CWE-89 · SQL Injection (page 21)
Page 21 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9523 | High | 7.3 | 2026-05-26 | A vulnerability was detected in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 3000WEBV2. Affected by this vulnerability is an… |
CVE-2026-48837 | High | 8.5 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements For Elementor allows Blind SQL Injecti… |
CVE-2026-42774 | Critical | 9.3 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine allows SQL Injection. This issue af… |
CVE-2026-42773 | Critical | 9.3 | 2026-05-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eMagicOne eMagicOne Store Manager allows Blind SQL Inject… |
CVE-2026-48842 | High | 8.1 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash e… |
CVE-2026-9474 | High | 7.3 | 2026-05-25 | A vulnerability was found in yashpokharna2555 StudentManagementSystem up to cb2f558ddf8d19396de0f92abf2d224d46a0a203. Affected by this issue is the function co… |
CVE-2026-27768 | Medium | 6.6 | 2026-05-25 | SQL Injection affecting the Access Manager role. |
CVE-2026-9470 | High | 7.3 | 2026-05-25 | A security vulnerability has been detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This affects the function conf… |
CVE-2026-9469 | High | 7.3 | 2026-05-25 | A weakness has been identified in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. The impacted element is an unknown functio… |
CVE-2026-9465 | High | 7.3 | 2026-05-25 | A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This vulnerability affects unknown code of the file /Easy7/apps/WebService/Get… |
CVE-2018-25381 | High | 7.1 | 2026-05-25 | Joomla Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through multipl… |
CVE-2018-25380 | High | 7.1 | 2026-05-25 | Joomla Component eXtroForms 2.1.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL commands through the fil… |
CVE-2018-25379 | High | 8.2 | 2026-05-25 | Collectric CMU 1.0 contains a boolean-based blind SQL injection vulnerability in the lang parameter that allows unauthenticated attackers to manipulate databas… |
CVE-2018-25372 | High | 8.2 | 2026-05-25 | MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injectin… |
CVE-2018-25371 | High | 8.2 | 2026-05-25 | mooSocial Store Plugin 2.6 contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries through the produc… |
CVE-2018-25364 | High | 8.2 | 2026-05-25 | Twitter-Clone 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25362 | High | 8.2 | 2026-05-25 | Twitter-Clone 1 contains a SQL injection vulnerability in follow.php that allows attackers to manipulate database queries by injecting SQL code through the use… |
CVE-2026-9451 | Medium | 6.3 | 2026-05-25 | A weakness has been identified in code-projects Employee Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /process… |
CVE-2026-9450 | Medium | 6.3 | 2026-05-25 | A security flaw has been discovered in code-projects Employee Management System 1.0. Affected is an unknown function of the file /psubmit.php. The manipulation… |
CVE-2026-9449 | Medium | 6.3 | 2026-05-25 | A vulnerability was identified in code-projects Employee Management System 1.0. This impacts an unknown function of the file /changepassemp.php. The manipulati… |
CVE-2026-9447 | High | 7.3 | 2026-05-25 | A vulnerability was found in SourceCodester Simple POS and Inventory System 1.0. The impacted element is an unknown function of the file /user/search.php. Perf… |
CVE-2026-9446 | Medium | 4.7 | 2026-05-25 | A vulnerability has been found in SourceCodester Simple POS and Inventory System 1.0. The affected element is an unknown function of the file /admin/edit_custo… |
CVE-2026-9444 | Medium | 4.7 | 2026-05-25 | A vulnerability was detected in SourceCodester Simple POS and Inventory System 1.0. This issue affects the function delete of the file /admin/deleteproduct.php… |
CVE-2026-9411 | Medium | 6.3 | 2026-05-25 | A vulnerability was found in SourceCodester Indian Invoicing System 1.0. This issue affects some unknown processing of the file /Invoicing/IGST_Invoice.php of… |
CVE-2026-9383 | High | 7.3 | 2026-05-24 | A vulnerability has been found in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/admin/login.php. The manipulati… |
CVE-2026-9364 | High | 7.3 | 2026-05-24 | A flaw has been found in projectworlds Online Art Gallery Shop 1.0. Impacted is an unknown function of the file /admin/adminHome.php. Executing a manipulation… |
CVE-2026-9356 | High | 7.3 | 2026-05-24 | A vulnerability has been found in SourceCodester Hospitals Patient Records Management System 1.0. This affects an unknown function of the file /admin/patients/… |
CVE-2026-9355 | High | 7.3 | 2026-05-24 | A flaw has been found in SourceCodester Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /classes/Maste… |
CVE-2026-9342 | Medium | 6.3 | 2026-05-23 | A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. Impacted is an unknown function of the file /admin/patie… |
CVE-2018-25352 | High | 7.1 | 2026-05-23 | WordPress Ultimate Form Builder Lite plugin version 1.3.7 and below contains an SQL injection vulnerability that allows authenticated attackers to manipulate d… |
CVE-2018-25351 | High | 8.2 | 2026-05-23 | Joomla! Component EkRishta 2.10 contains an error-based SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by i… |
CVE-2018-25348 | High | 8.2 | 2026-05-23 | Joomla! Component Ek Rishta 2.10 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL… |
CVE-2018-25347 | High | 7.1 | 2026-05-23 | WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through th… |
CVE-2018-25346 | High | 7.1 | 2026-05-23 | WordPress Form Maker Plugin 1.12.24 and below contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injec… |
CVE-2018-25342 | High | 8.2 | 2026-05-23 | Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2018-25341 | High | 8.2 | 2026-05-23 | Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2018-25340 | High | 8.2 | 2026-05-23 | Smartshop 1 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2026-9305 | Medium | 6.3 | 2026-05-23 | A weakness has been identified in QuantumNous new-api up to 0.12.1. The impacted element is the function SearchUserTopUps/SearchAllTopUps of the file model/top… |
CVE-2026-41075 | High | 8.8 | 2026-05-22 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 through 5.0.9 and 6.0.0 through 6.0.2 contain an SQL injection vulnerab… |
CVE-2026-25606 | | 2026-05-22 | A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Inject… | |
CVE-2026-4834 | High | 7.5 | 2026-05-22 | The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to i… |
CVE-2026-48240 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated… |
CVE-2026-48239 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clau… |
CVE-2026-48238 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause… |
CVE-2026-48237 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated… |
CVE-2026-48236 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser… |
CVE-2026-48235 | High | 8.2 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestam… |
CVE-2026-48234 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated… |
CVE-2026-48233 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT… |
CVE-2026-48232 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LI… |
CVE-2026-48231 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are conc… |
CVE-2026-39531 | Critical | 9.3 | 2026-05-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Inject… |
CVE-2026-44047 | High | 8.8 | 2026-05-21 | An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access t… |
CVE-2026-9082 | Critical | 9.8 | 2026-05-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affe… |
CVE-2026-44923 | Medium | 6.5 | 2026-05-20 | SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges. |
CVE-2026-42383 | High | 7.6 | 2026-05-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooCommerce Product Add-Ons allows Blind SQL In… |
CVE-2026-9065 | | 2026-05-20 | SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider')… | |
CVE-2026-9059 | | 2026-05-20 | NextGEN Gallery version prior to 4.2.1 are vulnerable to authenticated SQL injection via the 'orderby' parameter on the REST API endpoints '/imagely/v1/galleri… | |
CVE-2026-9010 | High | 7.5 | 2026-05-20 | The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0… |
CVE-2026-9003 | High | 7.5 | 2026-05-20 | E-LAN Hybrid Recording System developed by TONNET has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands… |
CVE-2026-8685 | Medium | 6.5 | 2026-05-20 | The Infility Global plugin for WordPress is vulnerable to SQL Injection via the 'orderby' and 'order' parameters in all versions up to, and including, 2.15.16… |
CVE-2026-7472 | Medium | 4.9 | 2026-05-20 | The Read More & Accordion plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'orderby' parameter in all versions up to, and including… |
CVE-2026-3985 | High | 7.5 | 2026-05-20 | The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress is vulnerable to SQL Injection via the 'checkout_uuid' parameter in all… |
CVE-2026-31069 | High | 8.8 | 2026-05-19 | BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository. User-controlled input from metric filter names and ag… |
CVE-2026-8912 | High | 7.5 | 2026-05-19 | The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6. This is due to… |
CVE-2026-8827 | | 2026-05-19 | The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not inv… | |
CVE-2026-8726 | | 2026-05-19 | The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL thro… | |
CVE-2026-8851 | High | 8.1 | 2026-05-18 | SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to ex… |
CVE-2026-6379 | High | 8.6 | 2026-05-18 | The WP Photo Album Plus WordPress plugin before 9.1.11.001 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthent… |
CVE-2026-8785 | High | 7.3 | 2026-05-18 | A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file up… |
CVE-2026-8772 | Medium | 4.7 | 2026-05-18 | A weakness has been identified in linlinjava litemall up to 1.8.0. Affected is an unknown function of the component Admin Endpoint. Executing a manipulation ca… |
CVE-2026-8771 | High | 7.3 | 2026-05-18 | A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litemall-wx-api/src/main/java/org/linlinjava… |
CVE-2018-25339 | High | 8.2 | 2026-05-17 | Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database information using time-based bli… |
CVE-2018-25338 | High | 8.2 | 2026-05-17 | Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-ba… |
CVE-2018-25333 | High | 8.2 | 2026-05-17 | Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries… |
CVE-2018-25330 | High | 8.2 | 2026-05-17 | Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code throug… |
CVE-2018-25319 | High | 7.1 | 2026-05-17 | Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL cod… |
CVE-2026-8734 | High | 7.3 | 2026-05-17 | A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnector.makeVariable of the component queryL… |
CVE-2026-8724 | Medium | 4.7 | 2026-05-17 | A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component D… |
CVE-2021-47980 | High | 7.1 | 2026-05-16 | Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2021-47956 | High | 8.2 | 2026-05-16 | EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code th… |
CVE-2021-47954 | High | 8.2 | 2026-05-16 | LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the se… |
CVE-2020-37244 | High | 8.2 | 2026-05-16 | Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou… |
CVE-2020-37243 | High | 8.2 | 2026-05-16 | Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQ… |
CVE-2020-37242 | High | 8.2 | 2026-05-16 | Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2026-46364 | Critical | 9.8 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods t… |
CVE-2026-46359 | High | 7.5 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injec… |
CVE-2026-45800 | | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injecti… | |
CVE-2021-47966 | High | 8.2 | 2026-05-15 | PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that allows unauthentic… |
CVE-2026-7046 | Medium | 4.9 | 2026-05-15 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'table' parameter in all versi… |
CVE-2026-42847 | | 2026-05-14 | ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical SQL Injection (SQLi) vulnerability in ClipBucket, exploitabl… | |
CVE-2026-22599 | High | 7.2 | 2026-05-14 | Strapi is an open source headless content management system. In versions on the 4.x branch prior to 4.26.1 and on the 5.x branch prior to 5.33.2, a database-qu… |
CVE-2026-6638 | Low | 3.7 | 2026-05-14 | SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the… |
CVE-2026-6637 | High | 8.8 | 2026-05-14 | Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the dat… |
CVE-2026-6476 | High | 7.2 | 2026-05-14 | SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack take… |
CVE-2025-11024 | Critical | 9.8 | 2026-05-14 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce… |
CVE-2026-6225 | Medium | 6.5 | 2026-05-14 | The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'pro… |
CVE-2026-5486 | Medium | 6.5 | 2026-05-14 | The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX act… |
CVE-2026-46446 | High | 7.1 | 2026-05-14 | SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in chang… |
CVE-2026-46445 | High | 7.1 | 2026-05-14 | SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. |