CWE-89 · SQL Injection (page 23)
Page 23 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-29172 | High | 8.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpo… |
CVE-2026-3843 | Critical | 9.8 | 2026-03-10 | Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module… |
CVE-2026-30930 | Critical | 9.8 | 2026-03-10 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenatio… |
CVE-2026-26116 | High | 8.8 | 2026-03-10 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-56421 | High | 7.5 | 2026-03-10 | SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database. |
CVE-2025-49784 | Medium | 6.0 | 2026-03-10 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnaly… |
CVE-2026-27684 | Medium | 6.4 | 2026-03-10 | SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through… |
CVE-2026-3818 | High | 7.3 | 2026-03-09 | A flaw has been found in Tiandy Easy7 CMS Windows 7.17.0. Impacted is an unknown function of the file /Easy7/apps/WebService/GetDBData.jsp. This manipulation o… |
CVE-2025-40639 | Critical | 9.8 | 2026-03-09 | A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the '… |
CVE-2026-3806 | Medium | 6.3 | 2026-03-09 | A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php… |
CVE-2026-3793 | Medium | 6.3 | 2026-03-09 | A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file sales_invoice1.php of the… |
CVE-2026-3792 | Medium | 6.3 | 2026-03-09 | A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file purchase_invoice.php of the component GET… |
CVE-2026-3791 | Medium | 6.3 | 2026-03-09 | A vulnerability has been found in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file dashboard.php… |
CVE-2026-3790 | Medium | 6.3 | 2026-03-09 | A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file check_supplier_d… |
CVE-2026-3786 | Medium | 6.3 | 2026-03-08 | A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Re… |
CVE-2026-3785 | Medium | 6.3 | 2026-03-08 | A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of the component Request… |
CVE-2026-3771 | Medium | 6.3 | 2026-03-08 | A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. This vulnerability affects unknown code of the file /accomodation.php. S… |
CVE-2026-3767 | Medium | 6.3 | 2026-03-08 | A weakness has been identified in itsourcecode sanitize or validate this input 1.0. Affected is an unknown function of the file /admin/teacher-attendance.php… |
CVE-2026-3765 | High | 7.3 | 2026-03-08 | A vulnerability was identified in itsourcecode University Management System 1.0. This affects an unknown function of the file /att_single_view.php. Such manipu… |
CVE-2026-3760 | High | 7.3 | 2026-03-08 | A vulnerability was detected in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /view_result.php. Performing… |
CVE-2026-3759 | High | 7.3 | 2026-03-08 | A security vulnerability has been detected in projectworlds Online Art Gallery Shop 1.0. This affects an unknown part of the file /admin/adminHome.php. Such ma… |
CVE-2026-3758 | High | 7.3 | 2026-03-08 | A weakness has been identified in projectworlds Online Art Gallery Shop 1.0. Affected by this issue is some unknown functionality of the file /admin/adminHome… |
CVE-2026-3757 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in projectworlds Online Art Gallery Shop 1.0. Affected by this vulnerability is an unknown functionality of the file /?pass… |
CVE-2026-3756 | Medium | 6.3 | 2026-03-08 | A vulnerability was identified in SourceCodester Sales and Inventory System up to 1.0. Affected is an unknown function of the file /check_item_details.php. The… |
CVE-2026-3755 | Medium | 6.3 | 2026-03-08 | A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /check_customer_details.php of th… |
CVE-2026-3754 | Medium | 6.3 | 2026-03-08 | A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /add_stock.php. Performing a manipulat… |
CVE-2026-3753 | Medium | 6.3 | 2026-03-08 | A vulnerability has been found in SourceCodester Sales and Inventory System up to 1.0. The impacted element is an unknown function of the file /add_sales_print… |
CVE-2026-3752 | Medium | 4.7 | 2026-03-08 | A flaw has been found in SourceCodester Employee Task Management System up to 1.0. The affected element is an unknown function of the file /daily-task-report.p… |
CVE-2026-3751 | Medium | 4.7 | 2026-03-08 | A vulnerability was detected in SourceCodester Employee Task Management System 1.0. Impacted is an unknown function of the file /daily-attendance-report.php of… |
CVE-2026-3747 | High | 7.3 | 2026-03-08 | A vulnerability was identified in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /add_result.p… |
CVE-2026-3746 | High | 7.3 | 2026-03-08 | A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-3745 | Medium | 6.3 | 2026-03-08 | A vulnerability was found in code-projects Student Web Portal 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument Us… |
CVE-2026-3744 | High | 7.3 | 2026-03-08 | A vulnerability has been found in code-projects Student Web Portal 1.0. This impacts the function valreg_passwdation of the file signup.php. The manipulation o… |
CVE-2026-3740 | High | 7.3 | 2026-03-08 | A weakness has been identified in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_search_student.php. This ma… |
CVE-2026-3736 | High | 7.3 | 2026-03-08 | A vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0. Affected by this issue is some unknown functionality of the file SearchResu… |
CVE-2026-3735 | High | 7.3 | 2026-03-08 | A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-3730 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /hotel/admin/mod… |
CVE-2026-3723 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /Admindelete.php. Th… |
CVE-2026-3711 | Medium | 4.7 | 2026-03-08 | A vulnerability was detected in code-projects Simple Flight Ticket Booking System 1.0. Affected is an unknown function of the file /Adminupdate.php. The manipu… |
CVE-2026-3710 | Medium | 4.7 | 2026-03-08 | A security vulnerability has been detected in code-projects Simple Flight Ticket Booking System 1.0. This impacts an unknown function of the file /Adminadd.php… |
CVE-2026-3709 | High | 7.3 | 2026-03-08 | A weakness has been identified in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /register.php. Executing… |
CVE-2026-3708 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. The impacted element is an unknown function of the file /login.ph… |
CVE-2026-3705 | High | 7.3 | 2026-03-08 | A vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0. This issue affects some unknown processing of the file /Adminsearch.php. Th… |
CVE-2026-3672 | Medium | 6.3 | 2026-03-07 | A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/getDictItems. Such ma… |
CVE-2026-30860 | Critical | 9.9 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vul… |
CVE-2026-2429 | Medium | 4.9 | 2026-03-07 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_save_changes_venues` function in all vers… |
CVE-2025-14353 | High | 7.5 | 2026-03-07 | The ZIP Code Based Content Protection plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 via the 'zipcode' paramet… |
CVE-2018-25199 | High | 8.2 | 2026-03-06 | OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25197 | High | 8.2 | 2026-03-06 | PlayJoom 0.10.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code thro… |
CVE-2018-25196 | High | 8.2 | 2026-03-06 | ServerZilla 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2018-25192 | High | 8.2 | 2026-03-06 | GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through t… |
CVE-2018-25191 | High | 7.1 | 2026-03-06 | Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25189 | High | 8.2 | 2026-03-06 | Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arb… |
CVE-2018-25188 | High | 8.2 | 2026-03-06 | Webiness Inventory 2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious co… |
CVE-2018-25187 | High | 8.2 | 2026-03-06 | Tina4 Stack 1.0.3 contains multiple vulnerabilities allowing unauthenticated attackers to access sensitive database files and execute SQL injection attacks. At… |
CVE-2018-25182 | High | 8.2 | 2026-03-06 | Silurus Classifieds Script 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2018-25180 | High | 7.1 | 2026-03-06 | Maitra 1.7.2 contains an sql injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2018-25179 | High | 8.2 | 2026-03-06 | Gumbo CMS 0.99 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25175 | High | 8.2 | 2026-03-06 | Alienor Web Libre 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious cod… |
CVE-2018-25173 | High | 8.2 | 2026-03-06 | Rmedia SMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the… |
CVE-2018-25172 | High | 8.2 | 2026-03-06 | Pedidos 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25167 | High | 8.2 | 2026-03-06 | Net-Billetterie 2.9 contains an SQL injection vulnerability in the login parameter of login.inc.php that allows unauthenticated attackers to execute arbitrary… |
CVE-2018-25166 | High | 8.2 | 2026-03-06 | Meneame English Pligg 5.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2018-25165 | High | 7.1 | 2026-03-06 | Galaxy Forces MMORPG 0.5.8 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2018-25163 | High | 8.2 | 2026-03-06 | BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25161 | High | 8.2 | 2026-03-06 | Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injecting malicious code thr… |
CVE-2026-29073 | High | 8.8 | 2026-03-06 | SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not a… |
CVE-2026-28438 | Critical | 9.8 | 2026-03-06 | CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creatin… |
CVE-2026-28785 | Critical | 9.8 | 2026-03-06 | Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL comman… |
CVE-2026-27005 | Critical | 9.8 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unaut… |
CVE-2026-28501 | Critical | 9.8 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos… |
CVE-2026-3616 | Medium | 6.3 | 2026-03-06 | A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/custom… |
CVE-2026-29081 | Medium | 6.5 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafte… |
CVE-2026-28443 | Critical | 9.8 | 2026-03-05 | OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field pa… |
CVE-2026-28284 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilitie… |
CVE-2026-28210 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue… |
CVE-2026-2893 | Medium | 6.5 | 2026-03-05 | The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to… |
CVE-2026-28115 | Critical | 9.3 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Pay… |
CVE-2026-27428 | High | 8.5 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eagle-Themes Eagle Booking eagle-booking allows SQL Injec… |
CVE-2026-27373 | High | 8.5 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome tablesome allows Blind SQL Injection.Th… |
CVE-2025-69338 | Critical | 9.3 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injecti… |
CVE-2026-3523 | Medium | 4.9 | 2026-03-05 | The Apocalypse Meow plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 22.1.0. This is due to a… |
CVE-2026-20003 | Medium | 4.9 | 2026-03-04 | A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected syst… |
CVE-2026-20002 | High | 8.1 | 2026-03-04 | A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attac… |
CVE-2026-20001 | Medium | 6.5 | 2026-03-04 | A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected syst… |
CVE-2019-25507 | High | 8.2 | 2026-03-04 | Ashop Shopping Cart Software contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2019-25506 | High | 8.2 | 2026-03-04 | FreeSMS 2.1.2 contains a boolean-based blind SQL injection vulnerability in the password parameter that allows unauthenticated attackers to bypass authenticati… |
CVE-2019-25505 | High | 7.1 | 2026-03-04 | Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbo… |
CVE-2019-25504 | High | 8.2 | 2026-03-04 | NCrypted Jobgator contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25503 | High | 7.1 | 2026-03-04 | PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2019-25501 | High | 8.2 | 2026-03-04 | Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the app_… |
CVE-2019-25500 | High | 8.2 | 2026-03-04 | Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25499 | High | 8.2 | 2026-03-04 | Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25498 | High | 8.2 | 2026-03-04 | Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2025-66944 | Critical | 9.8 | 2026-03-04 | SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search… |
CVE-2025-66678 | Critical | 9.8 | 2026-03-04 | An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read a… |
CVE-2023-7337 | High | 7.5 | 2026-03-04 | The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie… |
CVE-2026-2363 | Medium | 6.5 | 2026-03-04 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'order_by' attribute of the [wpmem_user_membership_posts] shortcod… |
CVE-2026-1651 | Medium | 6.5 | 2026-03-04 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'workflow_ids' parameter in all versions up to, and includ… |
CVE-2026-3487 | Medium | 4.7 | 2026-03-03 | A vulnerability was found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/class-result.php. Perfor… |