CWE-89 · SQL Injection (page 26)
Page 26 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39496 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.Th… |
CVE-2026-39495 | High | 8.5 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-app… |
CVE-2026-39487 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ameliabooking Amelia ameliabooking allows Blind SQL Injec… |
CVE-2026-39486 | High | 8.5 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill Download Monitor download-monitor allows Blind S… |
CVE-2026-39479 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL In… |
CVE-2026-39475 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind… |
CVE-2026-39466 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Broken Link… |
CVE-2026-33088 | Critical | 9.8 | 2026-04-08 | Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement. |
CVE-2026-3781 | Medium | 5.4 | 2026-04-08 | The Attendance Manager plugin for WordPress is vulnerable to SQL Injection via the 'attmgr_off' parameter in all versions up to, and including, 0.6.2. This is… |
CVE-2026-24913 | High | 8.8 | 2026-04-08 | SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the database may be obtained… |
CVE-2026-39356 | High | 7.5 | 2026-04-07 | Drizzle is a modern TypeScript ORM. Prior to 0.45.2 and 1.0.0-beta.20, Drizzle ORM improperly escaped quoted SQL identifiers in its dialect-specific escapeName… |
CVE-2026-5736 | High | 7.3 | 2026-04-07 | A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java… |
CVE-2026-39343 | High | 7.2 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only access… |
CVE-2026-39342 | High | 8.8 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL inj… |
CVE-2026-39341 | High | 8.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, the application is vulnerable to time-based SQL injection due to an improper input valida… |
CVE-2026-39340 | High | 8.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in PropertyTypeEditor.php, part of the administratio… |
CVE-2026-39334 | High | 8.8 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsIndividual.php in Churc… |
CVE-2026-39330 | High | 8.8 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyAssign.php in ChurchCRM… |
CVE-2026-39329 | High | 8.8 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authentica… |
CVE-2026-39327 | High | 8.8 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /MemberRoleChange.php in ChurchC… |
CVE-2026-39326 | High | 8.8 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyTypeEditor.php in Churc… |
CVE-2026-39325 | High | 7.2 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsUser.php in ChurchCRM 7… |
CVE-2026-39319 | High | 8.8 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.ph… |
CVE-2026-39318 | High | 8.8 | 2026-04-07 | ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints `/GroupPropsFormRowOps.php`… |
CVE-2026-35614 | Critical | 9.8 | 2026-04-07 | Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.1… |
CVE-2026-23696 | Critical | 9.9 | 2026-04-07 | Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authent… |
CVE-2024-36058 | Critical | 9.8 | 2026-04-07 | The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the POST parameter bib_li… |
CVE-2026-5372 | Medium | 6.4 | 2026-04-07 | An issue that allowed a SQL injection attack vector related to saved queries (introduced in version 4.0.260123.0). This is an instance of CWE-89: Improper Neut… |
CVE-2026-4079 | Medium | 6.5 | 2026-04-07 | The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to… |
CVE-2026-5719 | Medium | 6.3 | 2026-04-07 | A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /borrowedtool.php. Executing a manipulat… |
CVE-2026-35395 | High | 8.8 | 2026-04-06 | WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerabil… |
CVE-2026-5681 | Medium | 6.3 | 2026-04-06 | A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Par… |
CVE-2026-35184 | Critical | 9.8 | 2026-04-06 | EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom an… |
CVE-2026-5675 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Para… |
CVE-2026-5672 | High | 7.3 | 2026-04-06 | A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category… |
CVE-2026-35470 | High | 8.8 | 2026-04-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to 2.10.2, confronta_righe.php files across different module… |
CVE-2026-5669 | High | 7.3 | 2026-04-06 | A vulnerability has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3f. This vulnerability affects unknown code o… |
CVE-2026-5665 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Logi… |
CVE-2026-34885 | High | 8.5 | 2026-04-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows SQL Injectio… |
CVE-2026-29047 | High | 7.2 | 2026-04-06 | GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user can perform a SQL injection via the lo… |
CVE-2026-26263 | High | 8.1 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based blind SQL injection exists in GLPI's Searc… |
CVE-2026-5660 | Medium | 6.3 | 2026-04-06 | A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /borrowed_equip.php… |
CVE-2026-5649 | Medium | 6.3 | 2026-04-06 | A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unknown processing of the file /enrollment… |
CVE-2026-5648 | High | 7.3 | 2026-04-06 | A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component… |
CVE-2026-5646 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in code-projects Easy Blog Site 1.0. Affected by this issue is some unknown functionality of the file login.php. The… |
CVE-2026-5645 | High | 7.3 | 2026-04-06 | A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the c… |
CVE-2026-5641 | Medium | 6.3 | 2026-04-06 | A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /admin/update-image1.php of… |
CVE-2026-5640 | Medium | 6.3 | 2026-04-06 | A vulnerability has been found in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /admin/update-image2.p… |
CVE-2026-5639 | Medium | 6.3 | 2026-04-06 | A flaw has been found in PHPGurukul Online Shopping Portal Project 2.1. Impacted is an unknown function of the file /admin/update-image3.php of the component P… |
CVE-2026-5637 | High | 7.3 | 2026-04-06 | A security vulnerability has been detected in projectworlds Car Rental System 1.0. This vulnerability affects unknown code of the file /message_admin.php of th… |
CVE-2026-5636 | Medium | 6.3 | 2026-04-06 | A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /cancelorder.php of the component Par… |
CVE-2026-5635 | Medium | 6.3 | 2026-04-06 | A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categor… |
CVE-2026-5634 | High | 7.3 | 2026-04-06 | A vulnerability was identified in projectworlds Car Rental Project 1.0. Affected by this vulnerability is an unknown functionality of the file /book_car.php of… |
CVE-2026-5620 | Medium | 6.3 | 2026-04-06 | A vulnerability has been found in itsourcecode Construction Management System 1.0. Affected is an unknown function of the file /borrowed_equip_report.php of th… |
CVE-2026-5606 | Medium | 6.3 | 2026-04-06 | A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. The affected element is an unknown function of the file /order-details.ph… |
CVE-2026-5596 | Medium | 6.3 | 2026-04-05 | A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools/sql/tool.py of the… |
CVE-2019-25704 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the filter_user_m… |
CVE-2019-25702 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_project pa… |
CVE-2019-25700 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the sort_directio… |
CVE-2019-25698 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_to_delete… |
CVE-2019-25696 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the language_tag… |
CVE-2019-25694 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2019-25692 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id_to_modify… |
CVE-2019-25690 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the mng_profile_i… |
CVE-2019-25688 | High | 8.2 | 2026-04-05 | Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2019-25684 | High | 8.2 | 2026-04-05 | OpenDocMan 1.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2019-25680 | High | 8.2 | 2026-04-05 | Advance Gift Shop Pro Script 2.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting… |
CVE-2019-25678 | High | 8.2 | 2026-04-05 | C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL comma… |
CVE-2019-25676 | High | 8.2 | 2026-04-05 | Ask Expert Script 3.0.5 contains cross-site scripting and SQL injection vulnerabilities that allow unauthenticated attackers to inject malicious code by manipu… |
CVE-2019-25675 | High | 8.2 | 2026-04-05 | eDirectory contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to bypass administrator authentication and disclose sensitive f… |
CVE-2019-25674 | High | 8.2 | 2026-04-05 | CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pos… |
CVE-2019-25672 | High | 8.2 | 2026-04-05 | PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the '… |
CVE-2019-25669 | High | 8.2 | 2026-04-05 | qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[]… |
CVE-2019-25668 | High | 8.2 | 2026-04-05 | News Website Script 2.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code th… |
CVE-2019-25664 | High | 7.1 | 2026-04-05 | SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attac… |
CVE-2019-25663 | High | 7.1 | 2026-04-05 | SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the par… |
CVE-2019-25662 | High | 8.2 | 2026-04-05 | ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code th… |
CVE-2026-5587 | Medium | 6.3 | 2026-04-05 | A vulnerability was identified in wbbeyourself MAC-SQL up to 31a9df5e0d520be4769be57a4b9022e5e34a14f4. This affects the function _execute_sql of the file core/… |
CVE-2026-5586 | Medium | 6.3 | 2026-04-05 | A vulnerability was determined in zhongyu09 openchatbi up to 0.2.1. The impacted element is an unknown function of the component Multi-stage Text2SQL Workflow… |
CVE-2026-5583 | Medium | 6.3 | 2026-04-05 | A security vulnerability has been detected in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /my-profile.php of the co… |
CVE-2026-5580 | Medium | 6.3 | 2026-04-05 | A vulnerability was identified in CodeAstro Online Classroom 1.0. Impacted is an unknown function of the file /OnlineClassroom/addvideos.php of the component P… |
CVE-2026-5579 | Medium | 6.3 | 2026-04-05 | A vulnerability was determined in CodeAstro Online Classroom 1.0. This issue affects some unknown processing of the file /OnlineClassroom/updatedetailsfromfacu… |
CVE-2026-5578 | Medium | 6.3 | 2026-04-05 | A vulnerability was found in CodeAstro Online Classroom 1.0. This vulnerability affects unknown code of the file /OnlineClassroom/addassessment.php of the comp… |
CVE-2026-5577 | High | 7.3 | 2026-04-05 | A vulnerability has been found in Song-Li cross_browser up to ca690f0fe6954fd9bcda36d071b68ed8682a786a. This affects an unknown part of the file flask/uniquema… |
CVE-2026-5575 | High | 7.3 | 2026-04-05 | A vulnerability was detected in SourceCodester/jkev Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file index… |
CVE-2026-5565 | High | 7.3 | 2026-04-05 | A security vulnerability has been detected in code-projects Simple Laundry System 1.0. Affected by this issue is some unknown functionality of the file /delmem… |
CVE-2026-5564 | High | 7.3 | 2026-04-05 | A weakness has been identified in code-projects Simple Laundry System 1.0. Affected by this vulnerability is an unknown functionality of the file /searchguest… |
CVE-2026-5563 | Medium | 6.3 | 2026-04-05 | A security flaw has been discovered in AutohomeCorp frostmourne up to 1.0. Affected is the function httpTest of the file /api/monitor-api/alarm/previewData of… |
CVE-2026-5560 | Medium | 6.3 | 2026-04-05 | A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /payment-method.php of the… |
CVE-2026-5558 | Medium | 6.3 | 2026-04-05 | A flaw has been found in PHPGurukul PHPGurukul Online Shopping Portal Project up to 2.1. Impacted is an unknown function of the file /pending-orders.php of the… |
CVE-2026-5555 | High | 7.3 | 2026-04-05 | A weakness has been identified in code-projects Concert Ticket Reservation System 1.0. This affects an unknown part of the file /ConcertTicketReservationSystem… |
CVE-2026-5554 | High | 7.3 | 2026-04-05 | A security flaw has been discovered in code-projects Concert Ticket Reservation System 1.0. Affected by this issue is some unknown functionality of the file /C… |
CVE-2026-5553 | Medium | 6.3 | 2026-04-05 | A vulnerability was identified in itsourcecode Online Cellphone System 1.0. Affected by this vulnerability is an unknown functionality of the file /cp/availabl… |
CVE-2026-5552 | Medium | 6.3 | 2026-04-05 | A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This issue affects some unknown processing of the file /sub-category.php of th… |
CVE-2026-5551 | High | 7.3 | 2026-04-05 | A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/login.p… |
CVE-2026-5543 | Medium | 6.3 | 2026-04-05 | A vulnerability was identified in PHPGurukul User Registration & Login and User Management System 3.3. The affected element is an unknown function of the file… |
CVE-2026-5540 | High | 7.3 | 2026-04-05 | A vulnerability has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modifymember.php of the compone… |
CVE-2026-5537 | Medium | 6.3 | 2026-04-05 | A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the file Apps/Index/Cont… |
CVE-2026-5534 | High | 7.3 | 2026-04-05 | A vulnerability was identified in itsourcecode Online Enrollment System 1.0. This affects an unknown function of the file /sms/user/index.php?view=edit&id=10 o… |
CVE-2026-34934 | Critical | 9.8 | 2026-04-03 | PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped t… |