CWE-89 · SQL Injection (page 25)
Page 25 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-37590 | Low | 2.7 | 2026-04-14 | SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php. |
CVE-2026-37589 | Low | 2.7 | 2026-04-14 | SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/maintenance/manage_storage_unit.php. |
CVE-2026-40315 | Critical | 9.8 | 2026-04-14 | PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vulnerability in SQLiteConversationStore where the table_prefix… |
CVE-2026-4352 | High | 7.5 | 2026-04-14 | The JetEngine plugin for WordPress is vulnerable to SQL Injection via the Custom Content Type (CCT) REST API search endpoint in all versions up to, and includi… |
CVE-2026-27681 | Critical | 9.9 | 2026-04-14 | Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL s… |
CVE-2026-32272 | | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injection vulnerability exists where the ProductQuery::hasVarian… | |
CVE-2026-32271 | | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, there is an SQL injection vulnerability in the… | |
CVE-2026-6202 | Medium | 6.3 | 2026-04-13 | A security flaw has been discovered in code-projects Easy Blog Site 1.0. This affects an unknown function of the file post.php. Performing a manipulation of th… |
CVE-2026-6193 | High | 7.3 | 2026-04-13 | A security flaw has been discovered in PHPGurukul Daily Expense Tracking System 1.1. Affected is an unknown function of the file /register.php. The manipulatio… |
CVE-2026-6191 | Medium | 6.3 | 2026-04-13 | A vulnerability was determined in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /equipments.php. Executing a ma… |
CVE-2026-6190 | Medium | 6.3 | 2026-04-13 | A vulnerability was found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /employees.php. Performin… |
CVE-2026-6189 | High | 7.3 | 2026-04-13 | A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?act… |
CVE-2026-36952 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the file /otas/admin/curriculum/manage_curriculum.php. |
CVE-2026-36950 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects_per_department.php. |
CVE-2026-36948 | High | 7.3 | 2026-04-13 | Sourcecodester Online Thesis Archiving System v1.0 is vulnerale to SQL injection in the file /otas/view_archive.php. |
CVE-2026-6188 | High | 7.3 | 2026-04-13 | A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=delete_sales. Thi… |
CVE-2026-6187 | High | 7.3 | 2026-04-13 | A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action… |
CVE-2026-36938 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/rooms/view_room.php. |
CVE-2026-36937 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php. |
CVE-2026-34186 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via custom fields. This issue affects Pandora FMS: from 7… |
CVE-2026-30813 | High | 8.8 | 2026-04-13 | Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via module search. This issue affects Pandora FMS: from 7… |
CVE-2026-6183 | High | 7.3 | 2026-04-13 | A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functionality of the file /we… |
CVE-2026-6182 | High | 7.3 | 2026-04-13 | A vulnerability was identified in code-projects Simple Content Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /w… |
CVE-2026-36945 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/clients/manage_client.php |
CVE-2026-36944 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerale to SQL injection in the file/rsms/admin/repairs/view_details.php. |
CVE-2026-36943 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/repairs/manage_repair.php. |
CVE-2026-36942 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in the file /orms/admin/activities/manage_activity.php. |
CVE-2026-36941 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL Injection in the file /orms/admin/rooms/manage_room.php. |
CVE-2026-36947 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL Injection in the file /rsms/admin/services/view_service.php. |
CVE-2026-36946 | Low | 2.7 | 2026-04-13 | Sourcecodester Computer and Mobile Repair Shop Management System v1.0 is vulnerable to SQL injection in the file /rsms/admin/inquiries/view_details.php. |
CVE-2026-36923 | Low | 2.7 | 2026-04-13 | Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php. |
CVE-2026-36922 | Low | 2.7 | 2026-04-13 | Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php. |
CVE-2026-36920 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions-view.php. |
CVE-2026-36919 | Low | 2.7 | 2026-04-13 | Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-update.php. |
CVE-2026-36874 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php. |
CVE-2026-36873 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php. |
CVE-2026-36872 | Low | 2.7 | 2026-04-13 | Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php. |
CVE-2026-6167 | High | 7.3 | 2026-04-13 | A vulnerability was detected in code-projects Faculty Management System 1.0. Impacted is an unknown function of the file /subject-print.php. The manipulation o… |
CVE-2026-6166 | High | 7.3 | 2026-04-13 | A security vulnerability has been detected in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /uti… |
CVE-2026-3830 | High | 8.6 | 2026-04-13 | The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing u… |
CVE-2025-15441 | Medium | 6.8 | 2026-04-13 | The Form Maker by 10Web WordPress plugin before 1.15.38 does not properly prepare SQL queries when the "MySQL Mapping" feature is in use, which could make SQL… |
CVE-2026-6165 | High | 7.3 | 2026-04-13 | A weakness has been identified in code-projects Vehicle Showroom Management System 1.0. This vulnerability affects unknown code of the file /util/Login_check.p… |
CVE-2026-6164 | High | 7.3 | 2026-04-13 | A security flaw has been discovered in code-projects Lost and Found Thing Management 1.0. This affects an unknown part of the file /addcat.php. Performing a ma… |
CVE-2026-6163 | High | 7.3 | 2026-04-13 | A vulnerability was identified in code-projects Lost and Found Thing Management 1.0. Affected by this issue is some unknown functionality of the file /catageor… |
CVE-2026-6161 | High | 7.3 | 2026-04-13 | A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoin… |
CVE-2026-6153 | High | 7.3 | 2026-04-13 | A vulnerability was identified in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /util/StaffDetailsFunction… |
CVE-2026-6152 | High | 7.3 | 2026-04-13 | A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This issue affects some unknown processing of the file /util/StaffAddin… |
CVE-2026-6151 | High | 7.3 | 2026-04-13 | A vulnerability was found in code-projects Vehicle Showroom Management System 1.0. This vulnerability affects unknown code of the file /util/PaymentStatusFunct… |
CVE-2026-6149 | High | 7.3 | 2026-04-13 | A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Affected by this issue is some unknown functionality of the file /util/BookVehic… |
CVE-2026-6148 | High | 7.3 | 2026-04-13 | A vulnerability was detected in code-projects Vehicle Showroom Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /u… |
CVE-2026-6142 | High | 7.3 | 2026-04-13 | A vulnerability was identified in tushar-2223 Hotel Management System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. Affected by this vulnerability is an unkn… |
CVE-2019-25713 | High | 7.1 | 2026-04-12 | MyT-PM 1.5.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2019-25710 | High | 8.2 | 2026-04-12 | Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary… |
CVE-2019-25707 | High | 7.1 | 2026-04-12 | eBrigade ERP 4.5 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2019-25703 | High | 7.1 | 2026-04-12 | ImpressCMS 1.3.11 contains a time-based blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL c… |
CVE-2019-25699 | High | 7.1 | 2026-04-12 | Newsbull Haber Script 1.0.0 contains multiple SQL injection vulnerabilities in the search parameter that allow authenticated attackers to extract database info… |
CVE-2019-25697 | High | 8.2 | 2026-04-12 | CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cat_… |
CVE-2019-25693 | High | 7.1 | 2026-04-12 | ResourceSpace 8.6 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code thro… |
CVE-2018-25257 | High | 7.1 | 2026-04-12 | Adianti Framework 5.5.0 and 5.6.0 contains an SQL injection vulnerability that allows authenticated users to manipulate database queries by injecting SQL code… |
CVE-2026-5207 | Medium | 6.5 | 2026-04-11 | The LifterLMS plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 9.2.1. This is due to insuffi… |
CVE-2026-36236 | Critical | 9.8 | 2026-04-10 | SourceCodester Engineers Online Portal v1.0 is vulnerable to SQL Injection in update_password.php via the new_password parameter. |
CVE-2026-36235 | Critical | 9.8 | 2026-04-10 | A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is tha… |
CVE-2026-36234 | Critical | 9.8 | 2026-04-10 | itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename' parameter. |
CVE-2026-36233 | Critical | 9.8 | 2026-04-10 | A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this iss… |
CVE-2026-36232 | Critical | 9.8 | 2026-04-10 | A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is t… |
CVE-2026-29861 | Critical | 9.8 | 2026-04-10 | PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php. |
CVE-2026-23780 | High | 8.8 | 2026-04-10 | An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated atta… |
CVE-2026-6038 | High | 7.3 | 2026-04-10 | A vulnerability was identified in code-projects Vehicle Showroom Management System 1.0. This impacts an unknown function of the file /util/RegisterCustomerFunc… |
CVE-2026-6037 | High | 7.3 | 2026-04-10 | A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This affects an unknown function of the file /util/AddVehicleFunction.p… |
CVE-2026-6036 | High | 7.3 | 2026-04-10 | A vulnerability was found in code-projects Vehicle Showroom Management System 1.0. The impacted element is an unknown function of the file /util/VehicleDetails… |
CVE-2026-6033 | Medium | 6.3 | 2026-04-10 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /updatedetailsfromstudent.php?eno=146891650. Exec… |
CVE-2026-6031 | High | 7.3 | 2026-04-10 | A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. This affects an unknown function of the file /add-category-function.php. Such m… |
CVE-2026-6030 | Medium | 6.3 | 2026-04-10 | A flaw has been found in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /del1.php. This manipulation… |
CVE-2026-6010 | Medium | 6.3 | 2026-04-10 | A security flaw has been discovered in CodeAstro Online Classroom 1.0/2.php. Affected by this vulnerability is an unknown functionality of the file /OnlineClas… |
CVE-2026-6007 | Medium | 6.3 | 2026-04-10 | A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /del.php. The manipulation of the ar… |
CVE-2026-6006 | Medium | 6.3 | 2026-04-10 | A vulnerability has been found in code-projects Patient Record Management System 1.0. The impacted element is an unknown function of the file /edit_hpatient.ph… |
CVE-2026-6005 | Medium | 6.3 | 2026-04-10 | A flaw has been found in code-projects Patient Record Management System 1.0. The affected element is an unknown function of the file /hematology_print.php. Exe… |
CVE-2026-6004 | High | 7.3 | 2026-04-10 | A vulnerability was detected in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /delete-category.php. Performing a ma… |
CVE-2026-5985 | High | 7.3 | 2026-04-09 | A security flaw has been discovered in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /crud.php. The man… |
CVE-2023-54359 | High | 8.2 | 2026-04-09 | WordPress adivaha Travel Plugin 2.3 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database querie… |
CVE-2026-5961 | High | 7.3 | 2026-04-09 | A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This vulnerability affects unknown code of the file /topic-details… |
CVE-2026-4112 | High | 7.2 | 2026-04-09 | Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attac… |
CVE-2026-34185 | High | 8.8 | 2026-04-09 | AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can injec… |
CVE-2026-5840 | Medium | 4.7 | 2026-04-09 | A security flaw has been discovered in PHPGurukul News Portal Project 4.1. Impacted is an unknown function of the file /admin/check_availability.php. Performin… |
CVE-2026-5839 | Medium | 4.7 | 2026-04-09 | A vulnerability was identified in PHPGurukul News Portal Project 4.1. This issue affects some unknown processing of the file /admin/add-subcategory.php. Such m… |
CVE-2026-5838 | Medium | 4.7 | 2026-04-09 | A vulnerability was determined in PHPGurukul News Portal Project 4.1. This vulnerability affects unknown code of the file /admin/add-subadmins.php. This manipu… |
CVE-2026-5837 | High | 7.3 | 2026-04-09 | A vulnerability was found in PHPGurukul News Portal Project 4.1. This affects an unknown part of the file /news-details.php. The manipulation of the argument C… |
CVE-2026-5829 | High | 7.3 | 2026-04-09 | A vulnerability was determined in code-projects Simple IT Discussion Forum 1.0. The impacted element is an unknown function of the file /pages/content.php. Thi… |
CVE-2026-5828 | High | 7.3 | 2026-04-09 | A vulnerability was found in code-projects Simple IT Discussion Forum 1.0. The affected element is an unknown function of the file /functions/addcomment.php. T… |
CVE-2026-5827 | High | 7.3 | 2026-04-09 | A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /question-function.php. The manipul… |
CVE-2026-5824 | High | 7.3 | 2026-04-09 | A security vulnerability has been detected in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /userchecklogin.php. Such manip… |
CVE-2026-5823 | Medium | 6.3 | 2026-04-09 | A weakness has been identified in itsourcecode Construction Management System 1.0. Affected by this issue is some unknown functionality of the file /borrowed_t… |
CVE-2026-5814 | High | 7.3 | 2026-04-09 | A security vulnerability has been detected in PHPGurukul Online Course Registration 3.1. This issue affects some unknown processing of the file /admin/check_av… |
CVE-2026-5813 | High | 7.3 | 2026-04-08 | A weakness has been identified in PHPGurukul Online Course Registration 3.1. This vulnerability affects unknown code of the file /check_availability.php. Execu… |
CVE-2026-5805 | High | 7.3 | 2026-04-08 | A weakness has been identified in code-projects Easy Blog Site up to 1.0. The impacted element is an unknown function of the file /users/contact_us.php. Execut… |
CVE-2026-33350 | High | 7.5 | 2026-04-08 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research… |
CVE-2026-3396 | High | 7.5 | 2026-04-08 | WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable to time-based SQL Injection via the 'post-author' parameter in all versions up to, and including… |
CVE-2026-1865 | Medium | 6.5 | 2026-04-08 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin… |
CVE-2026-39497 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 FOX woocommerce-currency-switcher allows Blind… |
CVE-2026-39496 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.Th… |