CWE-89 · SQL Injection (page 24)
Page 24 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3486 | Medium | 4.7 | 2026-03-03 | A vulnerability has been found in itsourcecode College Management System 1.0. This vulnerability affects unknown code of the file /admin/student-fee.php. Such… |
CVE-2026-26892 | High | 7.2 | 2026-03-03 | Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage_carrier.php. |
CVE-2026-26891 | Low | 2.7 | 2026-03-03 | Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage_parcel_type.php. |
CVE-2026-26889 | Low | 2.7 | 2026-03-03 | Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_category.php. |
CVE-2026-26888 | Low | 2.7 | 2026-03-03 | Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_stock.php. |
CVE-2026-26887 | Low | 2.7 | 2026-03-03 | Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_supplier.php. |
CVE-2026-26890 | Low | 2.7 | 2026-03-03 | Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_product.php. |
CVE-2021-35484 | High | 8.2 | 2026-03-03 | Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/r… |
CVE-2026-26886 | Low | 2.7 | 2026-03-03 | Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /admin/services/manage_service.php. |
CVE-2026-26885 | Low | 2.7 | 2026-03-03 | Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /classes/Master.php?f=delete_service. |
CVE-2026-26884 | Low | 2.7 | 2026-03-03 | Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/admin/appointments/view_appointment.php. |
CVE-2026-26883 | Low | 2.7 | 2026-03-03 | Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/classes/Master.php?f=delete_appointment. |
CVE-2025-70821 | Critical | 9.8 | 2026-03-03 | renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component |
CVE-2026-1487 | Medium | 6.5 | 2026-03-03 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up… |
CVE-2026-26713 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php. |
CVE-2026-26712 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php. |
CVE-2026-26711 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php. |
CVE-2026-26710 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php. |
CVE-2026-26709 | Critical | 9.8 | 2026-03-02 | code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php. |
CVE-2025-48650 | High | 8.4 | 2026-03-02 | In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional exe… |
CVE-2026-3180 | High | 7.5 | 2026-03-02 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordE… |
CVE-2026-26707 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php. |
CVE-2026-26706 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php. |
CVE-2026-26705 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php. |
CVE-2026-26704 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php. |
CVE-2026-28399 | High | 8.8 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the D… |
CVE-2026-26708 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php. |
CVE-2026-26700 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php. |
CVE-2026-26701 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php. |
CVE-2026-26703 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/advance_search.php. |
CVE-2026-26702 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/myitem_reuse.php. |
CVE-2026-26696 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php. |
CVE-2026-26695 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php. |
CVE-2026-26694 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php. |
CVE-2025-50192 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. Thi… |
CVE-2025-50191 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes… |
CVE-2025-50190 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /in… |
CVE-2025-50189 | High | 8.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST… |
CVE-2025-50188 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET v… |
CVE-2026-26698 | Medium | 4.9 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php. |
CVE-2026-26697 | Medium | 4.9 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?teacherID=. |
CVE-2025-12462 | | 2026-03-02 | A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple… | |
CVE-2025-30062 | | 2026-03-02 | In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection. | |
CVE-2025-10350 | | 2026-03-02 | SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to… | |
CVE-2026-2584 | | 2026-03-02 | A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker (AV:N/PR:N) c… | |
CVE-2026-3413 | High | 7.3 | 2026-03-02 | A flaw has been found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /admin_single_student.php. This man… |
CVE-2026-3411 | High | 7.3 | 2026-03-02 | A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2026-3410 | High | 7.3 | 2026-03-02 | A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/che… |
CVE-2026-3406 | High | 7.3 | 2026-03-02 | A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the… |
CVE-2026-28562 | High | 8.2 | 2026-02-28 | wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitiz… |
CVE-2025-13673 | High | 7.5 | 2026-02-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to… |
CVE-2026-28516 | High | 8.8 | 2026-02-27 | openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php h… |
CVE-2026-27832 | High | 8.8 | 2026-02-27 | Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) v… |
CVE-2019-25497 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25496 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25495 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25494 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by inject… |
CVE-2019-25493 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'va… |
CVE-2019-25492 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt… |
CVE-2019-25491 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cat… |
CVE-2019-25490 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id'… |
CVE-2019-25489 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the host… |
CVE-2026-2751 | High | 8.3 | 2026-02-27 | Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dep… |
CVE-2025-15498 | | 2026-02-27 | Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass auth… | |
CVE-2025-11252 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm… |
CVE-2026-2831 | Medium | 4.9 | 2026-02-27 | The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient… |
CVE-2025-11251 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platf… |
CVE-2026-3292 | Medium | 6.3 | 2026-02-27 | A security vulnerability has been detected in jizhiCMS up to 2.5.6. Affected is the function findAll in the library frphp/lib/Model.php of the component Batch… |
CVE-2026-3287 | Medium | 6.3 | 2026-02-27 | A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/c… |
CVE-2026-28226 | Medium | 6.5 | 2026-02-26 | Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the Get… |
CVE-2026-3261 | High | 7.3 | 2026-02-26 | A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the component Setting H… |
CVE-2026-27149 | Medium | 6.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (`list_private_messages… |
CVE-2026-22206 | High | 8.8 | 2026-02-26 | SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulat… |
CVE-2026-1198 | | 2026-02-26 | SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker… | |
CVE-2026-28136 | High | 7.6 | 2026-02-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue… |
CVE-2026-26186 | High | 8.8 | 2026-02-26 | Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL… |
CVE-2026-27497 | High | 8.8 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify wo… |
CVE-2026-3200 | High | 7.3 | 2026-02-25 | A vulnerability was identified in z-9527 admin 1.0/2.0. The affected element is the function checkName/register/login/getUser/getUsers of the file /server/cont… |
CVE-2026-25746 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulner… |
CVE-2026-24908 | Critical | 9.9 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability… |
CVE-2026-23627 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability… |
CVE-2026-25554 | Medium | 6.5 | 2026-02-25 | OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() fun… |
CVE-2026-27847 | Critical | 9.8 | 2026-02-25 | Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known… |
CVE-2026-3118 | Medium | 6.5 | 2026-02-25 | A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQ… |
CVE-2026-2416 | High | 7.5 | 2026-02-25 | The Geo Mashup plugin for WordPress is vulnerable to SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.17. This is due to insuf… |
CVE-2026-3164 | High | 7.3 | 2026-02-25 | A vulnerability was found in itsourcecode News Portal Project 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulatio… |
CVE-2026-3153 | High | 7.3 | 2026-02-25 | A vulnerability has been found in itsourcecode Document Management System 1.0. Impacted is an unknown function of the file /register.php. Such manipulation of… |
CVE-2026-3152 | High | 7.3 | 2026-02-25 | A flaw has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/teacher-salary.php. This man… |
CVE-2026-3151 | High | 7.3 | 2026-02-25 | A vulnerability was detected in itsourcecode College Management System 1.0. This vulnerability affects unknown code of the file /login/login.php. The manipulat… |
CVE-2026-3150 | Medium | 6.3 | 2026-02-25 | A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php… |
CVE-2026-3149 | Medium | 6.3 | 2026-02-25 | A weakness has been identified in itsourcecode College Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/asign-sin… |
CVE-2026-3148 | High | 7.3 | 2026-02-25 | A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manip… |
CVE-2026-27747 | High | 8.8 | 2026-02-25 | The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelin… |
CVE-2026-27743 | Critical | 9.8 | 2026-02-25 | The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_suppri… |
CVE-2026-3135 | High | 7.3 | 2026-02-25 | A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This m… |
CVE-2026-3134 | High | 7.3 | 2026-02-25 | A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-cat… |
CVE-2026-3133 | High | 7.3 | 2026-02-25 | A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the compon… |
CVE-2026-21410 | Critical | 9.8 | 2026-02-24 | InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able… |
CVE-2026-3105 | High | 7.6 | 2026-02-24 | SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query co… |
CVE-2026-23980 | Medium | 6.5 | 2026-02-24 | Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read acc… |