CVE-2026-82045 | Medium | 6.5 | 2026-10-02 | UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanS… |
CVE-2026-82039 | High | 8.8 | 2026-10-02 | UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attackers to inject arbit… |
CVE-2026-104625 | Medium | 6.3 | 2026-10-02 | A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a… |
CVE-2026-85215 | High | 7.1 | 2026-10-02 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injec… |
CVE-2026-104614 | Medium | 6.3 | 2026-10-02 | A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/p… |
CVE-2026-104613 | Medium | 6.3 | 2026-10-02 | A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/prod… |
CVE-2026-104609 | High | 7.3 | 2026-10-02 | A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the… |
CVE-2026-104462 | High | 7.5 | 2026-10-02 | YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN cl… |
CVE-2026-104460 | High | 7.5 | 2026-10-02 | YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEX… |
CVE-2026-104457 | High | 8.6 | 2026-10-02 | YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and conca… |
CVE-2026-104456 | High | 7.6 | 2026-10-02 | YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped… |
CVE-2026-104606 | Medium | 6.3 | 2026-10-02 | A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. T… |
CVE-2026-80298 | High | 8.8 | 2026-10-02 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Inject… |
CVE-2026-97634 | Medium | 6.5 | 2026-10-02 | The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including… |
CVE-2026-12951 | Medium | 6.5 | 2026-10-02 | The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/compliance/report-abus… |
CVE-2026-94298 | Medium | 6.2 | 2026-10-02 | The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using… |
CVE-2026-104123 | High | 7.3 | 2026-10-02 | A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /r… |
CVE-2026-104053 | Medium | 6.3 | 2026-10-02 | A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php… |
CVE-2026-104052 | Medium | 6.3 | 2026-10-02 | A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.p… |
CVE-2026-103766 | High | 7.2 | 2026-10-02 | ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via th… |
CVE-2026-56097 | Medium | 6.5 | 2026-10-01 | A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize i… |
CVE-2026-103690 | Medium | 6.3 | 2026-10-01 | A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing… |
CVE-2026-62071 | Critical | 9.3 | 2026-10-01 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. |
CVE-2026-62060 | High | 7.6 | 2026-10-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows… |
CVE-2026-62059 | High | 7.6 | 2026-10-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Bl… |
CVE-2026-103338 | High | 8.5 | 2026-10-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free… |
CVE-2026-102379 | High | 8.5 | 2026-10-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – C… |
CVE-2026-103253 | High | 8.7 | 2026-10-01 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Dele… |
CVE-2026-103248 | Critical | 9.0 | 2026-10-01 | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (… |
CVE-2026-75786 | | 2026-10-01 | Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onw… | |
CVE-2026-89296 | High | 8.6 | 2026-10-01 | The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated user… |
CVE-2026-81809 | High | 7.5 | 2026-10-01 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the… |
CVE-2026-103543 | Medium | 6.3 | 2026-10-01 | A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controlle… |
CVE-2026-102109 | High | 7.1 | 2026-09-30 | A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated… |
CVE-2026-102098 | High | 7.2 | 2026-09-30 | Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could… |
CVE-2026-103232 | High | 7.3 | 2026-09-30 | A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_… |
CVE-2026-103231 | High | 7.3 | 2026-09-30 | A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the funct… |
CVE-2026-103230 | High | 7.3 | 2026-09-30 | A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_q… |
CVE-2026-103229 | High | 7.3 | 2026-09-30 | A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli… |
CVE-2026-76570 | Critical | 9.1 | 2026-09-30 | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no J… |
CVE-2026-62097 | High | 7.6 | 2026-09-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allo… |
CVE-2026-18782 | Critical | 9.8 | 2026-09-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES al… |
CVE-2026-82307 | Critical | 9.8 | 2026-09-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injectio… |
CVE-2026-97293 | High | 8.5 | 2026-09-30 | Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. |
CVE-2026-97287 | High | 8.5 | 2026-09-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows… |
CVE-2026-96828 | High | 7.6 | 2026-09-30 | Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions. |
CVE-2026-96827 | High | 7.6 | 2026-09-30 | Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions. |
CVE-2026-96822 | Critical | 9.3 | 2026-09-30 | Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions. |
CVE-2026-96346 | High | 7.6 | 2026-09-30 | Author SQL Injection in WP ERP <= 1.17.9 versions. |
CVE-2026-96345 | High | 7.6 | 2026-09-30 | Administrator SQL Injection in Estatik <= 4.3.5 versions. |
CVE-2026-94177 | High | 8.5 | 2026-09-30 | Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions. |
CVE-2026-94115 | High | 8.5 | 2026-09-30 | Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions. |
CVE-2026-94082 | High | 7.6 | 2026-09-30 | Author SQL Injection in Quiz Cat <= 3.1.1 versions. |
CVE-2026-93621 | High | 8.2 | 2026-09-30 | Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions. |
CVE-2026-62085 | High | 7.6 | 2026-09-30 | Administrator SQL Injection in WP Activity Log <= 5.6.6 versions. |
CVE-2026-103117 | Medium | 4.7 | 2026-09-30 | A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of… |
CVE-2026-103116 | Medium | 6.3 | 2026-09-30 | A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component S… |
CVE-2026-103115 | Medium | 6.3 | 2026-09-30 | A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the compo… |
CVE-2026-103114 | Medium | 6.3 | 2026-09-30 | A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignmen… |
CVE-2026-103113 | Medium | 4.7 | 2026-09-30 | A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of… |
CVE-2026-102578 | Medium | 5.5 | 2026-09-30 | A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries… |
CVE-2026-102456 | Medium | 6.5 | 2026-09-30 | EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database conten… |
CVE-2026-6806 | High | 7.5 | 2026-09-30 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' paramet… |
CVE-2026-16596 | Medium | 6.5 | 2026-09-30 | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5… |
CVE-2026-102913 | High | 7.3 | 2026-09-30 | A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php… |
CVE-2026-102912 | Medium | 4.7 | 2026-09-30 | A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=report… |
CVE-2026-102910 | High | 7.3 | 2026-09-30 | A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_… |
CVE-2026-102909 | High | 7.3 | 2026-09-30 | A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessme… |
CVE-2026-102908 | High | 7.3 | 2026-09-30 | A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admi… |
CVE-2026-51936 | | 2026-09-30 | Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into… | |
CVE-2026-72510 | Critical | 9.0 | 2026-09-29 | The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection. |
CVE-2026-72507 | Critical | 9.0 | 2026-09-29 | The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulner… |
CVE-2026-68954 | Critical | 9.0 | 2026-09-29 | The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability. |
CVE-2026-68068 | Critical | 9.0 | 2026-09-29 | The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL inj… |
CVE-2026-63713 | Critical | 9.0 | 2026-09-29 | The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability. |
CVE-2026-79536 | Critical | 9.1 | 2026-09-29 | bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to acc… |
CVE-2026-102616 | High | 7.3 | 2026-09-29 | A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl… |
CVE-2026-102796 | High | 7.5 | 2026-09-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Exte… |
CVE-2023-54400 | Critical | 9.8 | 2026-09-29 | Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary S… |
CVE-2026-102570 | Medium | 5.5 | 2026-09-29 | ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is con… |
CVE-2026-102569 | Medium | 5.5 | 2026-09-29 | ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concat… |
CVE-2026-102491 | High | 7.3 | 2026-09-29 | A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFi… |
CVE-2015-20122 | High | 7.5 | 2026-09-29 | Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment d… |
CVE-2026-86843 | Medium | 6.3 | 2026-09-29 | The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight… |
CVE-2026-96429 | | 2026-09-29 | SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arb… | |
CVE-2026-96428 | | 2026-09-29 | SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbi… | |
CVE-2026-101091 | High | 7.1 | 2026-09-28 | SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .s… |
CVE-2026-101110 | Critical | 9.8 | 2026-09-28 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and di… |
CVE-2026-101108 | | 2026-09-28 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_dir… | |
CVE-2026-101105 | Medium | 6.3 | 2026-09-28 | A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofile_form of the file /create_profile of… |
CVE-2026-100752 | | 2026-09-28 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause o… | |
CVE-2026-86595 | High | 8.8 | 2026-09-28 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL… |
CVE-2026-73640 | | 2026-09-28 | Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with… | |
CVE-2026-101018 | Medium | 4.7 | 2026-09-28 | A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/… |
CVE-2026-101013 | High | 7.3 | 2026-09-28 | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown fu… |
CVE-2026-101012 | High | 7.3 | 2026-09-28 | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of t… |
CVE-2026-101011 | Medium | 4.7 | 2026-09-28 | A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain… |
CVE-2026-101010 | Medium | 4.7 | 2026-09-28 | A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The man… |