CWE-89 · SQL Injection (page 30)
Page 30 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-25528 | High | 8.2 | 2026-03-12 | Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2019-25527 | High | 8.2 | 2026-03-12 | Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2019-25526 | High | 8.2 | 2026-03-12 | Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2019-25525 | High | 8.2 | 2026-03-12 | Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting… |
CVE-2019-25524 | High | 8.2 | 2026-03-12 | XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25523 | High | 8.2 | 2026-03-12 | XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25522 | High | 8.2 | 2026-03-12 | XooGallery Latest contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code thr… |
CVE-2019-25521 | High | 8.2 | 2026-03-12 | XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25520 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an authentication bypass vulnerability in the administration panel that allows unauthenticated attackers to… |
CVE-2019-25519 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious S… |
CVE-2019-25518 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injec… |
CVE-2019-25517 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injec… |
CVE-2019-25516 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injec… |
CVE-2019-25515 | High | 7.5 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an authentication bypass vulnerability in the login.php administration panel that allows unauthenticated att… |
CVE-2019-25514 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows attackers to inject malicious SQL commands through the kelime par… |
CVE-2019-25513 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injec… |
CVE-2019-25512 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows attackers to inject malicious SQL commands through the kelime par… |
CVE-2019-25511 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injec… |
CVE-2019-25510 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Haber Sitesi Scripti V2 contains an authentication bypass vulnerability in the administration panel that allows unauthenticated attackers to… |
CVE-2019-25509 | High | 8.2 | 2026-03-12 | XooDigital Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25508 | High | 8.2 | 2026-03-12 | Jettweb Php Hazir Ilan Sitesi Scripti V2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by inject… |
CVE-2019-25488 | High | 8.2 | 2026-03-12 | Jettweb Hazir Rent A Car Scripti V4 contains multiple SQL injection vulnerabilities in the admin panel that allow unauthenticated attackers to manipulate datab… |
CVE-2019-25482 | High | 8.2 | 2026-03-12 | Jettweb PHP Hazir Rent A Car Sitesi Scripti V2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by… |
CVE-2019-25481 | High | 8.2 | 2026-03-12 | iScripts ReserveLogic contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code throug… |
CVE-2019-25479 | High | 8.2 | 2026-03-12 | Inout RealEstate contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2019-25473 | High | 7.1 | 2026-03-12 | Clinic Pro contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the month pa… |
CVE-2026-4014 | High | 7.3 | 2026-03-12 | A security flaw has been discovered in itsourcecode Cafe Reservation System 1.0. This impacts an unknown function of the file /curvus2/signup.php of the compon… |
CVE-2026-3981 | High | 7.3 | 2026-03-12 | A vulnerability was found in itsourcecode Online Doctor Appointment System 1.0. Affected is an unknown function of the file /admin/doctor_action.php. Performin… |
CVE-2026-3980 | High | 7.3 | 2026-03-12 | A vulnerability has been found in itsourcecode Online Doctor Appointment System 1.0. This impacts an unknown function of the file /admin/patient_action.php. Su… |
CVE-2026-3657 | High | 7.5 | 2026-03-12 | The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including… |
CVE-2026-3969 | High | 7.3 | 2026-03-12 | A vulnerability was detected in FeMiner wms up to 1.0. This impacts an unknown function of the file /wms-master/src/basic/depart/depart_add_bg.php of the compo… |
CVE-2026-3957 | Medium | 4.7 | 2026-03-11 | A flaw has been found in xierongwkhd weimai-wetapp up to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2. This vulnerability affects the function getLikeMovieList of… |
CVE-2026-3956 | Medium | 4.7 | 2026-03-11 | A vulnerability was detected in xierongwkhd weimai-wetapp up to 5fe9e8225be4f73f2c5087f134aff657bdf1c6f2. This affects the function getAdmins of the file sourc… |
CVE-2026-32127 | High | 8.8 | 2026-03-11 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vul… |
CVE-2025-70024 | Critical | 9.8 | 2026-03-11 | An issue pertaining to CWE-89: Improper Neutralization of Special Elements used in an SQL Command was discovered in benkeen generatedata 4.0.14. |
CVE-2026-32234 | Medium | 4.7 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with ac… |
CVE-2026-31896 | Critical | 9.8 | 2026-03-11 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, a critical SQL injection vulnerability exists in the WeGIA application. The remover… |
CVE-2026-31895 | High | 8.8 | 2026-03-11 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vu… |
CVE-2026-31877 | Critical | 9.8 | 2026-03-11 | Frappe is a full-stack web application framework. Prior to 15.84.0 and 14.99.0, a specially crafted request made to a certain endpoint could result in SQL inje… |
CVE-2019-25486 | High | 8.2 | 2026-03-11 | Varient 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the us… |
CVE-2026-31871 | Critical | 9.8 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.5 and 8.6.31, a SQL injection vuln… |
CVE-2026-31858 | High | 8.8 | 2026-03-11 | Craft is a content management system (CMS). The ElementSearchController::actionSearch() endpoint is missing the unset() protection that was added to ElementInd… |
CVE-2026-31856 | Critical | 9.8 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL… |
CVE-2026-31840 | Critical | 9.8 | 2026-03-11 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use… |
CVE-2026-3496 | High | 7.5 | 2026-03-11 | The JetBooking plugin for WordPress is vulnerable to SQL Injection via the 'check_in_date' parameter in all versions up to, and including, 4.0.3. This is due t… |
CVE-2026-3944 | High | 7.3 | 2026-03-11 | A vulnerability was determined in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /att_add.php. This manipul… |
CVE-2026-1708 | High | 7.5 | 2026-03-11 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to… |
CVE-2024-14025 | Medium | 6.7 | 2026-03-11 | An SQL injection vulnerability has been reported to affect Video Station. If an attacker gains local network access who have also gained an administrator accou… |
CVE-2026-31844 | High | 8.8 | 2026-03-11 | An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper… |
CVE-2026-3222 | High | 7.5 | 2026-03-11 | The WP Maps plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'location_id' parameter in all versions up to, and including, 4.9.1. T… |
CVE-2026-2413 | High | 7.5 | 2026-03-11 | The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This… |
CVE-2026-31825 | Medium | 5.3 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied… |
CVE-2026-30951 | High | 7.5 | 2026-03-10 | Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() fun… |
CVE-2026-29174 | High | 8.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoin… |
CVE-2026-29172 | High | 8.8 | 2026-03-10 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchasables table endpo… |
CVE-2026-3843 | Critical | 9.8 | 2026-03-10 | Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module… |
CVE-2026-30930 | Critical | 9.8 | 2026-03-10 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenatio… |
CVE-2026-26116 | High | 8.8 | 2026-03-10 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-56421 | High | 7.5 | 2026-03-10 | SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database. |
CVE-2025-49784 | Medium | 6.0 | 2026-03-10 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnaly… |
CVE-2026-27684 | Medium | 6.4 | 2026-03-10 | SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through… |
CVE-2026-3818 | High | 7.3 | 2026-03-09 | A flaw has been found in Tiandy Easy7 CMS Windows 7.17.0. Impacted is an unknown function of the file /Easy7/apps/WebService/GetDBData.jsp. This manipulation o… |
CVE-2025-40639 | Critical | 9.8 | 2026-03-09 | A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the '… |
CVE-2026-3806 | Medium | 6.3 | 2026-03-09 | A weakness has been identified in SourceCodester/janobe Resort Reservation System 1.0. This issue affects some unknown processing of the file /room_rates.php… |
CVE-2026-3793 | Medium | 6.3 | 2026-03-09 | A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file sales_invoice1.php of the… |
CVE-2026-3792 | Medium | 6.3 | 2026-03-09 | A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file purchase_invoice.php of the component GET… |
CVE-2026-3791 | Medium | 6.3 | 2026-03-09 | A vulnerability has been found in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file dashboard.php… |
CVE-2026-3790 | Medium | 6.3 | 2026-03-09 | A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file check_supplier_d… |
CVE-2026-3786 | Medium | 6.3 | 2026-03-08 | A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Re… |
CVE-2026-3785 | Medium | 6.3 | 2026-03-08 | A vulnerability was identified in EasyCMS up to 1.6. The affected element is an unknown function of the file /RbacnodeAction.class.php of the component Request… |
CVE-2026-3771 | Medium | 6.3 | 2026-03-08 | A vulnerability has been found in SourceCodester/janobe Resort Reservation System 1.0. This vulnerability affects unknown code of the file /accomodation.php. S… |
CVE-2026-3767 | Medium | 6.3 | 2026-03-08 | A weakness has been identified in itsourcecode sanitize or validate this input 1.0. Affected is an unknown function of the file /admin/teacher-attendance.php… |
CVE-2026-3765 | High | 7.3 | 2026-03-08 | A vulnerability was identified in itsourcecode University Management System 1.0. This affects an unknown function of the file /att_single_view.php. Such manipu… |
CVE-2026-3760 | High | 7.3 | 2026-03-08 | A vulnerability was detected in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /view_result.php. Performing… |
CVE-2026-3759 | High | 7.3 | 2026-03-08 | A security vulnerability has been detected in projectworlds Online Art Gallery Shop 1.0. This affects an unknown part of the file /admin/adminHome.php. Such ma… |
CVE-2026-3758 | High | 7.3 | 2026-03-08 | A weakness has been identified in projectworlds Online Art Gallery Shop 1.0. Affected by this issue is some unknown functionality of the file /admin/adminHome… |
CVE-2026-3757 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in projectworlds Online Art Gallery Shop 1.0. Affected by this vulnerability is an unknown functionality of the file /?pass… |
CVE-2026-3756 | Medium | 6.3 | 2026-03-08 | A vulnerability was identified in SourceCodester Sales and Inventory System up to 1.0. Affected is an unknown function of the file /check_item_details.php. The… |
CVE-2026-3755 | Medium | 6.3 | 2026-03-08 | A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /check_customer_details.php of th… |
CVE-2026-3754 | Medium | 6.3 | 2026-03-08 | A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown function of the file /add_stock.php. Performing a manipulat… |
CVE-2026-3753 | Medium | 6.3 | 2026-03-08 | A vulnerability has been found in SourceCodester Sales and Inventory System up to 1.0. The impacted element is an unknown function of the file /add_sales_print… |
CVE-2026-3752 | Medium | 4.7 | 2026-03-08 | A flaw has been found in SourceCodester Employee Task Management System up to 1.0. The affected element is an unknown function of the file /daily-task-report.p… |
CVE-2026-3751 | Medium | 4.7 | 2026-03-08 | A vulnerability was detected in SourceCodester Employee Task Management System 1.0. Impacted is an unknown function of the file /daily-attendance-report.php of… |
CVE-2026-3747 | High | 7.3 | 2026-03-08 | A vulnerability was identified in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /add_result.p… |
CVE-2026-3746 | High | 7.3 | 2026-03-08 | A vulnerability was determined in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-3745 | Medium | 6.3 | 2026-03-08 | A vulnerability was found in code-projects Student Web Portal 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument Us… |
CVE-2026-3744 | High | 7.3 | 2026-03-08 | A vulnerability has been found in code-projects Student Web Portal 1.0. This impacts the function valreg_passwdation of the file signup.php. The manipulation o… |
CVE-2026-3740 | High | 7.3 | 2026-03-08 | A weakness has been identified in itsourcecode University Management System 1.0. Impacted is an unknown function of the file /admin_search_student.php. This ma… |
CVE-2026-3736 | High | 7.3 | 2026-03-08 | A vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0. Affected by this issue is some unknown functionality of the file SearchResu… |
CVE-2026-3735 | High | 7.3 | 2026-03-08 | A vulnerability has been found in code-projects Simple Flight Ticket Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-3730 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in itsourcecode Free Hotel Reservation System 1.0. The affected element is an unknown function of the file /hotel/admin/mod… |
CVE-2026-3723 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /Admindelete.php. Th… |
CVE-2026-3711 | Medium | 4.7 | 2026-03-08 | A vulnerability was detected in code-projects Simple Flight Ticket Booking System 1.0. Affected is an unknown function of the file /Adminupdate.php. The manipu… |
CVE-2026-3710 | Medium | 4.7 | 2026-03-08 | A security vulnerability has been detected in code-projects Simple Flight Ticket Booking System 1.0. This impacts an unknown function of the file /Adminadd.php… |
CVE-2026-3709 | High | 7.3 | 2026-03-08 | A weakness has been identified in code-projects Simple Flight Ticket Booking System 1.0. This affects an unknown function of the file /register.php. Executing… |
CVE-2026-3708 | High | 7.3 | 2026-03-08 | A security flaw has been discovered in code-projects Simple Flight Ticket Booking System 1.0. The impacted element is an unknown function of the file /login.ph… |
CVE-2026-3705 | High | 7.3 | 2026-03-08 | A vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0. This issue affects some unknown processing of the file /Adminsearch.php. Th… |
CVE-2026-3672 | Medium | 6.3 | 2026-03-07 | A vulnerability has been found in JeecgBoot up to 3.9.1. Affected is the function isExistSqlInjectKeyword of the file /jeecg-boot/sys/api/getDictItems. Such ma… |
CVE-2026-30860 | Critical | 9.9 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.12, a remote code execution (RCE) vul… |
CVE-2026-2429 | Medium | 4.9 | 2026-03-07 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_save_changes_venues` function in all vers… |