CWE-89 · SQL Injection (page 27)
Page 27 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37076 | High | 8.2 | 2026-02-03 | Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries… |
CVE-2019-25260 | High | 8.2 | 2026-02-03 | OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database con… |
CVE-2025-10878 | Critical | 10.0 | 2026-02-03 | A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are v… |
CVE-2026-25241 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<versi… |
CVE-2026-25240 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains()… |
CVE-2026-25239 | High | 7.5 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can a… |
CVE-2026-25238 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion ma… |
CVE-2026-25236 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe li… |
CVE-2026-25234 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow… |
CVE-2025-70311 | Medium | 6.5 | 2026-02-03 | JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 parameters in the /systemControl.do interface… |
CVE-2025-63624 | Critical | 9.8 | 2026-02-03 | SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary… |
CVE-2025-57529 | Critical | 9.8 | 2026-02-03 | YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation. This al… |
CVE-2020-37112 | High | 7.1 | 2026-02-03 | GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated pa… |
CVE-2020-37110 | High | 8.2 | 2026-02-03 | 60CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queries through unvalidate… |
CVE-2020-37108 | High | 7.1 | 2026-02-03 | PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to manipulate database… |
CVE-2020-37105 | High | 7.1 | 2026-02-03 | PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands thro… |
CVE-2026-25022 | High | 8.5 | 2026-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system… |
CVE-2026-1312 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases con… |
CVE-2026-1287 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via con… |
CVE-2026-1207 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows r… |
CVE-2025-5319 | Critical | 9.8 | 2026-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry… |
CVE-2026-1432 | | 2026-02-03 | SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several paramet… | |
CVE-2025-8587 | High | 8.6 | 2026-02-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSP… |
CVE-2026-1746 | Medium | 6.3 | 2026-02-02 | A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the componen… |
CVE-2021-47918 | High | 8.1 | 2026-02-01 | Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers… |
CVE-2021-47915 | High | 8.1 | 2026-02-01 | PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL comma… |
CVE-2021-47909 | High | 8.1 | 2026-02-01 | Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged ve… |
CVE-2026-0683 | Medium | 6.5 | 2026-01-31 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all… |
CVE-2020-37057 | High | 8.2 | 2026-01-30 | Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' pa… |
CVE-2020-37053 | High | 7.1 | 2026-01-30 | Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' paramete… |
CVE-2020-37051 | High | 8.2 | 2026-01-30 | Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes… |
CVE-2020-37035 | High | 8.2 | 2026-01-30 | e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database queries through unv… |
CVE-2020-37033 | High | 8.2 | 2026-01-30 | Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'usr_name' parameter in login… |
CVE-2025-69662 | High | 8.6 | 2026-01-30 | SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write G… |
CVE-2026-1701 | High | 7.3 | 2026-01-30 | A security vulnerability has been detected in itsourcecode School Management System 1.0. This issue affects some unknown processing of the file /enrollment/ind… |
CVE-2026-24854 | High | 8.8 | 2026-01-30 | ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7… |
CVE-2026-1688 | High | 7.3 | 2026-01-30 | A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an unknown function of the file /admin/inde… |
CVE-2025-4686 | High | 8.6 | 2026-01-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry… |
CVE-2026-1595 | High | 7.3 | 2026-01-29 | A vulnerability was detected in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/edit_student_query.php. The manipul… |
CVE-2026-1594 | High | 7.3 | 2026-01-29 | A security vulnerability has been detected in itsourcecode Society Management System 1.0. Affected by this issue is some unknown functionality of the file /adm… |
CVE-2026-1593 | High | 7.3 | 2026-01-29 | A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edi… |
CVE-2026-1590 | High | 7.3 | 2026-01-29 | A vulnerability was identified in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/faculty/index.php. Such man… |
CVE-2026-1589 | High | 7.3 | 2026-01-29 | A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/inquiry/index.php. This man… |
CVE-2025-7714 | High | 7.5 | 2026-01-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Man… |
CVE-2020-37006 | High | 8.2 | 2026-01-29 | berliCRM 1.0.24 contains a SQL injection vulnerability in the 'src_record' parameter that allows remote attackers to manipulate database queries. Attackers can… |
CVE-2020-37005 | High | 7.1 | 2026-01-29 | TimeClock Software 1.01 contains an authenticated time-based SQL injection vulnerability that allows attackers to enumerate valid usernames by manipulating the… |
CVE-2020-37004 | High | 8.2 | 2026-01-29 | The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes… |
CVE-2020-36999 | High | 8.2 | 2026-01-29 | Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login page with SQL injection… |
CVE-2026-1552 | Medium | 6.3 | 2026-01-29 | A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argumen… |
CVE-2026-1551 | Medium | 6.3 | 2026-01-29 | A weakness has been identified in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/course/controller.php. Executin… |
CVE-2025-15344 | Medium | 6.3 | 2026-01-29 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2026-1546 | Medium | 6.3 | 2026-01-28 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/dep… |
CVE-2026-1545 | High | 7.3 | 2026-01-28 | A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /course/index.php. Executi… |
CVE-2026-1535 | High | 7.3 | 2026-01-28 | A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.p… |
CVE-2026-1534 | High | 7.3 | 2026-01-28 | A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This… |
CVE-2026-1533 | Medium | 4.7 | 2026-01-28 | A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAdd… |
CVE-2025-57793 | High | 8.6 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application co… |
CVE-2025-57792 | Critical | 10.0 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. A… |
CVE-2020-36972 | High | 8.2 | 2026-01-28 | SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database inf… |
CVE-2020-36945 | High | 8.2 | 2026-01-28 | WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulat… |
CVE-2026-22243 | High | 8.8 | 2026-01-28 | EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.202… |
CVE-2026-0702 | High | 7.5 | 2026-01-28 | The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to… |
CVE-2026-1483 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1482 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1481 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1480 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1479 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1478 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1477 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1476 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1475 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1474 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1473 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1472 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2025-69563 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter. |
CVE-2025-69562 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter. |
CVE-2021-47902 | High | 8.2 | 2026-01-27 | Testa Online Test Management System 3.4.7 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'q' search pa… |
CVE-2020-36951 | High | 8.2 | 2026-01-27 | Phpscript-sgh 0.1.0 contains a time-based blind SQL injection vulnerability in the admin interface that allows attackers to manipulate database queries through… |
CVE-2020-36947 | High | 7.1 | 2026-01-27 | LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database infor… |
CVE-2026-1449 | High | 7.3 | 2026-01-27 | A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113. Affected is the function Page_Load of the file YZSoft/Forms/XForm/BM/Bus… |
CVE-2025-59473 | High | 7.2 | 2026-01-26 | SQL Injection vulnerability in the Structure for Admin authenticated user |
CVE-2026-1443 | High | 7.3 | 2026-01-26 | A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUs… |
CVE-2026-1422 | High | 7.3 | 2026-01-26 | A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of… |
CVE-2025-14973 | Medium | 6.8 | 2026-01-26 | The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors a… |
CVE-2026-0806 | Medium | 4.9 | 2026-01-24 | The WP-ClanWars plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.0.1 due to insufficient… |
CVE-2025-52025 | Critical | 9.4 | 2026-01-23 | An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability ar… |
CVE-2026-24624 | High | 7.6 | 2026-01-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.T… |
CVE-2026-24572 | High | 8.5 | 2026-01-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind S… |
CVE-2026-0603 | High | 8.3 | 2026-01-23 | A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, u… |
CVE-2026-24367 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.T… |
CVE-2026-22470 | High | 7.6 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FireStorm Plugins FireStorm Professional Real Estate fs-r… |
CVE-2025-69180 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind… |
CVE-2025-69045 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL… |
CVE-2025-68999 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-a… |
CVE-2025-68881 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.Thi… |
CVE-2025-68857 | Critical | 9.3 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL… |
CVE-2025-68034 | Critical | 9.3 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL In… |
CVE-2025-68017 | High | 7.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator a… |
CVE-2025-67945 | Critical | 9.3 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-maile… |
CVE-2025-49055 | Critical | 9.3 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allo… |