CWE-89 · SQL Injection (page 30)
Page 30 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15166 | High | 7.3 | 2025-12-29 | A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown function of the file /updatesupplier.php?action=edit. The ma… |
CVE-2025-15165 | High | 7.3 | 2025-12-29 | A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. The impacted element is an unknown function of the file /updatecustomer.php?act… |
CVE-2025-15143 | Medium | 4.7 | 2025-12-28 | A security flaw has been discovered in EyouCMS up to 1.7.6. The affected element is an unknown function of the file /application/admin/logic/FilemanagerLogic.p… |
CVE-2025-15142 | High | 7.3 | 2025-12-28 | A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file show.php. The manipu… |
CVE-2025-15140 | High | 7.3 | 2025-12-28 | A vulnerability was found in saiftheboss7 onlinemcqexam up to 0e56806132971e49721db3ef01868098c7b42ada. This vulnerability affects unknown code of the file /ad… |
CVE-2025-15127 | High | 7.3 | 2025-12-28 | A security vulnerability has been detected in FantasticLBP Hotels_Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown… |
CVE-2024-44065 | Critical | 9.8 | 2025-12-26 | Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint /index.php/logbookadvanced/search in the qsoresults parameter. |
CVE-2025-66947 | Medium | 6.5 | 2025-12-26 | SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigge… |
CVE-2025-15088 | Medium | 6.3 | 2025-12-25 | A vulnerability was detected in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is the function postilService.loadPostils of the file /je/postil/postil… |
CVE-2025-15078 | High | 7.3 | 2025-12-25 | A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_report.php. The manip… |
CVE-2025-15077 | High | 7.3 | 2025-12-25 | A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /form137.php… |
CVE-2025-15075 | High | 7.3 | 2025-12-25 | A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /student_p.php. Perfo… |
CVE-2025-15074 | High | 7.3 | 2025-12-25 | A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.p… |
CVE-2025-15073 | High | 7.3 | 2025-12-24 | A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipula… |
CVE-2025-68914 | Medium | 6.5 | 2025-12-24 | Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGINFAILEDTABLE table. |
CVE-2018-25128 | High | 8.2 | 2025-12-24 | SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST… |
CVE-2024-39037 | Medium | 6.5 | 2025-12-24 | MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via the intmenu parameter. |
CVE-2025-68590 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubs… |
CVE-2025-68570 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows… |
CVE-2025-68519 | High | 8.5 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce al… |
CVE-2025-68496 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind… |
CVE-2023-36525 | High | 8.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPJobBoard allows Blind SQL Injection.This issue affects… |
CVE-2025-15053 | High | 7.3 | 2025-12-24 | A flaw has been found in code-projects Student Information System 1.0. This issue affects some unknown processing of the file /searchresults.php. Executing man… |
CVE-2025-15049 | High | 7.3 | 2025-12-23 | A vulnerability was identified in code-projects Online Farm System 1.0. Affected is an unknown function of the file /addProduct.php. The manipulation of the ar… |
CVE-2025-65354 | Critical | 9.8 | 2025-12-23 | Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_name POST parameter. C… |
CVE-2023-53982 | High | 7.5 | 2025-12-23 | PMB 7.4.6 contains a SQL injection vulnerability in the storage parameter of the ajax.php endpoint that allows remote attackers to manipulate database queries… |
CVE-2021-47720 | High | 7.1 | 2025-12-23 | Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable… |
CVE-2024-57521 | Critical | 10.0 | 2025-12-23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java. |
CVE-2025-68561 | High | 7.6 | 2025-12-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia AutomatorWP automatorwp allows SQL Injection… |
CVE-2025-68550 | High | 7.6 | 2025-12-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme WPBulky wpbulky-wp-bulk-edit-post-types allows… |
CVE-2025-15034 | High | 7.3 | 2025-12-23 | A security flaw has been discovered in itsourcecode Student Management System 1.0. This affects an unknown part of the file /record.php. The manipulation of th… |
CVE-2023-53975 | High | 7.5 | 2025-12-22 | Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters… |
CVE-2023-53972 | High | 7.5 | 2025-12-22 | WebTareas 2.4 contains a SQL injection vulnerability in the webTareasSID cookie parameter that allows unauthenticated attackers to manipulate database queries… |
CVE-2023-53960 | Critical | 9.8 | 2025-12-22 | SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mechanism that allows attackers to manipula… |
CVE-2021-47714 | Medium | 5.5 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attacke… |
CVE-2025-12514 | High | 7.2 | 2025-12-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification ru… |
CVE-2025-15014 | Medium | 6.3 | 2025-12-22 | A security flaw has been discovered in loganhong php loganSite up to c035fb5c3edd0b2a5e32fd4051cbbc9e61a31426. This affects an unknown function of the file /in… |
CVE-2025-15012 | High | 7.3 | 2025-12-22 | A vulnerability was determined in code-projects Refugee Food Management System 1.0. The affected element is an unknown function of the file /home/home.php. Thi… |
CVE-2025-15011 | High | 7.3 | 2025-12-22 | A vulnerability was found in code-projects Simple Stock System 1.0. Impacted is an unknown function of the file /logout.php. The manipulation of the argument u… |
CVE-2025-15004 | Medium | 6.3 | 2025-12-22 | A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orde… |
CVE-2025-15003 | Medium | 4.7 | 2025-12-22 | A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argum… |
CVE-2025-15002 | High | 7.3 | 2025-12-21 | A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Su… |
CVE-2025-14990 | High | 7.3 | 2025-12-21 | A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-a… |
CVE-2025-14989 | High | 7.3 | 2025-12-21 | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-14968 | High | 7.3 | 2025-12-19 | A security flaw has been discovered in code-projects Simple Stock System 1.0. Affected by this issue is some unknown functionality of the file /market/update.p… |
CVE-2025-14967 | High | 7.3 | 2025-12-19 | A vulnerability was identified in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /candidate… |
CVE-2025-14966 | Medium | 4.7 | 2025-12-19 | A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of… |
CVE-2025-14961 | High | 7.3 | 2025-12-19 | A vulnerability was detected in code-projects Simple Blood Donor Management System 1.0. The affected element is an unknown function of the file /editedcampaign… |
CVE-2025-14960 | High | 7.3 | 2025-12-19 | A security vulnerability has been detected in code-projects Simple Blood Donor Management System 1.0. Impacted is an unknown function of the file /editeddonor… |
CVE-2025-14959 | High | 7.3 | 2025-12-19 | A weakness has been identified in code-projects Simple Stock System 1.0. This issue affects some unknown processing of the file /market/signup.php. Executing a… |
CVE-2025-14952 | High | 7.3 | 2025-12-19 | A vulnerability was detected in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_category.php. Performing a ma… |
CVE-2025-14951 | High | 7.3 | 2025-12-19 | A security vulnerability has been detected in code-projects Scholars Tracking System 1.0. The impacted element is an unknown function of the file /home.php. Su… |
CVE-2025-14950 | High | 7.3 | 2025-12-19 | A weakness has been identified in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /delete_post.php. This ma… |
CVE-2025-14940 | High | 7.3 | 2025-12-19 | A vulnerability was determined in code-projects Scholars Tracking System 1.0. The affected element is an unknown function of the file /admin/delete_user.php. T… |
CVE-2025-14939 | Medium | 4.7 | 2025-12-19 | A vulnerability was found in code-projects Online Appointment Booking System 1.0. Impacted is an unknown function of the file /admin/deletemanager.php. The man… |
CVE-2025-14900 | Medium | 4.7 | 2025-12-19 | A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of… |
CVE-2025-14899 | Medium | 4.7 | 2025-12-19 | A weakness has been identified in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /admin/stateadd.php of the componen… |
CVE-2025-14898 | Medium | 4.7 | 2025-12-19 | A security flaw has been discovered in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /admin/userbuilderdelete.php o… |
CVE-2025-14897 | Medium | 4.7 | 2025-12-19 | A vulnerability was identified in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /admin/useragentdelete.p… |
CVE-2025-63948 | Medium | 5.4 | 2025-12-18 | A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commands via the dbname par… |
CVE-2025-46268 | Medium | 6.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands. |
CVE-2023-53935 | Medium | 5.4 | 2025-12-18 | WBiz Desk 1.2 contains a SQL injection vulnerability that allows non-admin users to manipulate database queries through the 'tk' parameter in ticket.php. Attac… |
CVE-2021-47711 | High | 8.8 | 2025-12-18 | A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. T… |
CVE-2025-14877 | High | 7.3 | 2025-12-18 | A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_retailer.php. The manipulat… |
CVE-2025-64371 | High | 8.5 | 2025-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.T… |
CVE-2025-60062 | Critical | 9.3 | 2025-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mmetrodw tPlayer tplayer-html5-audio-player-with-playlist… |
CVE-2025-58951 | Critical | 9.3 | 2025-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Advance Seat Reservation Management for WooComme… |
CVE-2025-14314 | High | 8.5 | 2025-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roxnor PopupKit popup-builder-block allows Blind SQL Inje… |
CVE-2025-14834 | Medium | 6.3 | 2025-12-17 | A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /checkuser.php. Executing a manipulation… |
CVE-2025-14833 | High | 7.3 | 2025-12-17 | A security flaw has been discovered in code-projects Online Appointment Booking System 1.0. The impacted element is an unknown function of the file /admin/dele… |
CVE-2023-53926 | Critical | 9.8 | 2025-12-17 | PHPJabbers Simple CMS 5.0 contains a SQL injection vulnerability in the 'column' parameter that allows remote attackers to manipulate database queries. Attacke… |
CVE-2023-53917 | Medium | 6.5 | 2025-12-17 | Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated administrators to manipulate database que… |
CVE-2025-68400 | High | 8.8 | 2025-12-17 | ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCR… |
CVE-2025-68112 | Critical | 9.6 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows aut… |
CVE-2025-68111 | High | 7.2 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists in the `eGive.php` file within the "ReIm… |
CVE-2025-67877 | High | 8.8 | 2025-12-17 | ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the `src/CartToFamily.php` file, specifical… |
CVE-2025-14832 | High | 7.3 | 2025-12-17 | A vulnerability was identified in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /updateproduct.php?acti… |
CVE-2025-66396 | High | 7.2 | 2025-12-17 | ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/UserEditor.php` file. When an ad… |
CVE-2025-66395 | High | 8.8 | 2025-12-17 | ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/ListEvents.php` file. When filte… |
CVE-2025-67285 | High | 7.3 | 2025-12-17 | A SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0. The reason for this issue… |
CVE-2025-14780 | Medium | 6.3 | 2025-12-16 | A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dish_… |
CVE-2025-68056 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allo… |
CVE-2025-68055 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection… |
CVE-2025-68054 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown With Image or Video Background cou… |
CVE-2025-68053 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup xPromoter top_bar_promoter allows Blind SQL… |
CVE-2025-67999 | High | 7.6 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Inje… |
CVE-2025-67962 | High | 7.6 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AIOSEO Plugin Team Broken Link Checker broken-link-checke… |
CVE-2025-67950 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allow… |
CVE-2025-62849 | Critical | 9.8 | 2025-12-16 | An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to e… |
CVE-2025-67751 | High | 7.2 | 2025-12-16 | ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating… |
CVE-2025-67736 | High | 7.2 | 2025-12-16 | The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 an… |
CVE-2023-53877 | Critical | 9.8 | 2025-12-15 | Bus Reservation System 1.1 contains a SQL injection vulnerability in the pickup_id parameter that allows attackers to manipulate database queries. Attackers ca… |
CVE-2023-38913 | Medium | 5.3 | 2025-12-15 | SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script. |
CVE-2023-36338 | Medium | 5.3 | 2025-12-15 | Inventory Management System 1 was discovered to contain a SQL injection vulnerability. |
CVE-2025-55703 | Low | 2.5 | 2025-12-15 | An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays w… |
CVE-2025-66440 | High | 8.8 | 2025-12-15 | An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_ent… |
CVE-2025-66439 | High | 8.8 | 2025-12-15 | An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_ent… |
CVE-2025-34179 | | 2025-12-15 | NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server e… | |
CVE-2025-14383 | High | 7.5 | 2025-12-15 | The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and includi… |
CVE-2025-14711 | High | 7.3 | 2025-12-15 | A flaw has been found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This vulnerability affects unknown code of the file /contro… |