CWE-89 · SQL Injection (page 21)
Page 21 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3079 | Medium | 6.5 | 2026-03-24 | The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderby_order]' parameter in the 'learndash_propanel_te… |
CVE-2026-4615 | High | 7.3 | 2026-03-24 | A vulnerability was identified in SourceCodester Online Catering Reservation 1.0. Impacted is an unknown function of the file /search.php. Such manipulation of… |
CVE-2026-4614 | Medium | 6.3 | 2026-03-24 | A vulnerability was determined in itsourcecode sanitize or validate this input 1.0. This issue affects some unknown processing of the file /admin/subjects.php… |
CVE-2026-4613 | High | 7.3 | 2026-03-24 | A vulnerability was found in SourceCodester E-Commerce Site 1.0. This vulnerability affects unknown code of the file /products.php. The manipulation of the arg… |
CVE-2026-4306 | High | 7.5 | 2026-03-23 | The WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter in all versions up to, and including, 2.4.8 due to insufficien… |
CVE-2026-2412 | Medium | 6.5 | 2026-03-23 | The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including… |
CVE-2026-4612 | High | 7.3 | 2026-03-23 | A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?vie… |
CVE-2026-4597 | Medium | 6.3 | 2026-03-23 | A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the file src/main/java/com/genersoft/iot/vm… |
CVE-2026-33723 | High | 7.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Subscribe::save()` method in `objects/subscribe.php` concatenates the… |
CVE-2026-33651 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` thr… |
CVE-2026-4594 | High | 7.3 | 2026-03-23 | A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy of the file erupt-data/erupt-jpa/src/ma… |
CVE-2026-4593 | Medium | 6.3 | 2026-03-23 | A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the file erupt-ai/src/main/java/xyz/erupt/ai… |
CVE-2026-33485 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessibl… |
CVE-2026-33352 | Critical | 9.8 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `ge… |
CVE-2025-41008 | | 2026-03-23 | SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter… | |
CVE-2025-41007 | | 2026-03-23 | SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'search' parameter in the '/search… | |
CVE-2026-32969 | High | 7.5 | 2026-03-23 | An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper ne… |
CVE-2026-4581 | High | 7.3 | 2026-03-23 | A weakness has been identified in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checklogin.php of the component Paramet… |
CVE-2026-4580 | High | 7.3 | 2026-03-23 | A security flaw has been discovered in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkupdatestatus.php of the comp… |
CVE-2026-4579 | High | 7.3 | 2026-03-23 | A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /viewdetail.php of the component Parame… |
CVE-2026-4574 | Medium | 6.3 | 2026-03-23 | A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handl… |
CVE-2026-4573 | Medium | 6.3 | 2026-03-23 | A security vulnerability has been detected in SourceCodester Simple E-learning System 1.0. This affects an unknown part of the file /includes/form_handlers/del… |
CVE-2026-4572 | Medium | 6.3 | 2026-03-23 | A weakness has been identified in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /view_product… |
CVE-2026-4571 | Medium | 6.3 | 2026-03-23 | A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /v… |
CVE-2026-4570 | Medium | 6.3 | 2026-03-23 | A vulnerability was identified in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /view_customers.php of the compone… |
CVE-2026-4569 | Medium | 6.3 | 2026-03-23 | A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /view_category.php of the compone… |
CVE-2026-4568 | Medium | 6.3 | 2026-03-23 | A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component… |
CVE-2026-2580 | High | 7.5 | 2026-03-23 | The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the… |
CVE-2026-4550 | Medium | 4.7 | 2026-03-22 | A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulati… |
CVE-2026-4540 | High | 7.3 | 2026-03-22 | A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the compone… |
CVE-2026-4533 | Medium | 6.3 | 2026-03-22 | A vulnerability was detected in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file all-tickets.php… |
CVE-2026-4530 | Medium | 5.3 | 2026-03-22 | A security flaw has been discovered in apconw Aix-DB up to 1.2.3. This impacts an unknown function of the file agent/text2sql/rag/terminology_retriever.py. Per… |
CVE-2019-25581 | High | 8.2 | 2026-03-21 | i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code thr… |
CVE-2019-25578 | High | 8.2 | 2026-03-21 | phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2019-25576 | High | 8.2 | 2026-03-21 | Kepler Wallpaper Script 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2019-25575 | High | 8.2 | 2026-03-21 | SimplePress CMS 1.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious cod… |
CVE-2019-25573 | High | 7.1 | 2026-03-21 | Green CMS 2.x contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2026-4513 | Medium | 6.3 | 2026-03-21 | A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function ask of the file vanna\legacy\base\base.py. Performin… |
CVE-2026-4087 | Medium | 6.5 | 2026-03-21 | The Pre* Party Resource Hints plugin for WordPress is vulnerable to SQL Injection via the 'hint_ids' parameter of the pprh_update_hints AJAX action in all vers… |
CVE-2026-3334 | High | 8.8 | 2026-03-21 | The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versi… |
CVE-2026-2503 | Medium | 6.5 | 2026-03-21 | The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX ac… |
CVE-2026-2468 | High | 7.5 | 2026-03-21 | The Quentn WP plugin for WordPress is vulnerable to SQL Injection via the 'qntn_wp_access' cookie in all versions up to, and including, 1.2.12. This is due to… |
CVE-2026-2279 | High | 7.2 | 2026-03-21 | The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1.6 due… |
CVE-2026-1800 | High | 7.5 | 2026-03-21 | The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, an… |
CVE-2026-4508 | High | 7.3 | 2026-03-20 | A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.p… |
CVE-2026-4507 | Medium | 6.3 | 2026-03-20 | A vulnerability was determined in Mindinventory MindSQL up to 0.2.1. The affected element is the function ask_db of the file mindsql/core/mindsql_core.py. Exec… |
CVE-2026-33142 | High | 8.1 | 2026-03-20 | OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggrega… |
CVE-2026-4504 | High | 7.3 | 2026-03-20 | A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix… |
CVE-2025-62846 | Medium | 6.7 | 2026-03-20 | An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability t… |
CVE-2026-4485 | Medium | 6.3 | 2026-03-20 | A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/search_student.php… |
CVE-2026-33134 | Critical | 9.3 | 2026-03-20 | WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_… |
CVE-2026-33133 | High | 7.2 | 2026-03-20 | WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives wi… |
CVE-2026-4473 | Medium | 4.7 | 2026-03-20 | A vulnerability was detected in itsourcecode Online Doctor Appointment System 1.0. This issue affects some unknown processing of the file /admin/appointment_ac… |
CVE-2026-4472 | Medium | 6.3 | 2026-03-20 | A security vulnerability has been detected in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /admin/… |
CVE-2026-4471 | Medium | 4.7 | 2026-03-20 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /admin/admin_edit_employee.php… |
CVE-2026-4470 | Medium | 4.7 | 2026-03-20 | A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2026-4469 | Medium | 4.7 | 2026-03-20 | A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-33025 | High | 8.8 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'… |
CVE-2026-32954 | High | 7.1 | 2026-03-20 | ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and… |
CVE-2026-32950 | High | 8.8 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in t… |
CVE-2026-32888 | High | 8.8 | 2026-03-20 | Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items s… |
CVE-2026-32813 | High | 8.0 | 2026-03-20 | Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature… |
CVE-2026-32767 | Critical | 9.8 | 2026-03-20 | SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock… |
CVE-2026-33288 | High | 8.8 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a SQL Injection v… |
CVE-2026-32763 | High | 8.2 | 2026-03-20 | Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL a… |
CVE-2026-29099 | High | 8.8 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()`… |
CVE-2026-29096 | High | 8.1 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or… |
CVE-2026-30711 | High | 8.8 | 2026-03-19 | Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-a… |
CVE-2026-3658 | High | 7.5 | 2026-03-19 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter i… |
CVE-2026-27413 | Critical | 9.3 | 2026-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection… |
CVE-2026-32698 | Critical | 9.1 | 2026-03-18 | OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection a… |
CVE-2026-32321 | High | 8.8 | 2026-03-18 | ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 w… |
CVE-2025-58112 | High | 8.8 | 2026-03-18 | Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .r… |
CVE-2026-32611 | High | 7.0 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by… |
CVE-2025-67830 | Critical | 9.8 | 2026-03-18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection. |
CVE-2025-67829 | Critical | 9.8 | 2026-03-18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection. |
CVE-2026-22730 | High | 8.8 | 2026-03-18 | A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute ar… |
CVE-2026-33058 | Medium | 6.5 | 2026-03-18 | Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers wi… |
CVE-2026-31891 | High | 7.7 | 2026-03-18 | Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by… |
CVE-2026-26001 | High | 7.1 | 2026-03-18 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user in… |
CVE-2026-25936 | Medium | 6.5 | 2026-03-17 | GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injecti… |
CVE-2026-4319 | High | 7.3 | 2026-03-17 | A vulnerability was identified in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/a… |
CVE-2026-4324 | Medium | 5.4 | 2026-03-17 | A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attac… |
CVE-2026-2579 | High | 7.5 | 2026-03-17 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up… |
CVE-2026-4289 | High | 7.3 | 2026-03-17 | A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preS… |
CVE-2026-4288 | High | 7.3 | 2026-03-17 | A weakness has been identified in Tiandy Easy7 Integrated Management Platform 7.17.0. The impacted element is an unknown function of the file /rest/devStatus/g… |
CVE-2026-4287 | High | 7.3 | 2026-03-17 | A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devSta… |
CVE-2026-30881 | High | 8.8 | 2026-03-16 | Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters d… |
CVE-2026-28430 | Critical | 9.8 | 2026-03-16 | Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to… |
CVE-2025-69768 | High | 7.5 | 2026-03-16 | SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php component |
CVE-2025-62319 | Critical | 9.8 | 2026-03-16 | Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into app… |
CVE-2025-52646 | Low | 2.2 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2026-4241 | Medium | 6.3 | 2026-03-16 | A vulnerability was identified in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/time-table.php. Su… |
CVE-2026-4238 | Medium | 4.7 | 2026-03-16 | A vulnerability has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/courses.php. The ma… |
CVE-2026-4237 | High | 7.3 | 2026-03-16 | A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/mod_reports/index.php… |
CVE-2026-4236 | High | 7.3 | 2026-03-16 | A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view… |
CVE-2026-4235 | High | 7.3 | 2026-03-16 | A weakness has been identified in itsourcecode Online Enrollment System 1.0. This issue affects some unknown processing of the file /sms/login.php. This manipu… |
CVE-2026-4234 | Medium | 6.3 | 2026-03-16 | A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handl… |
CVE-2026-4232 | High | 7.3 | 2026-03-16 | A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /rest/user/get… |
CVE-2026-4230 | Medium | 6.3 | 2026-03-16 | A vulnerability has been found in vanna-ai vanna up to 2.0.2. Affected is the function update_sql of the file src/vanna/legacy/flask/__init__.py of the compone… |