CWE-89 · SQL Injection (page 3)
Page 3 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93000 | Medium | 6.8 | 2026-09-28 | The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled… |
CVE-2026-89303 | Medium | 6.4 | 2026-09-28 | The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticate… |
CVE-2026-100899 | Medium | 6.3 | 2026-09-28 | A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widge… |
CVE-2026-100898 | Medium | 6.3 | 2026-09-28 | A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament… |
CVE-2026-100894 | Medium | 6.3 | 2026-09-28 | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown proce… |
CVE-2026-100887 | Medium | 6.3 | 2026-09-28 | A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted elemen… |
CVE-2026-100875 | High | 7.3 | 2026-09-27 | A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of t… |
CVE-2026-100874 | High | 7.3 | 2026-09-27 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file a… |
CVE-2026-101046 | Low | 3.1 | 2026-09-27 | Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activ… |
CVE-2026-100847 | High | 7.5 | 2026-09-27 | AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitra… |
CVE-2026-100739 | High | 7.3 | 2026-09-26 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the… |
CVE-2026-97162 | | 2026-09-26 | Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | |
CVE-2026-94131 | | 2026-09-26 | Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a… | |
CVE-2026-94130 | | 2026-09-26 | Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video search functio… | |
CVE-2026-100683 | High | 8.0 | 2026-09-26 | Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename DDL in packages/backend-core/src/sql/sqlTable.ts by interpolating identifiers di… |
CVE-2026-100644 | High | 7.5 | 2026-09-26 | SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query endpoint where the dailyNoteSavePath parameter is concatenated into SQL without… |
CVE-2026-100315 | High | 7.3 | 2026-09-26 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the… |
CVE-2026-100314 | High | 7.3 | 2026-09-26 | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown f… |
CVE-2026-100312 | Medium | 6.3 | 2026-09-26 | A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unkno… |
CVE-2026-89237 | Medium | 6.8 | 2026-09-26 | The Bluff Post WordPress plugin through 1.1.1 does not sanitise and escape parameters before using them as identifiers in a SQL query, allowing unauthenticated… |
CVE-2026-84097 | Medium | 6.5 | 2026-09-26 | The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, bef… |
CVE-2026-53629 | | 2026-09-25 | GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the h… | |
CVE-2026-97886 | Medium | 6.3 | 2026-09-25 | A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an… |
CVE-2026-97885 | High | 7.3 | 2026-09-25 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file up… |
CVE-2026-97884 | Medium | 6.3 | 2026-09-25 | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the… |
CVE-2026-97883 | High | 7.3 | 2026-09-25 | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown f… |
CVE-2026-97882 | High | 7.3 | 2026-09-25 | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown fu… |
CVE-2026-62262 | Critical | 9.1 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can c… |
CVE-2026-54790 | Medium | 6.0 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-contro… |
CVE-2026-44642 | High | 8.1 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, check_upgrade_access_rights() in admin/include/functions_upgrade… |
CVE-2026-42324 | High | 7.2 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/element_set_ranks.php stores administrator-controlled image… |
CVE-2026-42323 | High | 7.2 | 2026-09-25 | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-controlled dimensio… |
CVE-2026-33639 | High | 7.2 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane interpolates the administrator… |
CVE-2026-84893 | High | 7.6 | 2026-09-25 | IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sens… |
CVE-2026-93899 | Medium | 6.5 | 2026-09-25 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Messag… |
CVE-2026-97321 | Medium | 6.3 | 2026-09-24 | A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of… |
CVE-2026-13016 | | 2026-09-24 | ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated u… | |
CVE-2026-56738 | | 2026-09-24 | phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and i… | |
CVE-2026-47132 | Medium | 5.4 | 2026-09-24 | phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat use… |
CVE-2026-77874 | High | 8.6 | 2026-09-24 | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker coul… |
CVE-2026-78311 | High | 8.8 | 2026-09-24 | SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-78309 | High | 8.8 | 2026-09-24 | SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-96803 | High | 7.3 | 2026-09-24 | A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the c… |
CVE-2026-96777 | Medium | 6.3 | 2026-09-24 | A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server… |
CVE-2026-96751 | High | 7.3 | 2026-09-24 | A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the… |
CVE-2026-96604 | High | 7.3 | 2026-09-23 | A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the… |
CVE-2026-96602 | High | 7.3 | 2026-09-23 | A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler… |
CVE-2026-96601 | High | 7.3 | 2026-09-23 | A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The… |
CVE-2026-96826 | High | 7.6 | 2026-09-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Inject… |
CVE-2026-95601 | Critical | 9.3 | 2026-09-23 | Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. |
CVE-2026-95593 | High | 7.6 | 2026-09-23 | Editor SQL Injection in Ultimeter <= 3.0.8 versions. |
CVE-2026-95590 | High | 7.1 | 2026-09-23 | Subscriber SQL Injection in Tainacan <= 1.2.0 versions. |
CVE-2026-95522 | High | 7.6 | 2026-09-23 | Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. |
CVE-2026-94174 | High | 7.6 | 2026-09-23 | Administrator SQL Injection in Email Log <= 2.63 versions. |
CVE-2026-94124 | High | 8.5 | 2026-09-23 | Contributor SQL Injection in WP EasyCart <= 5.9.4 versions. |
CVE-2026-93773 | High | 8.5 | 2026-09-23 | Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. |
CVE-2026-93527 | High | 8.5 | 2026-09-23 | Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. |
CVE-2026-92692 | | 2026-09-23 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines hav… | |
CVE-2026-90902 | | 2026-09-23 | Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update… | |
CVE-2026-90901 | | 2026-09-23 | Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion e… | |
CVE-2026-96514 | High | 7.3 | 2026-09-23 | A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. T… |
CVE-2025-63564 | Critical | 9.8 | 2026-09-23 | SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests |
CVE-2026-96673 | High | 7.5 | 2026-09-23 | Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating… |
CVE-2026-18180 | Medium | 6.5 | 2026-09-23 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection. |
CVE-2026-96600 | Medium | 5.5 | 2026-09-23 | Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administ… |
CVE-2026-86677 | High | 8.8 | 2026-09-23 | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining admini… |
CVE-2026-14913 | High | 8.8 | 2026-09-23 | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search R… |
CVE-2026-93368 | High | 7.5 | 2026-09-23 | The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up t… |
CVE-2026-91024 | Medium | 6.8 | 2026-09-23 | The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL… |
CVE-2022-4997 | High | 8.6 | 2026-09-23 | The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing una… |
CVE-2026-95929 | Medium | 6.3 | 2026-09-23 | A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapp… |
CVE-2026-95927 | High | 7.3 | 2026-09-23 | A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessm… |
CVE-2026-95926 | High | 7.3 | 2026-09-23 | A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/adm… |
CVE-2026-96272 | High | 7.5 | 2026-09-23 | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into… |
CVE-2026-95925 | High | 7.3 | 2026-09-23 | A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/a… |
CVE-2026-95924 | High | 7.3 | 2026-09-23 | A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessme… |
CVE-2026-95868 | Medium | 6.3 | 2026-09-23 | A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the fun… |
CVE-2026-95833 | Medium | 6.3 | 2026-09-23 | A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manip… |
CVE-2026-95829 | Medium | 6.3 | 2026-09-23 | A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the… |
CVE-2026-61685 | High | 7.5 | 2026-09-22 | ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using uns… |
CVE-2026-95819 | High | 7.3 | 2026-09-22 | A vulnerability has been found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this vulnerability is an unkn… |
CVE-2026-18137 | High | 8.1 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary ESQL commands due to improper neutralization of… |
CVE-2026-88416 | Critical | 9.8 | 2026-09-22 | MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature. |
CVE-2026-88414 | Critical | 9.8 | 2026-09-22 | MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). |
CVE-2026-75682 | Critical | 9.9 | 2026-09-22 | Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitra… |
CVE-2026-82011 | Critical | 9.1 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-82010 | Critical | 9.9 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-82009 | Critical | 9.1 | 2026-09-22 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re… |
CVE-2026-65128 | High | 8.8 | 2026-09-22 | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability mig… |
CVE-2026-12718 | Critical | 9.8 | 2026-09-22 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows… |
CVE-2026-94117 | High | 7.6 | 2026-09-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blin… |
CVE-2026-94492 | Medium | 6.3 | 2026-09-22 | A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit o… |
CVE-2026-94491 | High | 7.3 | 2026-09-22 | A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument… |
CVE-2026-88756 | Medium | 5.3 | 2026-09-21 | Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /u… |
CVE-2026-65980 | | 2026-09-21 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's Clic… | |
CVE-2026-61852 | | 2026-09-21 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQ… | |
CVE-2026-88402 | Critical | 9.8 | 2026-09-21 | A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL s… |
CVE-2026-94144 | High | 7.3 | 2026-09-21 | A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component OR… |
CVE-2026-94143 | High | 7.3 | 2026-09-21 | A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the comp… |
CVE-2026-94110 | High | 7.3 | 2026-09-21 | A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the compo… |