CWE-89 · SQL Injection (page 28)
Page 28 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49050 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allo… |
CVE-2025-49049 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Inje… |
CVE-2025-36588 | High | 8.8 | 2026-01-22 | Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabil… |
CVE-2025-4764 | High | 8.0 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hot… |
CVE-2025-27378 | High | 8.6 | 2026-01-22 | AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configurat… |
CVE-2021-47872 | High | 7.1 | 2026-01-21 | SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate databas… |
CVE-2021-47848 | High | 8.2 | 2026-01-21 | Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter… |
CVE-2021-47846 | High | 8.2 | 2026-01-21 | Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers… |
CVE-2025-67261 | Medium | 6.5 | 2026-01-20 | Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page. |
CVE-2026-1179 | High | 7.3 | 2026-01-19 | A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. Th… |
CVE-2026-1178 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the componen… |
CVE-2026-1177 | High | 7.3 | 2026-01-19 | A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component… |
CVE-2026-1176 | High | 7.3 | 2026-01-19 | A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index.php. Performing a… |
CVE-2026-22850 | High | 8.3 | 2026-01-19 | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics… |
CVE-2026-1160 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the compone… |
CVE-2026-1159 | High | 7.3 | 2026-01-19 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.ph… |
CVE-2026-0610 | Critical | 9.8 | 2026-01-19 | SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
CVE-2026-1133 | High | 7.3 | 2026-01-19 | A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter… |
CVE-2026-1132 | High | 7.3 | 2026-01-19 | A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/edit_folder.jsp of the component HTTP GET Parameter… |
CVE-2026-1131 | High | 7.3 | 2026-01-19 | A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handle… |
CVE-2026-1130 | High | 7.3 | 2026-01-19 | A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Paramet… |
CVE-2026-1129 | High | 7.3 | 2026-01-19 | A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Paramete… |
CVE-2026-1124 | High | 7.3 | 2026-01-18 | A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of th… |
CVE-2026-1123 | High | 7.3 | 2026-01-18 | A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Hand… |
CVE-2026-1122 | High | 7.3 | 2026-01-18 | A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Ha… |
CVE-2026-1121 | High | 7.3 | 2026-01-18 | A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Hand… |
CVE-2026-1120 | High | 7.3 | 2026-01-18 | A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Pa… |
CVE-2026-1119 | High | 7.3 | 2026-01-18 | A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/delete_activity.php. Execut… |
CVE-2026-1118 | Medium | 6.3 | 2026-01-18 | A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/add_activity.php. Performing a m… |
CVE-2026-1105 | High | 7.3 | 2026-01-18 | A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argume… |
CVE-2026-1059 | High | 7.3 | 2026-01-17 | A security vulnerability has been detected in FeMiner wms up to 9cad1f1b179a98b9547fd003c23b07c7594775fa. Affected by this vulnerability is an unknown function… |
CVE-2026-1050 | High | 7.3 | 2026-01-17 | A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/ut… |
CVE-2025-12984 | Medium | 4.9 | 2026-01-17 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 2.0… |
CVE-2026-23723 | High | 7.2 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaContr… |
CVE-2025-61943 | High | 8.4 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and… |
CVE-2021-47811 | Critical | 9.1 | 2026-01-16 | Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can… |
CVE-2021-47801 | High | 8.2 | 2026-01-16 | Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit t… |
CVE-2021-47782 | High | 8.2 | 2026-01-16 | Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to inject malicious databas… |
CVE-2025-70893 | High | 8.8 | 2026-01-15 | A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. The application fai… |
CVE-2025-70892 | Critical | 9.8 | 2026-01-15 | Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate u… |
CVE-2025-66417 | High | 7.5 | 2026-01-15 | GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpo… |
CVE-2021-47777 | High | 8.2 | 2026-01-15 | Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint. Attackers can inj… |
CVE-2021-47766 | High | 7.1 | 2026-01-15 | Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that allows attackers to manipulate databas… |
CVE-2021-47763 | High | 8.2 | 2026-01-15 | Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attacker… |
CVE-2025-67082 | Medium | 6.5 | 2026-01-15 | An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An aut… |
CVE-2025-67081 | Medium | 4.9 | 2026-01-15 | An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account ca… |
CVE-2025-12166 | High | 7.5 | 2026-01-14 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `a… |
CVE-2026-23492 | High | 8.8 | 2026-01-14 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API al… |
CVE-2025-37183 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37182 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37181 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-66169 | Medium | 5.3 | 2026-01-14 | Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, f… |
CVE-2025-14770 | High | 7.5 | 2026-01-14 | The Shipping Rate By Cities plugin for WordPress is vulnerable to SQL Injection via the 'city' parameter in all versions up to, and including, 2.0.0 due to ins… |
CVE-2026-0678 | Medium | 4.9 | 2026-01-14 | The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'cities' parameter in all versions up to… |
CVE-2023-54340 | High | 8.2 | 2026-01-13 | WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password paramete… |
CVE-2023-54333 | High | 8.2 | 2026-01-13 | Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. At… |
CVE-2022-50895 | Critical | 9.8 | 2026-01-13 | Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate database queries. Attackers can exploit boole… |
CVE-2022-50894 | Medium | 6.5 | 2026-01-13 | VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code t… |
CVE-2022-50892 | High | 8.2 | 2026-01-13 | VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials. Attackers… |
CVE-2022-50805 | High | 8.2 | 2026-01-13 | Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries… |
CVE-2026-20947 | High | 8.8 | 2026-01-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute co… |
CVE-2025-59922 | High | 7.2 | 2026-01-13 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 t… |
CVE-2025-69991 | Critical | 9.8 | 2026-01-13 | phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php. |
CVE-2025-13774 | High | 8.8 | 2026-01-13 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute u… |
CVE-2026-0501 | Critical | 9.9 | 2026-01-13 | Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL q… |
CVE-2025-67146 | Critical | 9.4 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search… |
CVE-2025-67147 | Critical | 9.8 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_c… |
CVE-2025-51567 | Critical | 9.1 | 2026-01-12 | A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL comma… |
CVE-2025-41006 | | 2026-01-12 | Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’. | |
CVE-2025-41005 | | 2026-01-12 | Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchange_offers.php’. | |
CVE-2025-41004 | | 2026-01-12 | Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter. | |
CVE-2025-52694 | Critical | 10.0 | 2026-01-12 | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable s… |
CVE-2026-0852 | High | 7.3 | 2026-01-12 | A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpd… |
CVE-2026-0851 | High | 7.3 | 2026-01-12 | A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser… |
CVE-2026-0850 | Medium | 4.7 | 2026-01-11 | A vulnerability was determined in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /admin/delete_activity.php… |
CVE-2026-0843 | Medium | 6.3 | 2026-01-11 | A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshop_food up to 20260103. This vulnerability affects unknown code of the file /i… |
CVE-2026-22687 | Medium | 5.6 | 2026-01-10 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent se… |
CVE-2025-65091 | Critical | 10.0 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (i… |
CVE-2026-22596 | Medium | 6.7 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/… |
CVE-2025-51626 | Medium | 6.5 | 2026-01-09 | SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel_order.php endpoint. |
CVE-2025-67811 | Medium | 6.5 | 2026-01-09 | Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers… |
CVE-2026-22197 | High | 8.1 | 2026-01-09 | GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, se… |
CVE-2026-22196 | High | 8.1 | 2026-01-09 | GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation… |
CVE-2026-22195 | High | 8.1 | 2026-01-09 | GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL q… |
CVE-2025-15496 | Medium | 6.3 | 2026-01-09 | A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument… |
CVE-2025-15494 | Medium | 6.3 | 2026-01-09 | A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapper.xml. The manipul… |
CVE-2025-15493 | Medium | 6.3 | 2026-01-09 | A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/DocSystem/mapping/ReposAuthMapper.xml… |
CVE-2026-0803 | Medium | 6.3 | 2026-01-09 | A vulnerability was found in PHPGurukul Online Course Registration System up to 3.1. This affects an unknown part of the file /enroll.php. The manipulation of… |
CVE-2025-67281 | Medium | 5.4 | 2026-01-09 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the datab… |
CVE-2025-15492 | Medium | 6.3 | 2026-01-09 | A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/mapping/GroupMemberMap… |
CVE-2025-14598 | Critical | 9.8 | 2026-01-09 | BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQ… |
CVE-2025-64092 | High | 7.5 | 2026-01-09 | This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database. |
CVE-2026-0733 | Medium | 6.3 | 2026-01-09 | A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown function of the file /onlinecourse/admin/mana… |
CVE-2026-0729 | Medium | 4.7 | 2026-01-08 | A vulnerability was detected in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /intern/admin/add_activity.p… |
CVE-2026-0728 | Medium | 4.7 | 2026-01-08 | A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /in… |
CVE-2025-61548 | Critical | 9.8 | 2026-01-08 | SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Sho… |
CVE-2025-61246 | Critical | 9.8 | 2026-01-08 | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter. |
CVE-2026-21892 | Medium | 5.3 | 2026-01-08 | Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The applic… |
CVE-2026-22242 | Medium | 4.9 | 2026-01-08 | CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authent… |
CVE-2025-67928 | Critical | 9.3 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQ… |