CWE-89 · SQL Injection (page 22)
Page 22 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-29206 | High | 8.1 | 2026-05-13 | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled. |
CVE-2026-44447 | High | 8.8 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted… |
CVE-2026-44446 | High | 8.8 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through spe… |
CVE-2026-45054 | Medium | 4.9 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=orders&node=transactions) builds a raw ORD… |
CVE-2026-44418 | | 2026-05-13 | EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-su… | |
CVE-2026-44381 | Medium | 5.3 | 2026-05-13 | MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled orde… |
CVE-2026-39358 | High | 7.2 | 2026-05-13 | CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting paramet… |
CVE-2026-42550 | High | 8.8 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by con… |
CVE-2026-42031 | Critical | 9.8 | 2026-05-13 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_s… |
CVE-2026-0242 | | 2026-05-13 | A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. S… | |
CVE-2020-37226 | High | 7.1 | 2026-05-13 | Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL… |
CVE-2020-37224 | High | 7.1 | 2026-05-13 | Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL… |
CVE-2020-37218 | High | 8.2 | 2026-05-13 | Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries… |
CVE-2026-4608 | Medium | 6.5 | 2026-05-13 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to… |
CVE-2026-37429 | Medium | 6.5 | 2026-05-13 | qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. This vulnerability… |
CVE-2026-37428 | Medium | 6.5 | 2026-05-13 | qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. This vulnerability… |
CVE-2026-4798 | High | 7.5 | 2026-05-13 | The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1… |
CVE-2026-6929 | High | 7.5 | 2026-05-13 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'sortf' paramet… |
CVE-2026-7619 | Medium | 6.5 | 2026-05-13 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via th… |
CVE-2026-6888 | High | 7.2 | 2026-05-13 | Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, … |
CVE-2026-1250 | High | 7.5 | 2026-05-12 | The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameter in all versions up… |
CVE-2026-44864 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44863 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44862 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44861 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44860 | High | 7.2 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the AOS-8 and AOS-10 command-line interface and management prot… |
CVE-2026-44204 | Medium | 6.5 | 2026-05-12 | Shelf is a platform for tracking physical assets. From 1.12 to before 1.20.1, a SQL injection vulnerability in the sortBy query parameter on the /assets route… |
CVE-2026-25088 | Medium | 5.4 | 2026-05-12 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0… |
CVE-2025-53681 | High | 7.2 | 2026-05-12 | An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 throu… |
CVE-2026-34187 | Critical | 9.8 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph container parameter. This issue affects Pandora… |
CVE-2026-8111 | High | 8.8 | 2026-05-12 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to achieve remote code execution. |
CVE-2026-43937 | High | 8.8 | 2026-05-12 | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewri… |
CVE-2026-32687 | High | 7.8 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' mod… |
CVE-2026-27851 | High | 7.4 | 2026-05-12 | When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to b… |
CVE-2026-45218 | High | 7.7 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection… |
CVE-2026-45214 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows B… |
CVE-2026-45213 | High | 7.6 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injectio… |
CVE-2026-45211 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare al… |
CVE-2026-42742 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blin… |
CVE-2026-42741 | High | 8.5 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views – Display & Edit Ninja F… |
CVE-2026-41125 | Medium | 6.0 | 2026-05-12 | A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blueplanet 105 TL3 (All versions), bluepla… |
CVE-2025-6577 | Critical | 9.8 | 2026-05-12 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce… |
CVE-2026-5028 | Medium | 6.5 | 2026-05-12 | The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the `pp-get-articles` AJAX… |
CVE-2026-2993 | High | 7.5 | 2026-05-12 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient e… |
CVE-2026-40131 | Low | 3.4 | 2026-05-12 | SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user input without proper parameterization o… |
CVE-2026-34260 | Critical | 9.6 | 2026-05-12 | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements th… |
CVE-2026-38567 | Critical | 9.8 | 2026-05-11 | HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints. User-supplied input is concatenated directly into SQL queries without paramet… |
CVE-2026-36962 | High | 7.3 | 2026-05-11 | SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, an… |
CVE-2026-7815 | High | 8.8 | 2026-05-11 | SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_… |
CVE-2026-6093 | | 2026-05-11 | Corteza contains a SQL injection vulnerability in its Microsoft SQL Server (MSSQL) backend when filtering Compose records by the meta field.This issue affects… | |
CVE-2021-47941 | High | 8.2 | 2026-05-10 | WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inject… |
CVE-2021-47930 | High | 8.2 | 2026-05-10 | Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execu… |
CVE-2021-47928 | High | 8.2 | 2026-05-10 | Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting… |
CVE-2026-8231 | Medium | 6.3 | 2026-05-10 | A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulatio… |
CVE-2025-14179 | Critical | 9.8 | 2026-05-10 | In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes whe… |
CVE-2026-8207 | | 2026-05-09 | Gibbon versions before v30.0.01 are affected by an authenticated SQL Injection vulnerability by abusing the Tracking/graphing https://github.com/GibbonEdu/cor… | |
CVE-2026-42287 | | 2026-05-08 | Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allows attackers to exe… | |
CVE-2026-41889 | Critical | 9.8 | 2026-05-08 | pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted st… |
CVE-2026-37431 | Critical | 9.8 | 2026-05-08 | Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoi… |
CVE-2026-44337 | Medium | 6.3 | 2026-05-08 | PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations… |
CVE-2026-41496 | High | 8.1 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for CVE-2026-40315 added input validation… |
CVE-2026-4935 | High | 8.6 | 2026-05-08 | The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which coul… |
CVE-2023-46453 | Critical | 9.8 | 2026-05-08 | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid S… |
CVE-2024-33722 | Medium | 6.3 | 2026-05-08 | SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. |
CVE-2024-33288 | High | 7.3 | 2026-05-08 | Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page. |
CVE-2026-8133 | High | 7.3 | 2026-05-08 | A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of the file dzz/shares/… |
CVE-2026-8132 | High | 7.3 | 2026-05-08 | A weakness has been identified in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /login.php. This manipulation of the argum… |
CVE-2026-8131 | High | 7.3 | 2026-05-08 | A security flaw has been discovered in SourceCodester SUP Online Shopping 1.0. This impacts an unknown function of the file /admin/replymsg.php. The manipulati… |
CVE-2026-8130 | High | 7.3 | 2026-05-08 | A vulnerability was identified in SourceCodester SUP Online Shopping 1.0. This affects an unknown function of the file /admin/message.php. The manipulation of… |
CVE-2026-8129 | High | 7.3 | 2026-05-08 | A vulnerability was determined in SourceCodester SUP Online Shopping 1.0. The impacted element is an unknown function of the file wishlist.php. Executing a man… |
CVE-2026-42208 | Critical | 9.8 | 2026-05-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used duri… |
CVE-2026-8128 | High | 7.3 | 2026-05-08 | A vulnerability was found in SourceCodester SUP Online Shopping 1.0. The affected element is an unknown function of the file /admin/viewmsg.php. Performing a m… |
CVE-2026-8126 | High | 7.3 | 2026-05-08 | A flaw has been found in SourceCodester Comment System 1.0. This issue affects some unknown processing of the file post_comment.php. This manipulation of the a… |
CVE-2026-8125 | Medium | 6.3 | 2026-05-08 | A vulnerability was detected in code-projects Simple Chat System 1.0. This vulnerability affects unknown code of the file sendMessage.php. The manipulation of… |
CVE-2026-8114 | Medium | 6.3 | 2026-05-07 | A vulnerability was identified in JeecgBoot up to 3.9.1. Affected by this issue is some unknown functionality of the file /sys/dict/loadTreeData of the compone… |
CVE-2026-8098 | High | 7.3 | 2026-05-07 | A security vulnerability has been detected in code-projects Feedback System 1.0. Impacted is an unknown function of the file /admin/checklogin.php. Such manipu… |
CVE-2026-8097 | Medium | 6.3 | 2026-05-07 | A security flaw has been discovered in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /askquery.php. The manipulation of t… |
CVE-2026-8083 | High | 7.3 | 2026-05-07 | A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_user. The m… |
CVE-2026-44349 | | 2026-05-07 | Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 splits the user-sup… | |
CVE-2026-41422 | High | 8.3 | 2026-05-07 | Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were pass… |
CVE-2026-41490 | High | 8.3 | 2026-05-07 | Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster… |
CVE-2025-68060 | High | 7.6 | 2026-05-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMart Team Member allows Blind SQL Injection. This issu… |
CVE-2026-4348 | High | 7.5 | 2026-05-07 | The BetterDocs Pro plugin for WordPress is vulnerable to SQL Injection via the `get_current_letter_docs` and `docs_sort_by_letter` AJAX actions in all versions… |
CVE-2026-41641 | High | 7.2 | 2026-05-07 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the checkSQL() valida… |
CVE-2026-41143 | High | 8.8 | 2026-05-07 | YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManag… |
CVE-2026-41640 | High | 7.5 | 2026-05-07 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, the queryParentSQL()… |
CVE-2026-29090 | High | 8.8 | 2026-05-06 | ### Summary A SQL injection vulnerability exists in Rucio versions 1.30.0 and later before 35.8.5, 38.5.5, 39.4.2, and 40.1.1, in `FilterEngine.create_postgre… |
CVE-2026-29080 | High | 8.8 | 2026-05-06 | A SQL injection vulnerability in `FilterEngine.create_sqla_query()` allows any authenticated Rucio user to execute arbitrary SQL against the backend database t… |
CVE-2026-1719 | High | 7.5 | 2026-05-06 | The Gravity Bookings Premium plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.5.9 due to insufficient escaping on th… |
CVE-2026-44331 | High | 8.1 | 2026-05-05 | In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inj… |
CVE-2026-40331 | | 2026-05-05 | Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the… | |
CVE-2026-40330 | | 2026-05-05 | Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQ… | |
CVE-2026-40329 | | 2026-05-05 | Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within… | |
CVE-2026-33324 | High | 8.8 | 2026-05-05 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to… |
CVE-2026-38428 | Critical | 9.8 | 2026-05-05 | Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated i… |
CVE-2026-4304 | High | 7.5 | 2026-05-05 | The WeePie Cookie Allow plugin for WordPress is vulnerable to SQL Injection via the 'consent' parameter in all versions up to, and including, 3.4.11 due to ins… |
CVE-2026-3359 | High | 7.5 | 2026-05-05 | The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in ve… |
CVE-2026-40797 | Critical | 9.3 | 2026-05-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder LLC WebinarIgnition allows Blind SQL Injectio… |
CVE-2026-7822 | Medium | 6.3 | 2026-05-05 | A vulnerability was identified in itsourcecode Courier Management System 1.0. This impacts an unknown function of the file /print_pdets.php. The manipulation o… |
CVE-2026-3456 | High | 7.5 | 2026-05-05 | The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to SQL Injection via the 'attributekey' param… |