CWE-89 · SQL Injection (page 25)
Page 25 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-23969 | Medium | 6.5 | 2026-02-24 | Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab a… |
CVE-2025-11165 | Critical | 9.9 | 2026-02-24 | A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class… |
CVE-2026-3069 | High | 7.3 | 2026-02-24 | A security vulnerability has been detected in itsourcecode Document Management System 1.0. Affected is an unknown function of the file /edtlbls.php. The manipu… |
CVE-2026-3068 | High | 7.3 | 2026-02-24 | A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulat… |
CVE-2026-27461 | Medium | 4.9 | 2026-02-24 | Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the depend… |
CVE-2026-3057 | Medium | 6.3 | 2026-02-24 | A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model… |
CVE-2026-26198 | Critical | 9.8 | 2026-02-24 | Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user… |
CVE-2026-3046 | High | 7.3 | 2026-02-24 | A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of… |
CVE-2026-3042 | High | 7.3 | 2026-02-24 | A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing… |
CVE-2025-41002 | | 2026-02-23 | SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by s… | |
CVE-2026-1367 | High | 8.3 | 2026-02-23 | Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option. |
CVE-2026-24494 | Critical | 9.8 | 2026-02-23 | SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to acce… |
CVE-2026-2963 | Medium | 6.3 | 2026-02-23 | A vulnerability was determined in Jinher OA C6 up to 20260210. This issue affects some unknown processing of the file /C6/Jhsoft.Web.officesupply/OfficeSupplyT… |
CVE-2019-25462 | High | 8.2 | 2026-02-22 | Web Ofisi Rent a Car v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thro… |
CVE-2019-25461 | High | 7.5 | 2026-02-22 | Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL c… |
CVE-2019-25460 | High | 7.5 | 2026-02-22 | Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL c… |
CVE-2019-25459 | Critical | 9.8 | 2026-02-22 | Web Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through… |
CVE-2019-25458 | Critical | 9.8 | 2026-02-22 | Web Ofisi Firma Rehberi v1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code t… |
CVE-2019-25457 | High | 7.5 | 2026-02-22 | Web Ofisi Firma v13 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2019-25456 | Critical | 9.1 | 2026-02-22 | Web Ofisi Emlak v2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2019-25455 | High | 7.5 | 2026-02-22 | Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code throu… |
CVE-2019-25452 | High | 7.5 | 2026-02-22 | Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers… |
CVE-2019-25450 | High | 7.5 | 2026-02-22 | Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2019-25446 | High | 8.2 | 2026-02-22 | DIGIT CENTRIS ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25443 | High | 8.2 | 2026-02-22 | Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET… |
CVE-2019-25442 | High | 7.5 | 2026-02-22 | Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2019-25440 | High | 8.2 | 2026-02-22 | WebIncorp ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pr… |
CVE-2019-25439 | High | 8.2 | 2026-02-22 | NoviSmart CMS contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the Ref… |
CVE-2019-25433 | High | 8.2 | 2026-02-22 | XOOPS CMS 2.5.9 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2019-25391 | High | 8.2 | 2026-02-22 | Ashop Shopping Cart Software contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through the blacklist… |
CVE-2019-25366 | High | 8.2 | 2026-02-22 | microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2026-2912 | High | 7.3 | 2026-02-22 | A vulnerability was found in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/students/assessments/results/… |
CVE-2026-2867 | High | 7.3 | 2026-02-21 | A vulnerability was determined in itsourcecode Vehicle Management System 1.0. Affected is an unknown function of the file /billaction.php. Executing a manipula… |
CVE-2026-2865 | High | 7.3 | 2026-02-21 | A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of… |
CVE-2026-27470 | High | 8.8 | 2026-02-21 | ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-o… |
CVE-2019-25438 | High | 7.5 | 2026-02-20 | LabCollector 5.423 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting maliciou… |
CVE-2019-25432 | High | 7.5 | 2026-02-20 | Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication paramete… |
CVE-2019-25431 | High | 8.2 | 2026-02-20 | delpino73 Blue-Smiley-Organizer 1.32 contains an SQL injection vulnerability in the datetime parameter that allows unauthenticated attackers to manipulate data… |
CVE-2019-25444 | Critical | 9.1 | 2026-02-20 | Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code th… |
CVE-2026-2848 | High | 7.3 | 2026-02-20 | A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/… |
CVE-2026-26745 | Medium | 5.3 | 2026-02-20 | OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially… |
CVE-2026-24959 | High | 8.5 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL I… |
CVE-2026-24956 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-eleme… |
CVE-2025-69366 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Inj… |
CVE-2025-69365 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injec… |
CVE-2025-69337 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Wolmart Core wolmart-core allows Blind SQL Inj… |
CVE-2025-69310 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Inj… |
CVE-2025-69309 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind S… |
CVE-2025-69308 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL… |
CVE-2025-69307 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL I… |
CVE-2025-69306 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL I… |
CVE-2025-69305 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injec… |
CVE-2025-69304 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Allmart allmart-core allows Blind SQL Inject… |
CVE-2025-69295 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core allows Blind SQL Injec… |
CVE-2025-67987 | High | 8.5 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-ne… |
CVE-2025-10970 | Critical | 9.8 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kolay Software Inc. Talentics allows Blind SQL Injection… |
CVE-2026-2822 | Medium | 6.3 | 2026-02-20 | A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag… |
CVE-2026-2821 | High | 7.3 | 2026-02-20 | A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Contro… |
CVE-2026-2820 | High | 7.3 | 2026-02-20 | A security flaw has been discovered in Fujian Smart Integrated Management Platform System up to 7.5. This issue affects some unknown processing of the file /Mo… |
CVE-2026-26990 | High | 8.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in… |
CVE-2026-26988 | Critical | 9.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_tab… |
CVE-2026-26980 | Critical | 9.4 | 2026-02-20 | Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This… |
CVE-2026-2435 | Medium | 6.3 | 2026-02-20 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2026-2409 | | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue… | |
CVE-2026-2232 | High | 7.5 | 2026-02-19 | The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versio… |
CVE-2026-1581 | High | 7.5 | 2026-02-19 | The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to i… |
CVE-2025-15560 | High | 8.8 | 2026-02-19 | An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Fireb… |
CVE-2026-25418 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issu… |
CVE-2026-25378 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows B… |
CVE-2026-23805 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced media-search-enhanced a… |
CVE-2026-2706 | Medium | 6.3 | 2026-02-19 | A flaw has been found in code-projects Patient Record Management System 1.0. This affects an unknown function of the file /fecalysis_not.php. This manipulation… |
CVE-2026-2691 | High | 7.3 | 2026-02-19 | A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_regi… |
CVE-2026-2690 | High | 7.3 | 2026-02-19 | A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?actio… |
CVE-2026-2689 | High | 7.3 | 2026-02-19 | A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulati… |
CVE-2026-0722 | Medium | 6.5 | 2026-02-19 | The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is due to the plugin al… |
CVE-2025-12707 | High | 7.5 | 2026-02-19 | The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3.2.1 due to in… |
CVE-2025-15585 | | 2026-02-19 | Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation req… | |
CVE-2026-2682 | Medium | 6.3 | 2026-02-18 | A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/Publi… |
CVE-2025-12812 | | 2026-02-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Privileged Access Service. Remediation… | |
CVE-2026-27179 | High | 8.2 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly… |
CVE-2026-2663 | Medium | 6.3 | 2026-02-18 | A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /frontend-api/system… |
CVE-2025-70152 | Critical | 9.8 | 2026-02-18 | code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /ad… |
CVE-2025-70149 | Critical | 9.8 | 2026-02-18 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter. |
CVE-2025-59920 | | 2026-02-18 | When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in… | |
CVE-2026-1317 | Medium | 6.5 | 2026-02-18 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is… |
CVE-2025-8781 | Medium | 4.9 | 2026-02-18 | The Bookster – WordPress Appointment Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘raw’ parameter in all versions up to, and incl… |
CVE-2026-2495 | High | 7.5 | 2026-02-18 | The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parame… |
CVE-2026-1639 | Medium | 6.5 | 2026-02-18 | The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort… |
CVE-2026-2576 | High | 7.5 | 2026-02-18 | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' paramet… |
CVE-2026-2621 | High | 7.3 | 2026-02-17 | A security vulnerability has been detected in Sciyon Koyuan Thermoelectricity Heat Network Management System 3.0. This affects an unknown part of the file /SIS… |
CVE-2026-2620 | High | 7.3 | 2026-02-17 | A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManag… |
CVE-2025-67102 | High | 7.6 | 2026-02-17 | A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the enti… |
CVE-2024-55270 | High | 8.8 | 2026-02-17 | phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. |
CVE-2025-70397 | High | 7.2 | 2026-02-17 | jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter. |
CVE-2026-2247 | | 2026-02-17 | SQL injection vulnerability (SQLi) in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker ex… | |
CVE-2025-7631 | High | 8.6 | 2026-02-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tumeva Internet Technologies Software Information Adverti… |
CVE-2026-2553 | Medium | 6.3 | 2026-02-16 | A security flaw has been discovered in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. This affects an unknown part of the… |
CVE-2026-1258 | Medium | 4.9 | 2026-02-14 | The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' AP… |
CVE-2026-2024 | High | 7.5 | 2026-02-14 | The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 0.4.1 due to insuff… |
CVE-2025-69633 | Critical | 9.8 | 2026-02-13 | A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows r… |