CWE-89 · SQL Injection (page 23)
Page 23 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35228 | High | 8.7 | 2026-05-05 | Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component: helper tool). The supported versions that is affected is… |
CVE-2026-5100 | High | 7.5 | 2026-05-05 | The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via the 'regions' parameter array keys in versions up to, and including, 4.4.5 due to i… |
CVE-2026-7783 | Medium | 6.3 | 2026-05-05 | A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. This vulnerability affects the function AbstractKanban::applySortQuery of the file application/serv… |
CVE-2026-42237 | High | 8.8 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the fix for GHSA-f3f2-mcxc-pwjx did not cover the Snowflake… |
CVE-2026-42233 | Critical | 9.8 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the Oracle Database node's select operation allow… |
CVE-2026-42229 | High | 8.8 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the SeaTable node's row:search and row:get operat… |
CVE-2026-42087 | Critical | 9.6 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From version 6.7.0 to before version 7… |
CVE-2026-7746 | Medium | 6.3 | 2026-05-04 | A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected is an unknown function of the file /product_expiry/… |
CVE-2026-7745 | Medium | 6.3 | 2026-05-04 | A vulnerability was determined in CodeAstro Online Classroom 1.0. This impacts an unknown function of the file /OnlineClassroom/facultydetails. This manipulati… |
CVE-2026-7744 | Medium | 6.3 | 2026-05-04 | A vulnerability was found in CodeAstro Online Classroom 1.0. This affects an unknown function of the file /OnlineClassroom/addnewstudent. The manipulation of t… |
CVE-2026-7743 | Medium | 6.3 | 2026-05-04 | A vulnerability has been found in CodeAstro Online Classroom 1.0. The impacted element is an unknown function of the file /OnlineClassroom/studentdetails. The… |
CVE-2026-7742 | Medium | 6.3 | 2026-05-04 | A flaw has been found in CodeAstro Online Classroom 1.0. The affected element is an unknown function of the file /OnlineClassroom/facultylogin. Executing a man… |
CVE-2026-7741 | Medium | 6.3 | 2026-05-04 | A vulnerability was detected in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/studentlogin. Performing a manipul… |
CVE-2026-7731 | Medium | 6.3 | 2026-05-04 | A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. The affected element is an unknown function of the file get_state.ph… |
CVE-2026-7727 | High | 7.3 | 2026-05-04 | A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to 8.3.9. This affects the function GetQueryMachineGridOnePage… |
CVE-2026-7716 | Medium | 6.3 | 2026-05-04 | A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Per… |
CVE-2026-7699 | Medium | 6.3 | 2026-05-03 | A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Affected by this issue is the function StrUtils.checkSqlInjection of the file StrUtils.java… |
CVE-2026-7697 | Medium | 4.7 | 2026-05-03 | A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected is an unknown function of the file /manager/card/cardhand_submit.php. Thi… |
CVE-2026-7695 | High | 7.3 | 2026-05-03 | A vulnerability has been found in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0. This affects an unknown function of th… |
CVE-2026-7694 | High | 7.3 | 2026-05-03 | A flaw has been found in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0. The impacted element is an unknown function of… |
CVE-2026-7688 | Medium | 5.0 | 2026-05-03 | A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class… |
CVE-2026-7678 | Medium | 6.3 | 2026-05-03 | A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io… |
CVE-2026-7672 | Medium | 6.3 | 2026-05-03 | A security vulnerability has been detected in youlaitech youlai-boot up to 2.21.1. This affects the function getUserList of the file src/main/java/com/youlai/b… |
CVE-2026-7670 | High | 7.3 | 2026-05-02 | A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. This manipulation of… |
CVE-2026-7632 | High | 7.3 | 2026-05-02 | A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This… |
CVE-2026-4062 | High | 7.5 | 2026-05-02 | The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'object_ids' and 'exclude_object_ids' parameters in all versions up to, a… |
CVE-2026-4061 | High | 7.5 | 2026-05-02 | The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and including, 1.13.18… |
CVE-2026-4060 | High | 7.5 | 2026-05-02 | The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is d… |
CVE-2026-7612 | Medium | 4.7 | 2026-05-02 | A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Executing a manipulat… |
CVE-2026-7489 | High | 8.8 | 2026-05-02 | CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and delet… |
CVE-2026-7649 | High | 7.5 | 2026-05-02 | The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to time-based blind SQL Inj… |
CVE-2026-6457 | Medium | 6.5 | 2026-05-02 | The Geo Mashup plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geo_mashup_null_fields' parameter in all versions up to, and inclu… |
CVE-2026-7592 | High | 7.3 | 2026-05-01 | A weakness has been identified in itsourcecode Courier Management System 1.0. This affects an unknown function of the file /edit_staff.php. Executing a manipul… |
CVE-2026-7591 | Medium | 6.3 | 2026-05-01 | A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the com… |
CVE-2026-42475 | Medium | 6.5 | 2026-05-01 | SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `on` array to the joinOn function in BuildHelper.php. |
CVE-2026-42474 | Medium | 6.5 | 2026-05-01 | SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php. |
CVE-2026-37505 | Medium | 4.9 | 2026-05-01 | SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directl… |
CVE-2026-7555 | High | 7.3 | 2026-05-01 | A vulnerability was identified in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/login.php. Such manipulation of… |
CVE-2026-7553 | Medium | 4.7 | 2026-05-01 | A vulnerability was found in code-projects Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit_exerci… |
CVE-2026-7550 | High | 7.3 | 2026-05-01 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=save_cus… |
CVE-2026-7549 | High | 7.3 | 2026-05-01 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=delete_customer… |
CVE-2026-7545 | High | 7.3 | 2026-05-01 | A weakness has been identified in SourceCodester Advanced School Management System 1.0. The affected element is an unknown function of the file commonControlle… |
CVE-2026-7506 | High | 7.3 | 2026-04-30 | A vulnerability has been found in SourceCodester Hotel Management System 1.0. This impacts an unknown function of the file /index.php/reservation/check. Such m… |
CVE-2026-7435 | High | 7.2 | 2026-04-30 | SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without… |
CVE-2026-3346 | Medium | 6.4 | 2026-04-30 | IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitra… |
CVE-2026-7447 | Medium | 6.3 | 2026-04-30 | A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/update_customer.php. T… |
CVE-2026-7410 | Medium | 6.3 | 2026-04-29 | A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=add_t… |
CVE-2026-7409 | Medium | 4.7 | 2026-04-29 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function save_user of the file /admin/ajax.php?action=save_user. Executi… |
CVE-2026-7408 | Medium | 4.7 | 2026-04-29 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this issue is the function save_menu of the file /admin/ajax.php?actio… |
CVE-2026-7407 | Medium | 4.7 | 2026-04-29 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function save_settings of the… |
CVE-2018-25300 | High | 8.2 | 2026-04-29 | XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL co… |
CVE-2026-7394 | Medium | 4.7 | 2026-04-29 | A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/vi… |
CVE-2026-7392 | Medium | 6.3 | 2026-04-29 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function delete_supplier of the file /ajax.php?actio… |
CVE-2026-7391 | Medium | 6.3 | 2026-04-29 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier of the file /ajax.php?action=save_supp… |
CVE-2026-7389 | High | 7.3 | 2026-04-29 | A security vulnerability has been detected in EyouCMS up to 1.7.9. The affected element is the function GetSortData of the file application/common.php. The man… |
CVE-2026-42646 | High | 7.6 | 2026-04-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Burge TaxoPress simple-tags allows Blind SQL Inject… |
CVE-2026-3325 | | 2026-04-29 | SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerabili… | |
CVE-2026-42167 | High | 8.1 | 2026-04-28 | mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an… |
CVE-2026-7293 | Medium | 4.7 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete_category of the file /admin/ajax.php?action=delete… |
CVE-2026-7290 | Medium | 6.3 | 2026-04-28 | A vulnerability was determined in JeecgBoot up to 3.9.1. Impacted is the function SqlInjectionUtil of the file jeecg-boot/jeecg-boot-base-core/src/main/java/or… |
CVE-2026-7283 | Medium | 4.7 | 2026-04-28 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function save_expired of the file /ajax.php?act… |
CVE-2026-7282 | Medium | 4.7 | 2026-04-28 | A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete_expired of the file /ajax.php?action… |
CVE-2026-7268 | Medium | 6.3 | 2026-04-28 | A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_… |
CVE-2026-7267 | Medium | 6.3 | 2026-04-28 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. This affects an unknown function of the file /view_prod.php. This manipulation of the arg… |
CVE-2026-7266 | Medium | 6.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. The impacted element is the function save_order of the file /admin/ajax.php?action… |
CVE-2026-7265 | Medium | 6.3 | 2026-04-28 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/inde… |
CVE-2026-7264 | Medium | 6.3 | 2026-04-28 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajax.php?action=get_c… |
CVE-2026-40978 | High | 8.8 | 2026-04-28 | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs. Affected versions… |
CVE-2026-7229 | Medium | 6.3 | 2026-04-28 | A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file /cims/modules/admin/reply.php of the co… |
CVE-2026-7228 | High | 7.3 | 2026-04-28 | A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_count of the file /admin/ajax.php?action=ge… |
CVE-2026-7227 | High | 7.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function Login of the file /admin/ajax.php?action=login. The manip… |
CVE-2026-7226 | High | 7.3 | 2026-04-28 | A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?a… |
CVE-2026-7225 | High | 7.3 | 2026-04-28 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function delete_menu of the file /admin/ajax.php?… |
CVE-2026-7224 | High | 7.3 | 2026-04-28 | A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_cart of the file /admin/ajax.php?action=de… |
CVE-2026-7206 | High | 7.3 | 2026-04-28 | A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/entry.py. Performing… |
CVE-2026-7199 | High | 7.3 | 2026-04-28 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-7196 | Medium | 6.3 | 2026-04-28 | A security vulnerability has been detected in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /guestdetails. Such manipulation of t… |
CVE-2026-7194 | High | 7.3 | 2026-04-27 | A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=save_pr… |
CVE-2024-46636 | Critical | 9.4 | 2026-04-27 | NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter |
CVE-2026-5394 | | 2026-04-27 | An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger un… | |
CVE-2026-7148 | Medium | 6.3 | 2026-04-27 | A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation of the argument fnam… |
CVE-2021-36438 | Medium | 6.5 | 2026-04-27 | SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php. |
CVE-2026-7143 | Medium | 6.3 | 2026-04-27 | A vulnerability was identified in 1000 Projects Portfolio Management System MCA up to 1.0. This affects an unknown function of the file /admin/block_status.php… |
CVE-2026-41462 | Critical | 9.8 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly co… |
CVE-2026-7131 | High | 7.3 | 2026-04-27 | A vulnerability has been found in code-projects Online Lot Reservation System up to 1.0. The impacted element is an unknown function of the file /loginuser.php… |
CVE-2026-7130 | High | 7.3 | 2026-04-27 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delet… |
CVE-2026-7128 | High | 7.3 | 2026-04-27 | A security vulnerability has been detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /a… |
CVE-2026-7127 | High | 7.3 | 2026-04-27 | A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=… |
CVE-2026-7126 | High | 7.3 | 2026-04-27 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save_c… |
CVE-2026-7118 | Medium | 6.3 | 2026-04-27 | A security vulnerability has been detected in code-projects Employee Management System 1.0. The affected element is an unknown function of the file 370project/… |
CVE-2026-7117 | Medium | 6.3 | 2026-04-27 | A weakness has been identified in code-projects Employee Management System 1.0. Impacted is an unknown function of the file 370project/approve.php. Executing a… |
CVE-2026-7115 | Medium | 6.3 | 2026-04-27 | A vulnerability was identified in code-projects Employee Management System 1.0. This vulnerability affects unknown code of the file 370project/delete.php. Such… |
CVE-2026-7114 | Medium | 6.3 | 2026-04-27 | A vulnerability was determined in code-projects Employee Management System 1.0. This affects an unknown part of the file 370project/edit.php. This manipulation… |
CVE-2026-22336 | Critical | 9.3 | 2026-04-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Directorist Booking allows SQL Injection.This issue affec… |
CVE-2026-7088 | High | 7.3 | 2026-04-27 | A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?act… |
CVE-2026-7087 | High | 7.3 | 2026-04-27 | A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=sav… |
CVE-2026-7083 | Medium | 4.7 | 2026-04-27 | A vulnerability has been found in likeadmin-likeshop likeadmin_php up to 1.9.6. Affected by this issue is the function queryResult of the file server\app\admin… |
CVE-2026-7077 | High | 7.3 | 2026-04-27 | A vulnerability was identified in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /edit_parcel.php. The man… |
CVE-2026-7076 | High | 7.3 | 2026-04-27 | A vulnerability was determined in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /edit_branch.php. Executing a manipul… |
CVE-2026-7075 | High | 7.3 | 2026-04-27 | A vulnerability was found in itsourcecode Construction Management System 1.0. This issue affects some unknown processing of the file /locations.php. Performing… |