CWE-89 · SQL Injection (page 26)
Page 26 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25335 | High | 7.5 | 2026-02-12 | PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page. Attackers can bypass… |
CVE-2019-25325 | High | 8.2 | 2026-02-12 | Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by… |
CVE-2019-25320 | Medium | 6.5 | 2026-02-12 | E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating l… |
CVE-2019-25347 | High | 7.5 | 2026-02-12 | thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can i… |
CVE-2019-25346 | High | 7.5 | 2026-02-12 | TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter. Attackers can… |
CVE-2026-22821 | Medium | 4.9 | 2026-02-12 | mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4. |
CVE-2025-70981 | Critical | 9.8 | 2026-02-12 | CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter. |
CVE-2025-10969 | Critical | 9.8 | 2026-02-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Pack… |
CVE-2025-13431 | Medium | 6.5 | 2026-02-11 | The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and including, 5.3.1 due… |
CVE-2026-25993 | Critical | 9.8 | 2026-02-10 | EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derive… |
CVE-2026-25947 | High | 8.8 | 2026-02-10 | Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affec… |
CVE-2026-1602 | Medium | 6.5 | 2026-02-10 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-7636 | High | 8.8 | 2026-02-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc… |
CVE-2026-2094 | High | 8.8 | 2026-02-10 | Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and… |
CVE-2026-2093 | High | 7.5 | 2026-02-10 | Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database c… |
CVE-2026-25495 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-element… |
CVE-2025-6830 | Critical | 9.8 | 2026-02-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module… |
CVE-2026-2225 | High | 7.3 | 2026-02-09 | A flaw has been found in itsourcecode News Portal Project 1.0. This vulnerability affects unknown code of the file /admin/index.php of the component Administra… |
CVE-2026-2236 | High | 7.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database cont… |
CVE-2026-2235 | Medium | 6.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2026-2223 | High | 7.3 | 2026-02-09 | A security vulnerability has been detected in code-projects Online Reviewer System 1.0. Affected by this issue is some unknown functionality of the file /syste… |
CVE-2026-2221 | High | 7.3 | 2026-02-09 | A security flaw has been discovered in code-projects Online Reviewer System 1.0. Affected is an unknown function of the file /login/index.php of the component… |
CVE-2026-2220 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Reviewer System 1.0. This impacts an unknown function of the file /system/system/admins/assessments/pret… |
CVE-2026-2217 | High | 7.3 | 2026-02-09 | A vulnerability was found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. The mani… |
CVE-2026-2212 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /Administrator/PH… |
CVE-2026-2211 | High | 7.3 | 2026-02-09 | A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDeleteCategory.php… |
CVE-2026-2199 | High | 7.3 | 2026-02-09 | A security flaw has been discovered in code-projects Online Reviewer System 1.0. The impacted element is an unknown function of the file /reviewer/system/syste… |
CVE-2026-2198 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /system/system/admins/asses… |
CVE-2026-2197 | High | 7.3 | 2026-02-09 | A vulnerability was determined in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/admins/assessments/prete… |
CVE-2026-2196 | High | 7.3 | 2026-02-09 | A vulnerability was found in code-projects Online Reviewer System 1.0. This issue affects some unknown processing of the file /system/system/admins/assessments… |
CVE-2026-2195 | High | 7.3 | 2026-02-09 | A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /system/system/admins/assessmen… |
CVE-2026-2190 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. T… |
CVE-2026-2189 | High | 7.3 | 2026-02-08 | A vulnerability was identified in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/report/index.php. The manip… |
CVE-2026-2179 | Medium | 4.7 | 2026-02-08 | A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipul… |
CVE-2026-2176 | Medium | 6.3 | 2026-02-08 | A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unknown processing of the file index.py. Suc… |
CVE-2026-2173 | High | 7.3 | 2026-02-08 | A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file login.php. The… |
CVE-2026-2172 | High | 7.3 | 2026-02-08 | A vulnerability was determined in code-projects Online Application System for Admission 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-2171 | High | 7.3 | 2026-02-08 | A vulnerability was found in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php of the component Logi… |
CVE-2026-2166 | High | 7.3 | 2026-02-08 | A security vulnerability has been detected in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /login/index.ph… |
CVE-2026-2162 | Medium | 4.7 | 2026-02-08 | A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the a… |
CVE-2026-2161 | High | 7.3 | 2026-02-08 | A vulnerability was found in itsourcecode Directory Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/forget-passw… |
CVE-2026-2158 | High | 7.3 | 2026-02-08 | A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation o… |
CVE-2026-2136 | High | 7.3 | 2026-02-08 | A flaw has been found in projectworlds Online Food Ordering System 1.0. This affects an unknown function of the file /view-ticket.php. Executing a manipulation… |
CVE-2026-2134 | Medium | 4.7 | 2026-02-08 | A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/admin/man… |
CVE-2026-2132 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpda… |
CVE-2026-2122 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The m… |
CVE-2026-2117 | High | 7.3 | 2026-02-08 | A vulnerability was found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/edit_activity.php. Perf… |
CVE-2026-2116 | High | 7.3 | 2026-02-08 | A vulnerability has been found in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/edit_expenses.php. Such manipu… |
CVE-2026-2115 | High | 7.3 | 2026-02-07 | A flaw has been found in itsourcecode Society Management System 1.0. This issue affects some unknown processing of the file /admin/delete_expenses.php. This ma… |
CVE-2026-2114 | High | 7.3 | 2026-02-07 | A vulnerability was detected in itsourcecode Society Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_admin.php. The mani… |
CVE-2026-2090 | High | 7.3 | 2026-02-07 | A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admin/message/search.p… |
CVE-2026-2089 | High | 7.3 | 2026-02-07 | A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php… |
CVE-2026-2088 | High | 7.3 | 2026-02-07 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/accepted-appointment.php. Su… |
CVE-2026-2087 | High | 7.3 | 2026-02-07 | A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. This… |
CVE-2026-2083 | High | 7.3 | 2026-02-07 | A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.php. Performing a ma… |
CVE-2025-15477 | Medium | 6.5 | 2026-02-07 | The Bucketlister plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode `category` and `id` attributes in all versions up to, and inclu… |
CVE-2026-2073 | High | 7.3 | 2026-02-07 | A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/user/index.php. Executing a… |
CVE-2020-37163 | High | 8.2 | 2026-02-07 | QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the '_located' parameter in the find… |
CVE-2020-37154 | High | 7.1 | 2026-02-07 | eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries th… |
CVE-2020-37147 | High | 7.1 | 2026-02-07 | ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through… |
CVE-2020-37141 | High | 8.2 | 2026-02-07 | AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module's maildetail.php script through the 'id' parameter. Attackers can manipulate the… |
CVE-2026-25544 | Critical | 9.8 | 2026-02-06 | Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded… |
CVE-2026-24418 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based S… |
CVE-2026-24417 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Bl… |
CVE-2026-24416 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Bl… |
CVE-2025-69216 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability… |
CVE-2025-69214 | High | 8.8 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the… |
CVE-2026-2060 | High | 7.3 | 2026-02-06 | A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /si… |
CVE-2026-24419 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based S… |
CVE-2026-2059 | High | 7.3 | 2026-02-06 | A vulnerability has been found in SourceCodester Medical Center Portal Management System 1.0. Affected is an unknown function of the file /emp_edit1.php. Such… |
CVE-2026-2058 | High | 7.3 | 2026-02-06 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file /… |
CVE-2019-25303 | High | 7.1 | 2026-02-06 | TheJshen ContentManagementSystem 1.04 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET paramete… |
CVE-2019-25300 | High | 7.1 | 2026-02-06 | thejshen Globitek CMS 1.4 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter. Attackers… |
CVE-2019-25299 | High | 7.1 | 2026-02-06 | RimbaLinux AhadPOS 1.11 contains a SQL injection vulnerability in the 'alamatCustomer' parameter that allows attackers to manipulate database queries through c… |
CVE-2019-25298 | Critical | 9.1 | 2026-02-06 | html5_snmp 1.11 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through Router_ID and Router_IP parameters… |
CVE-2026-2057 | High | 7.3 | 2026-02-06 | A vulnerability was detected in SourceCodester Medical Center Portal Management System 1.0. This affects an unknown function of the file /login.php. The manipu… |
CVE-2026-2018 | High | 7.3 | 2026-02-06 | A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulati… |
CVE-2026-2014 | High | 7.3 | 2026-02-06 | A security flaw has been discovered in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /ramonsys/billing/index.php. Pe… |
CVE-2026-2013 | High | 7.3 | 2026-02-06 | A vulnerability was identified in itsourcecode Student Management System 1.0. This affects an unknown function of the file /ramonsys/soa/index.php. Such manipu… |
CVE-2026-2012 | High | 7.3 | 2026-02-06 | A vulnerability was determined in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /ramonsys/facultyloading/… |
CVE-2026-2011 | High | 7.3 | 2026-02-06 | A vulnerability was found in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /ramonsys/enrollment/controlle… |
CVE-2026-21643 | Critical | 9.8 | 2026-02-06 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthentic… |
CVE-2025-15325 | Medium | 6.3 | 2026-02-05 | Tanium addressed an improper input validation vulnerability in Discover. |
CVE-2020-37151 | High | 8.2 | 2026-02-05 | phpMyChat Plus 1.98 contains a SQL injection vulnerability in the deluser.php page through the pmc_username parameter that allows attackers to manipulate datab… |
CVE-2025-13379 | High | 8.6 | 2026-02-05 | IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2026-1517 | Medium | 4.7 | 2026-02-05 | A vulnerability was identified in iomad up to 5.0. Affected is an unknown function of the component Company Admin Block. Such manipulation leads to sql injecti… |
CVE-2025-10258 | Medium | 6.3 | 2026-02-05 | Infinera DNA is vulnerable to a time-based SQL injection vulnerability due to insufficient input validation, which may result in leaking of sensitive informati… |
CVE-2025-13192 | High | 8.2 | 2026-02-05 | The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Inject… |
CVE-2026-25514 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-25513 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-22044 | Medium | 6.5 | 2026-02-04 | GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has… |
CVE-2025-69215 | High | 8.8 | 2026-02-04 | OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, there is a SQL Injection vulnerability… |
CVE-2025-69213 | High | 8.8 | 2026-02-04 | OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists i… |
CVE-2025-5329 | Critical | 9.8 | 2026-02-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc. Delta Course Automation allows SQL… |
CVE-2026-1370 | Medium | 4.9 | 2026-02-04 | The SIBS woocommerce payment gateway plugin for WordPress is vulnerable to time-based SQL Injection via the ‘referencedId’ parameter in all versions up to, and… |
CVE-2026-0816 | Medium | 4.9 | 2026-02-04 | The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'delete_id' parameter in all versions up to, and includ… |
CVE-2025-15268 | High | 7.5 | 2026-02-04 | The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and inclu… |
CVE-2020-37089 | High | 8.2 | 2026-02-03 | School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET req… |
CVE-2020-37083 | High | 8.2 | 2026-02-03 | PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' pa… |
CVE-2020-37081 | High | 7.1 | 2026-02-03 | Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject m… |