CWE-89 · SQL Injection (page 29)
Page 29 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33142 | High | 8.1 | 2026-03-20 | OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE-2026-32306 (ClickHouse SQL injection via aggrega… |
CVE-2026-4504 | High | 7.3 | 2026-03-20 | A flaw has been found in eosphoros-ai db-gpt up to 0.7.5. This vulnerability affects unknown code of the file /api/v1/editor/ of the component Incomplete Fix… |
CVE-2025-62846 | Medium | 6.7 | 2026-03-20 | An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability t… |
CVE-2026-4485 | Medium | 6.3 | 2026-03-20 | A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/search_student.php… |
CVE-2026-33134 | Critical | 9.3 | 2026-03-20 | WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_… |
CVE-2026-33133 | High | 7.2 | 2026-03-20 | WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives wi… |
CVE-2026-4473 | Medium | 4.7 | 2026-03-20 | A vulnerability was detected in itsourcecode Online Doctor Appointment System 1.0. This issue affects some unknown processing of the file /admin/appointment_ac… |
CVE-2026-4472 | Medium | 6.3 | 2026-03-20 | A security vulnerability has been detected in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /admin/… |
CVE-2026-4471 | Medium | 4.7 | 2026-03-20 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /admin/admin_edit_employee.php… |
CVE-2026-4470 | Medium | 4.7 | 2026-03-20 | A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2026-4469 | Medium | 4.7 | 2026-03-20 | A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-33025 | High | 8.8 | 2026-03-20 | AVideo is a video-sharing Platform. Versions prior to 8.0 contain a SQL Injection vulnerability in the getSqlFromPost() method of Object.php. The $_POST['sort'… |
CVE-2026-32954 | High | 7.1 | 2026-03-20 | ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and… |
CVE-2026-32950 | High | 8.8 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in t… |
CVE-2026-32888 | High | 8.8 | 2026-03-20 | Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Versions contain an SQL Injection in the Items s… |
CVE-2026-32813 | High | 8.0 | 2026-03-20 | Admidio is an open-source user management solution. Versions 5.0.6 and below are vulnerable to arbitrary SQL Injection through the MyList configuration feature… |
CVE-2026-32767 | Critical | 9.8 | 2026-03-20 | SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextSearchBlock… |
CVE-2026-33288 | High | 8.8 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, a SQL Injection v… |
CVE-2026-32763 | High | 8.2 | 2026-03-20 | Kysely is a type-safe TypeScript SQL query builder. Versions up to and including 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL a… |
CVE-2026-29099 | High | 8.8 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the `retrieve()`… |
CVE-2026-29096 | High | 8.1 | 2026-03-19 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, when creating or… |
CVE-2026-30711 | High | 8.8 | 2026-03-19 | Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-a… |
CVE-2026-3658 | High | 7.5 | 2026-03-19 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter i… |
CVE-2026-27413 | Critical | 9.3 | 2026-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection… |
CVE-2026-32698 | Critical | 9.1 | 2026-03-18 | OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection a… |
CVE-2026-32321 | High | 8.8 | 2026-03-18 | ClipBucket v5 is an open source video sharing platform. An authenticated time-based blind SQL injection vulnerability exists in ClipBucket prior to 5.5.3 #80 w… |
CVE-2025-58112 | High | 8.8 | 2026-03-18 | Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .r… |
CVE-2026-32611 | High | 7.0 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by… |
CVE-2025-67830 | Critical | 9.8 | 2026-03-18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection. |
CVE-2025-67829 | Critical | 9.8 | 2026-03-18 | Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection. |
CVE-2026-22730 | High | 8.8 | 2026-03-18 | A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute ar… |
CVE-2026-33058 | Medium | 6.5 | 2026-03-18 | Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers wi… |
CVE-2026-31891 | High | 7.7 | 2026-03-18 | Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API access enabled is potentially affected by… |
CVE-2026-26001 | High | 7.1 | 2026-03-18 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Prior to 1.6.6, non sanitized user in… |
CVE-2026-25936 | Medium | 6.5 | 2026-03-17 | GLPI is a free Asset and IT management software package. Starting in version 11.0.0 and prior to version 11.0.6, an authenticated user can perfom a SQL injecti… |
CVE-2026-4319 | High | 7.3 | 2026-03-17 | A vulnerability was identified in code-projects Simple Food Order System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/a… |
CVE-2026-4324 | Medium | 5.4 | 2026-03-17 | A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attac… |
CVE-2026-2579 | High | 7.5 | 2026-03-17 | The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up… |
CVE-2026-4289 | High | 7.3 | 2026-03-17 | A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preS… |
CVE-2026-4288 | High | 7.3 | 2026-03-17 | A weakness has been identified in Tiandy Easy7 Integrated Management Platform 7.17.0. The impacted element is an unknown function of the file /rest/devStatus/g… |
CVE-2026-4287 | High | 7.3 | 2026-03-17 | A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devSta… |
CVE-2026-30881 | High | 8.8 | 2026-03-16 | Chamilo LMS is a learning management system. Version 1.11.34 and prior contains a SQL Injection vulnerability in the statistics AJAX endpoint. The parameters d… |
CVE-2026-28430 | Critical | 9.8 | 2026-03-16 | Chamilo LMS is a learning management system. Prior to version 1.11.34, there is an unauthenticated SQL injection vulnerability which allows remote attackers to… |
CVE-2025-69768 | High | 7.5 | 2026-03-16 | SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php component |
CVE-2025-62319 | Critical | 9.8 | 2026-03-16 | Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into app… |
CVE-2025-52646 | Low | 2.2 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2026-4241 | Medium | 6.3 | 2026-03-16 | A vulnerability was identified in itsourcecode College Management System 1.0. The impacted element is an unknown function of the file /admin/time-table.php. Su… |
CVE-2026-4238 | Medium | 4.7 | 2026-03-16 | A vulnerability has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/courses.php. The ma… |
CVE-2026-4237 | High | 7.3 | 2026-03-16 | A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/mod_reports/index.php… |
CVE-2026-4236 | High | 7.3 | 2026-03-16 | A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view… |
CVE-2026-4235 | High | 7.3 | 2026-03-16 | A weakness has been identified in itsourcecode Online Enrollment System 1.0. This issue affects some unknown processing of the file /sms/login.php. This manipu… |
CVE-2026-4234 | Medium | 6.3 | 2026-03-16 | A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handl… |
CVE-2026-4232 | High | 7.3 | 2026-03-16 | A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /rest/user/get… |
CVE-2026-4230 | Medium | 6.3 | 2026-03-16 | A vulnerability has been found in vanna-ai vanna up to 2.0.2. Affected is the function update_sql of the file src/vanna/legacy/flask/__init__.py of the compone… |
CVE-2026-4229 | High | 7.3 | 2026-03-16 | A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove_training_data of the file src/vanna/legacy/google/bigquery_vector.py. Thi… |
CVE-2026-4223 | High | 7.3 | 2026-03-16 | A vulnerability was identified in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /manage_employee.php. Such… |
CVE-2026-4190 | High | 7.3 | 2026-03-16 | A vulnerability was detected in JawherKl node-api-postgres up to 2.5. This impacts the function User.getAll of the file models/user.js. The manipulation of the… |
CVE-2026-4189 | Medium | 4.7 | 2026-03-16 | A weakness has been identified in phpipam up to 1.7.4. The impacted element is an unknown function of the file app/admin/sections/edit-result.php of the compon… |
CVE-2026-4173 | Medium | 6.3 | 2026-03-16 | A flaw has been found in CodePhiliaX Chat2DB up to 0.3.7. This vulnerability affects the function exportTable/exportTableColumnComment/exportView/exportProcedu… |
CVE-2026-3023 | High | 8.8 | 2026-03-16 | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-tags'. This vulnera… |
CVE-2026-3022 | Medium | 6.5 | 2026-03-16 | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/hospitalization/generate-hospi… |
CVE-2026-3021 | Medium | 6.5 | 2026-03-16 | Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/centro/equipo/empleado'. This… |
CVE-2026-32628 | High | 8.8 | 2026-03-16 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL inject… |
CVE-2025-52637 | Medium | 4.5 | 2026-03-16 | HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or r… |
CVE-2015-20121 | High | 8.2 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting… |
CVE-2015-20120 | High | 8.2 | 2026-03-16 | Next Click Ventures RealtyScript 4.0.2 contains multiple time-based blind SQL injection vulnerabilities that allow unauthenticated attackers to extract databas… |
CVE-2026-32459 | High | 7.6 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows B… |
CVE-2026-32458 | High | 7.6 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.Th… |
CVE-2026-32433 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-wi… |
CVE-2026-32422 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind… |
CVE-2026-32418 | High | 7.6 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Blind SQL Inj… |
CVE-2026-32399 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assis… |
CVE-2026-32368 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injec… |
CVE-2026-32366 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allo… |
CVE-2026-32365 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows B… |
CVE-2026-32358 | High | 7.6 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injec… |
CVE-2026-32306 | Critical | 9.9 | 2026-03-13 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, a… |
CVE-2026-31922 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This i… |
CVE-2026-31917 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects… |
CVE-2026-25076 | High | 7.3 | 2026-03-13 | Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access t… |
CVE-2026-22193 | High | 8.1 | 2026-03-13 | wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL… |
CVE-2025-36368 | Medium | 6.5 | 2026-03-13 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to… |
CVE-2026-32137 | High | 8.8 | 2026-03-12 | Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated… |
CVE-2026-26794 | High | 8.8 | 2026-03-12 | GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execut… |
CVE-2026-21708 | Critical | 9.9 | 2026-03-12 | A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user. |
CVE-2019-25543 | High | 8.2 | 2026-03-12 | Netartmedia Real Estate Portal 5.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQ… |
CVE-2019-25542 | High | 8.2 | 2026-03-12 | Netartmedia Real Estate Portal 5.0 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL… |
CVE-2019-25541 | High | 8.2 | 2026-03-12 | Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through unvalidate… |
CVE-2019-25540 | High | 8.2 | 2026-03-12 | Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL c… |
CVE-2019-25539 | High | 8.2 | 2026-03-12 | 202CMS v10 beta contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2019-25538 | High | 8.2 | 2026-03-12 | 202CMS v10 beta contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2019-25537 | High | 8.2 | 2026-03-12 | Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by in… |
CVE-2019-25536 | High | 8.2 | 2026-03-12 | Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by inject… |
CVE-2019-25535 | High | 8.2 | 2026-03-12 | Netartmedia PHP Dating Site contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code t… |
CVE-2019-25534 | High | 8.2 | 2026-03-12 | Netartmedia PHP Car Dealer contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting maliciou… |
CVE-2019-25533 | High | 8.2 | 2026-03-12 | Netartmedia PHP Business Directory 4.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injectin… |
CVE-2019-25532 | High | 8.2 | 2026-03-12 | Netartmedia Jobs Portal 6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2019-25531 | High | 8.2 | 2026-03-12 | Netartmedia Deals Portal contains an SQL injection vulnerability in the Email parameter of loginaction.php that allows unauthenticated attackers to manipulate… |
CVE-2019-25530 | High | 8.2 | 2026-03-12 | uHotelBooking System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2019-25529 | High | 7.1 | 2026-03-12 | Placeto CMS Alpha rv.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through… |