CWE-89 · SQL Injection (page 27)
Page 27 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34788 | Medium | 6.5 | 2026-04-03 | Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168… |
CVE-2026-34612 | Critical | 9.9 | 2026-04-03 | Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vuln… |
CVE-2026-27885 | High | 7.2 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the A… |
CVE-2026-27834 | High | 7.2 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Serv… |
CVE-2026-27634 | Critical | 9.8 | 2026-04-03 | Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_avai… |
CVE-2026-25773 | High | 8.1 | 2026-04-03 | ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering cat… |
CVE-2026-34825 | Medium | 6.5 | 2026-04-02 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workf… |
CVE-2026-5368 | High | 7.3 | 2026-04-02 | A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Par… |
CVE-2026-34717 | Critical | 9.9 | 2026-04-02 | OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177… |
CVE-2026-5334 | High | 7.3 | 2026-04-02 | A weakness has been identified in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view=edit&id=3 o… |
CVE-2026-35168 | High | 8.8 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in Ope… |
CVE-2026-28805 | High | 8.8 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAM… |
CVE-2026-5328 | Medium | 6.3 | 2026-04-02 | A weakness has been identified in shsuishang modulithshop up to 829bac71f507e84684c782b9b062b8bf3b5585d6. The impacted element is the function listItem of the… |
CVE-2026-33616 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of s… |
CVE-2026-33615 | Critical | 9.1 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special… |
CVE-2026-33614 | High | 7.5 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special… |
CVE-2026-5322 | High | 7.3 | 2026-04-02 | A vulnerability has been found in AlejandroArciniegas mcp-data-vis bc597e391f184d2187062fd567599a3cb72adf51/de5a51525a69822290eaee569a1ab447b490746d. This affe… |
CVE-2026-34747 | High | 8.5 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker… |
CVE-2026-34455 | High | 8.8 | 2026-04-01 | Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes p… |
CVE-2026-30273 | High | 7.3 | 2026-04-01 | pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component. |
CVE-2026-21630 | High | 8.8 | 2026-04-01 | Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint. |
CVE-2026-5257 | High | 7.3 | 2026-04-01 | A vulnerability has been found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /delstaffinfo.php of the comp… |
CVE-2026-5256 | High | 7.3 | 2026-04-01 | A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modify.php of the component Parameter Ha… |
CVE-2025-13855 | High | 7.6 | 2026-04-01 | IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements… |
CVE-2026-5238 | High | 7.3 | 2026-04-01 | A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /view_employee.p… |
CVE-2026-4668 | Medium | 6.5 | 2026-04-01 | The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the `sort` parameter in the payments listing… |
CVE-2026-5237 | High | 7.3 | 2026-03-31 | A security flaw has been discovered in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /mana… |
CVE-2026-34400 | Critical | 9.8 | 2026-03-31 | Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which buil… |
CVE-2026-5206 | Medium | 6.3 | 2026-03-31 | A security vulnerability has been detected in code-projects Simple Gym Management System 1.0. This vulnerability affects unknown code of the component Payment… |
CVE-2026-30520 | Medium | 5.4 | 2026-03-31 | A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the s… |
CVE-2026-34220 | Critical | 9.8 | 2026-03-31 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injec… |
CVE-2026-5198 | High | 7.3 | 2026-03-31 | A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the… |
CVE-2026-5197 | Medium | 6.3 | 2026-03-31 | A vulnerability was found in code-projects Student Membership System 1.0. The affected element is an unknown function of the file /delete_user.php. The manipul… |
CVE-2026-4317 | | 2026-03-31 | SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to… | |
CVE-2026-5196 | Medium | 6.3 | 2026-03-31 | A vulnerability has been found in code-projects Student Membership System 1.0. Impacted is an unknown function of the file /delete_member.php. The manipulation… |
CVE-2026-5195 | High | 7.3 | 2026-03-31 | A flaw has been found in code-projects Student Membership System 1.0. This issue affects some unknown processing of the component User Registration Handler. Ex… |
CVE-2026-5182 | High | 7.3 | 2026-03-31 | A vulnerability was found in SourceCodester Teacher Record System 1.0. Impacted is an unknown function of the file Teacher Record System of the component Param… |
CVE-2026-5180 | High | 7.3 | 2026-03-31 | A flaw has been found in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=login… |
CVE-2026-5179 | High | 7.3 | 2026-03-31 | A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This affects an unknown part of the file /admin/login.php. The manipulati… |
CVE-2026-32714 | Critical | 9.8 | 2026-03-31 | SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection be… |
CVE-2026-27697 | Critical | 9.8 | 2026-03-31 | baserCMS is a website development framework. Prior to version 5.2.3, baserCMS has a SQL injection vulnerability in blog posts. This issue has been patched in v… |
CVE-2026-5150 | High | 7.3 | 2026-03-30 | A security vulnerability has been detected in code-projects Accounting System 1.0. This issue affects some unknown processing of the file /viewin_costumer.php… |
CVE-2026-5148 | Medium | 4.7 | 2026-03-30 | A weakness has been identified in YunaiV yudao-cloud up to 2026.01. This vulnerability affects unknown code of the file /admin-api/system/mail-log/page. This m… |
CVE-2026-31799 | Medium | 4.9 | 2026-03-30 | Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after"… |
CVE-2026-5147 | High | 7.3 | 2026-03-30 | A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The… |
CVE-2026-33643 | High | 7.4 | 2026-03-30 | SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the mysqlColumnAsInsert function in file plugins/mysql/lib/column.go. |
CVE-2026-29953 | High | 7.4 | 2026-03-30 | SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert function in file plugins/postgres/lib/column.go. |
CVE-2026-5035 | High | 7.3 | 2026-03-29 | A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown part of the file /view_work.php of the component Parameter Handl… |
CVE-2026-5034 | High | 7.3 | 2026-03-29 | A flaw has been found in code-projects Accounting System 1.0. Affected by this issue is some unknown functionality of the file /edit_costumer.php of the compon… |
CVE-2026-5033 | High | 7.3 | 2026-03-29 | A vulnerability was detected in code-projects Accounting System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_costumer.php… |
CVE-2026-5019 | High | 7.3 | 2026-03-29 | A security vulnerability has been detected in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2026-5018 | High | 7.3 | 2026-03-28 | A weakness has been identified in code-projects Simple Food Order System 1.0. Affected is an unknown function of the file register-router.php of the component… |
CVE-2026-5017 | High | 7.3 | 2026-03-28 | A security flaw has been discovered in code-projects Simple Food Order System 1.0. This impacts an unknown function of the file /all-tickets.php of the compone… |
CVE-2026-4996 | High | 7.3 | 2026-03-28 | A vulnerability was identified in Sinaptik AI PandasAI up to 0.1.4. Affected by this issue is the function delete_question_and_answers/delete_docs/update_quest… |
CVE-2026-33991 | High | 8.8 | 2026-03-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php` uses `extract($_REQUEST)` on line 14… |
CVE-2026-4970 | Medium | 6.3 | 2026-03-27 | A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file delete_photos.php of the componen… |
CVE-2026-34386 | High | 8.8 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configuration allows an authen… |
CVE-2026-34385 | High | 8.1 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline cou… |
CVE-2026-34374 | Critical | 9.1 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpola… |
CVE-2026-4966 | Medium | 6.3 | 2026-03-27 | A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /admin/mod_room/index.php?view=edit. Execu… |
CVE-2026-33770 | Critical | 9.8 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method in `objects/category.php` constructs a… |
CVE-2026-33767 | High | 8.8 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like.php`, the `getLike()` method constructs a SQL query using… |
CVE-2026-30534 | High | 8.3 | 2026-03-27 | A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/manage_category.php via the "id" parameter. |
CVE-2026-30533 | Critical | 9.8 | 2026-03-27 | A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage_product.php file via the "id" parameter. |
CVE-2026-30532 | Critical | 9.8 | 2026-03-27 | A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view_product.php file via the "id" parameter. |
CVE-2026-30531 | High | 8.8 | 2026-03-27 | A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_category action). The ap… |
CVE-2026-30530 | Critical | 9.8 | 2026-03-27 | A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_customer action). The ap… |
CVE-2026-30529 | High | 8.8 | 2026-03-27 | A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifically the save_user action). The applic… |
CVE-2026-4956 | High | 7.3 | 2026-03-27 | A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. The affected element is an unknown function of the file /DevicePrint.do?Act… |
CVE-2026-4955 | High | 7.3 | 2026-03-27 | A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. This impacts an unknown function of the file /OperateStatistic.do. The manipul… |
CVE-2026-4954 | Medium | 6.3 | 2026-03-27 | A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.ja… |
CVE-2026-33755 | High | 8.8 | 2026-03-27 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, and 26.0.17, an authenticated SQL Inject… |
CVE-2026-27876 | Critical | 9.1 | 2026-03-27 | A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature i… |
CVE-2026-24031 | High | 7.7 | 2026-03-27 | Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user… |
CVE-2026-22743 | High | 7.5 | 2026-03-27 | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpressionConverter. When a user-controlled string is passed as… |
CVE-2026-4910 | High | 7.3 | 2026-03-27 | A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. Affected is an unknown function of the file /RemoteForm… |
CVE-2026-4908 | High | 7.3 | 2026-03-27 | A security flaw has been discovered in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /modstaffinfo.php of the component… |
CVE-2026-33545 | Medium | 5.3 | 2026-03-26 | MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) us… |
CVE-2026-33531 | Medium | 6.5 | 2026-03-26 | InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-le… |
CVE-2026-33505 | High | 7.2 | 2026-03-26 | Ory Keto is am open source authorization server for managing permissions at scale. Prior to version 26.2.0, the GetRelationships API in Ory Keto is vulnerable… |
CVE-2026-33153 | Medium | 6.5 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the Recipe API endpoint expose… |
CVE-2026-30463 | High | 7.7 | 2026-03-26 | Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component. |
CVE-2026-33504 | High | 7.2 | 2026-03-26 | Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider. Prior to version 26.2.0, the listOAuth2Clients, listOAuth2ConsentSessions, and listTrustedOAuth2J… |
CVE-2026-33503 | High | 7.2 | 2026-03-26 | Ory Kratos is an identity, user management and authentication system for cloud services. Prior to version 26.2.0, the ListCourierMessages Admin API in Ory Krat… |
CVE-2026-33468 | High | 8.1 | 2026-03-26 | Kysely is a type-safe TypeScript SQL query builder. Prior to version 0.28.14, Kysely's `DefaultQueryCompiler.sanitizeStringLiteral()` only escapes single quote… |
CVE-2026-33442 | High | 8.1 | 2026-03-26 | Kysely is a type-safe TypeScript SQL query builder. In versions 0.28.12 and 0.28.13, the `sanitizeStringLiteral` method in Kysely's query compiler escapes sing… |
CVE-2026-4876 | Medium | 6.3 | 2026-03-26 | A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/… |
CVE-2026-2511 | High | 7.5 | 2026-03-26 | The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameter in the `storeTicke… |
CVE-2025-55262 | High | 8.3 | 2026-03-26 | HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database. |
CVE-2018-25209 | High | 8.2 | 2026-03-26 | OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through t… |
CVE-2018-25208 | High | 8.2 | 2026-03-26 | qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by… |
CVE-2018-25207 | High | 7.1 | 2026-03-26 | Online Quiz Maker 1.0 contains SQL injection vulnerabilities in the catid and usern parameters that allow authenticated attackers to execute arbitrary SQL comm… |
CVE-2018-25206 | High | 8.2 | 2026-03-26 | KomSeo Cart 1.3 contains an SQL injection vulnerability that allows attackers to inject SQL commands through the 'my_item_search' parameter in edit.php. Attack… |
CVE-2018-25205 | High | 8.2 | 2026-03-26 | ASP.NET jVideo Kit 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the 'query' parameter in th… |
CVE-2018-25204 | High | 8.2 | 2026-03-26 | Library CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the userna… |
CVE-2018-25203 | High | 8.2 | 2026-03-26 | Online Store System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2018-25202 | High | 8.2 | 2026-03-26 | SAT CFDI 3.3 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter in t… |
CVE-2018-25201 | High | 7.1 | 2026-03-26 | School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by inj… |
CVE-2018-25195 | High | 8.2 | 2026-03-26 | Wecodex Hotel CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows unauthenticated attackers to bypass authentication b… |
CVE-2018-25185 | High | 8.2 | 2026-03-26 | Wecodex Restaurant CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code t… |