CWE-89 · SQL Injection (page 28)
Page 28 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-25183 | High | 8.2 | 2026-03-26 | Shipping System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through th… |
CVE-2026-4850 | High | 7.3 | 2026-03-26 | A security flaw has been discovered in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checkregisitem.php of the componen… |
CVE-2026-4844 | High | 7.3 | 2026-03-26 | A vulnerability was detected in code-projects Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin.php of the compone… |
CVE-2026-4842 | High | 7.3 | 2026-03-26 | A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/grades/index… |
CVE-2026-4841 | High | 7.3 | 2026-03-26 | A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file form/cart.php of the component Shoppi… |
CVE-2026-4839 | High | 7.3 | 2026-03-26 | A vulnerability has been found in SourceCodester Food Ordering System 1.0. This affects an unknown function of the file /purchase.php of the component Paramete… |
CVE-2026-4838 | High | 7.3 | 2026-03-26 | A flaw has been found in SourceCodester Malawi Online Market 1.0. The impacted element is an unknown function of the file /display.php. Executing a manipulatio… |
CVE-2026-4836 | Medium | 6.3 | 2026-03-26 | A vulnerability was detected in code-projects Accounting System 1.0. The affected element is an unknown function of the file /my_account/delete.php. Performing… |
CVE-2026-4826 | Medium | 6.3 | 2026-03-26 | A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /update_stock.php of the c… |
CVE-2026-33917 | High | 8.8 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vuln… |
CVE-2026-33914 | High | 7.2 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module cont… |
CVE-2026-4825 | Medium | 6.3 | 2026-03-25 | A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file /update_sales.php of the component HTTP GE… |
CVE-2026-33910 | High | 7.2 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL inj… |
CVE-2026-33909 | Medium | 5.9 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, several variables in the Med… |
CVE-2026-29187 | High | 8.1 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulner… |
CVE-2026-33713 | High | 8.8 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify w… |
CVE-2026-33660 | High | 8.8 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.26, an authenticated user with permission to create or modify w… |
CVE-2026-32539 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Bl… |
CVE-2026-32534 | High | 8.5 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL I… |
CVE-2026-32516 | High | 8.5 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows… |
CVE-2026-32499 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.T… |
CVE-2026-31920 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce pro… |
CVE-2026-27039 | High | 8.5 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team WZone woozone allows Blind SQL Injection.This iss… |
CVE-2026-25377 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows S… |
CVE-2026-25371 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQ… |
CVE-2026-25340 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injec… |
CVE-2026-25007 | High | 8.5 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Element Invader ElementInvader Addons for Elementor eleme… |
CVE-2026-24993 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting we… |
CVE-2026-24977 | High | 8.5 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Bli… |
CVE-2026-22484 | Critical | 9.3 | 2026-03-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pebas Lisfinity Core lisfinity-core allows SQL Injection… |
CVE-2024-58341 | High | 8.2 | 2026-03-25 | OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2026-4815 | High | 8.8 | 2026-03-25 | A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via… |
CVE-2026-4784 | High | 7.3 | 2026-03-25 | A vulnerability was found in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /checkcheckout.php of the component Paramete… |
CVE-2026-4783 | Medium | 6.3 | 2026-03-25 | A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/add-single-student… |
CVE-2026-4781 | Medium | 6.3 | 2026-03-25 | A flaw has been found in SourceCodester Sales and Inventory System 1.0. The affected element is an unknown function of the file update_purchase.php of the comp… |
CVE-2026-4780 | Medium | 6.3 | 2026-03-25 | A vulnerability was detected in SourceCodester Sales and Inventory System 1.0. Impacted is an unknown function of the file update_out_standing.php of the compo… |
CVE-2026-4779 | Medium | 6.3 | 2026-03-24 | A security vulnerability has been detected in SourceCodester Sales and Inventory System 1.0. This issue affects some unknown processing of the file update_cust… |
CVE-2026-4778 | Medium | 6.3 | 2026-03-24 | A weakness has been identified in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file update_category.php of the… |
CVE-2026-4777 | Medium | 6.3 | 2026-03-24 | A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file view_supplier.php of the compone… |
CVE-2026-33539 | High | 7.2 | 2026-03-24 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacke… |
CVE-2026-23921 | High | 8.8 | 2026-03-24 | A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL sel… |
CVE-2026-30655 | Medium | 6.5 | 2026-03-24 | SQL injection in Solicitante::resetaSenha() in esiclivre/esiclivre v0.2.2 and earlier allows unauthenticated remote attackers to gain unauthorized access to se… |
CVE-2019-25643 | High | 8.2 | 2026-03-24 | eNdonesia Portal v8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malici… |
CVE-2019-25642 | High | 8.2 | 2026-03-24 | Bootstrapy CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious cod… |
CVE-2019-25641 | High | 8.2 | 2026-03-24 | Netartmedia Vlog System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thro… |
CVE-2019-25640 | High | 8.2 | 2026-03-24 | Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' param… |
CVE-2019-25639 | High | 8.2 | 2026-03-24 | Matrimony Website Script M-Plus contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injectin… |
CVE-2019-25638 | High | 7.1 | 2026-03-24 | Meeplace Business Review Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mal… |
CVE-2019-25636 | High | 8.2 | 2026-03-24 | Zeeways Jobsite CMS contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2019-25635 | High | 8.2 | 2026-03-24 | Zeeways Matrimony CMS contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the profile_l… |
CVE-2026-4662 | High | 7.5 | 2026-03-24 | The JetEngine plugin for WordPress is vulnerable to SQL Injection via the `listing_load_more` AJAX action in all versions up to, and including, 3.8.6.1. This i… |
CVE-2026-4632 | High | 7.3 | 2026-03-24 | A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add o… |
CVE-2026-4625 | High | 7.3 | 2026-03-24 | A flaw has been found in SourceCodester Online Admission System 1.0. This affects an unknown function of the file /programmes.php. Executing a manipulation of… |
CVE-2026-4624 | High | 7.3 | 2026-03-24 | A vulnerability was detected in SourceCodester Online Library Management System 1.0. The impacted element is an unknown function of the file /home.php of the c… |
CVE-2026-3079 | Medium | 6.5 | 2026-03-24 | The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderby_order]' parameter in the 'learndash_propanel_te… |
CVE-2026-4615 | High | 7.3 | 2026-03-24 | A vulnerability was identified in SourceCodester Online Catering Reservation 1.0. Impacted is an unknown function of the file /search.php. Such manipulation of… |
CVE-2026-4614 | Medium | 6.3 | 2026-03-24 | A vulnerability was determined in itsourcecode sanitize or validate this input 1.0. This issue affects some unknown processing of the file /admin/subjects.php… |
CVE-2026-4613 | High | 7.3 | 2026-03-24 | A vulnerability was found in SourceCodester E-Commerce Site 1.0. This vulnerability affects unknown code of the file /products.php. The manipulation of the arg… |
CVE-2026-4306 | High | 7.5 | 2026-03-23 | The WP Job Portal plugin for WordPress is vulnerable to SQL Injection via the 'radius' parameter in all versions up to, and including, 2.4.8 due to insufficien… |
CVE-2026-2412 | Medium | 6.5 | 2026-03-23 | The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including… |
CVE-2026-4612 | High | 7.3 | 2026-03-23 | A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?vie… |
CVE-2026-4597 | Medium | 6.3 | 2026-03-23 | A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. Impacted is the function selectAll of the file src/main/java/com/genersoft/iot/vm… |
CVE-2026-33723 | High | 7.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Subscribe::save()` method in `objects/subscribe.php` concatenates the… |
CVE-2026-33651 | High | 8.1 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint passes `$_REQUEST['live_schedule_id']` thr… |
CVE-2026-4594 | High | 7.3 | 2026-03-23 | A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy of the file erupt-data/erupt-jpa/src/ma… |
CVE-2026-4593 | Medium | 6.3 | 2026-03-23 | A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the file erupt-ai/src/main/java/xyz/erupt/ai… |
CVE-2026-33485 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `plugin/Live/on_publish.php` is accessibl… |
CVE-2026-33352 | Critical | 9.8 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exists in `objects/category.php` in the `ge… |
CVE-2025-41008 | | 2026-03-23 | SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter… | |
CVE-2025-41007 | | 2026-03-23 | SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'search' parameter in the '/search… | |
CVE-2026-32969 | High | 7.5 | 2026-03-23 | An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper ne… |
CVE-2026-4581 | High | 7.3 | 2026-03-23 | A weakness has been identified in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /checklogin.php of the component Paramet… |
CVE-2026-4580 | High | 7.3 | 2026-03-23 | A security flaw has been discovered in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /checkupdatestatus.php of the comp… |
CVE-2026-4579 | High | 7.3 | 2026-03-23 | A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file /viewdetail.php of the component Parame… |
CVE-2026-4574 | Medium | 6.3 | 2026-03-23 | A vulnerability was detected in SourceCodester Simple E-learning System 1.0. This vulnerability affects unknown code of the component User Profile Update Handl… |
CVE-2026-4573 | Medium | 6.3 | 2026-03-23 | A security vulnerability has been detected in SourceCodester Simple E-learning System 1.0. This affects an unknown part of the file /includes/form_handlers/del… |
CVE-2026-4572 | Medium | 6.3 | 2026-03-23 | A weakness has been identified in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /view_product… |
CVE-2026-4571 | Medium | 6.3 | 2026-03-23 | A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /v… |
CVE-2026-4570 | Medium | 6.3 | 2026-03-23 | A vulnerability was identified in SourceCodester Sales and Inventory System 1.0. Affected is an unknown function of the file /view_customers.php of the compone… |
CVE-2026-4569 | Medium | 6.3 | 2026-03-23 | A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /view_category.php of the compone… |
CVE-2026-4568 | Medium | 6.3 | 2026-03-23 | A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /update_supplier.php of the component… |
CVE-2026-2580 | High | 7.5 | 2026-03-23 | The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to time-based SQL Injection via the… |
CVE-2026-4550 | Medium | 4.7 | 2026-03-22 | A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulati… |
CVE-2026-4540 | High | 7.3 | 2026-03-22 | A vulnerability was detected in projectworlds Online Notes Sharing System 1.0. This issue affects some unknown processing of the file /login.php of the compone… |
CVE-2026-4533 | Medium | 6.3 | 2026-03-22 | A vulnerability was detected in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file all-tickets.php… |
CVE-2026-4530 | Medium | 5.3 | 2026-03-22 | A security flaw has been discovered in apconw Aix-DB up to 1.2.3. This impacts an unknown function of the file agent/text2sql/rag/terminology_retriever.py. Per… |
CVE-2019-25581 | High | 8.2 | 2026-03-21 | i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code thr… |
CVE-2019-25578 | High | 8.2 | 2026-03-21 | phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2019-25576 | High | 8.2 | 2026-03-21 | Kepler Wallpaper Script 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2019-25575 | High | 8.2 | 2026-03-21 | SimplePress CMS 1.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious cod… |
CVE-2019-25573 | High | 7.1 | 2026-03-21 | Green CMS 2.x contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2026-4513 | Medium | 6.3 | 2026-03-21 | A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function ask of the file vanna\legacy\base\base.py. Performin… |
CVE-2026-4087 | Medium | 6.5 | 2026-03-21 | The Pre* Party Resource Hints plugin for WordPress is vulnerable to SQL Injection via the 'hint_ids' parameter of the pprh_update_hints AJAX action in all vers… |
CVE-2026-3334 | High | 8.8 | 2026-03-21 | The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versi… |
CVE-2026-2503 | Medium | 6.5 | 2026-03-21 | The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX ac… |
CVE-2026-2468 | High | 7.5 | 2026-03-21 | The Quentn WP plugin for WordPress is vulnerable to SQL Injection via the 'qntn_wp_access' cookie in all versions up to, and including, 1.2.12. This is due to… |
CVE-2026-2279 | High | 7.2 | 2026-03-21 | The myLinksDump plugin for WordPress is vulnerable to SQL Injection via the 'sort_by' and 'sort_order' parameters in all versions up to, and including, 1.6 due… |
CVE-2026-1800 | High | 7.5 | 2026-03-21 | The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, an… |
CVE-2026-4508 | High | 7.3 | 2026-03-20 | A vulnerability was identified in PbootCMS up to 3.2.12. The impacted element is the function checkUsername of the file apps/home/controller/MemberController.p… |
CVE-2026-4507 | Medium | 6.3 | 2026-03-20 | A vulnerability was determined in Mindinventory MindSQL up to 0.2.1. The affected element is the function ask_db of the file mindsql/core/mindsql_core.py. Exec… |