CWE-89 · SQL Injection (page 31)
Page 31 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14353 | High | 7.5 | 2026-03-07 | The ZIP Code Based Content Protection plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 1.0.2 via the 'zipcode' paramet… |
CVE-2018-25199 | High | 8.2 | 2026-03-06 | OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25197 | High | 8.2 | 2026-03-06 | PlayJoom 0.10.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code thro… |
CVE-2018-25196 | High | 8.2 | 2026-03-06 | ServerZilla 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2018-25192 | High | 8.2 | 2026-03-06 | GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through t… |
CVE-2018-25191 | High | 7.1 | 2026-03-06 | Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2018-25189 | High | 8.2 | 2026-03-06 | Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to execute arb… |
CVE-2018-25188 | High | 8.2 | 2026-03-06 | Webiness Inventory 2.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious co… |
CVE-2018-25187 | High | 8.2 | 2026-03-06 | Tina4 Stack 1.0.3 contains multiple vulnerabilities allowing unauthenticated attackers to access sensitive database files and execute SQL injection attacks. At… |
CVE-2018-25182 | High | 8.2 | 2026-03-06 | Silurus Classifieds Script 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting mali… |
CVE-2018-25180 | High | 7.1 | 2026-03-06 | Maitra 1.7.2 contains an sql injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2018-25179 | High | 8.2 | 2026-03-06 | Gumbo CMS 0.99 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code throu… |
CVE-2018-25175 | High | 8.2 | 2026-03-06 | Alienor Web Libre 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious cod… |
CVE-2018-25173 | High | 8.2 | 2026-03-06 | Rmedia SMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the… |
CVE-2018-25172 | High | 8.2 | 2026-03-06 | Pedidos 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25167 | High | 8.2 | 2026-03-06 | Net-Billetterie 2.9 contains an SQL injection vulnerability in the login parameter of login.inc.php that allows unauthenticated attackers to execute arbitrary… |
CVE-2018-25166 | High | 8.2 | 2026-03-06 | Meneame English Pligg 5.8 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2018-25165 | High | 7.1 | 2026-03-06 | Galaxy Forces MMORPG 0.5.8 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious… |
CVE-2018-25163 | High | 8.2 | 2026-03-06 | BitZoom 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through… |
CVE-2018-25161 | High | 8.2 | 2026-03-06 | Warranty Tracking System 11.06.3 contains an SQL injection vulnerability that allows attackers to execute arbitrary SQL queries by injecting malicious code thr… |
CVE-2026-29073 | High | 8.8 | 2026-03-06 | SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not a… |
CVE-2026-28438 | Critical | 9.8 | 2026-03-06 | CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creatin… |
CVE-2026-28785 | Critical | 9.8 | 2026-03-06 | Ghostfolio is an open source wealth management software. Prior to version 2.244.0, by bypassing symbol validation, an attacker can execute arbitrary SQL comman… |
CVE-2026-27005 | Critical | 9.8 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3, an unaut… |
CVE-2026-28501 | Critical | 9.8 | 2026-03-06 | WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos… |
CVE-2026-3616 | Medium | 6.3 | 2026-03-06 | A vulnerability was detected in DefaultFuction Jeson Customer Relationship Management System 1.0.0. Impacted is an unknown function of the file /modules/custom… |
CVE-2026-29081 | Medium | 6.5 | 2026-03-05 | Frappe is a full-stack web application framework. Prior to versions 14.100.1 and 15.100.0, an endpoint was vulnerable to SQL injection through specially crafte… |
CVE-2026-28443 | Critical | 9.8 | 2026-03-05 | OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /{projectId}/cards/search endpoint has a SQL injection in the sort.field pa… |
CVE-2026-28284 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilitie… |
CVE-2026-28210 | High | 8.8 | 2026-03-05 | FreePBX is an open source IP PBX. Prior to versions 16.0.49 and 17.0.7, FreePBX module cdr (Call Data Record) is vulnerable to SQL query injection. This issue… |
CVE-2026-2893 | Medium | 6.5 | 2026-03-05 | The Page and Post Clone plugin for WordPress is vulnerable to SQL Injection via the 'meta_key' parameter in the content_clone() function in all versions up to… |
CVE-2026-28115 | Critical | 9.3 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Pay… |
CVE-2026-27428 | High | 8.5 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eagle-Themes Eagle Booking eagle-booking allows SQL Injec… |
CVE-2026-27373 | High | 8.5 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome tablesome allows Blind SQL Injection.Th… |
CVE-2025-69338 | Critical | 9.3 | 2026-03-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injecti… |
CVE-2026-3523 | Medium | 4.9 | 2026-03-05 | The Apocalypse Meow plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 22.1.0. This is due to a… |
CVE-2026-20003 | Medium | 4.9 | 2026-03-04 | A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected syst… |
CVE-2026-20002 | High | 8.1 | 2026-03-04 | A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attac… |
CVE-2026-20001 | Medium | 6.5 | 2026-03-04 | A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected syst… |
CVE-2019-25507 | High | 8.2 | 2026-03-04 | Ashop Shopping Cart Software contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2019-25506 | High | 8.2 | 2026-03-04 | FreeSMS 2.1.2 contains a boolean-based blind SQL injection vulnerability in the password parameter that allows unauthenticated attackers to bypass authenticati… |
CVE-2019-25505 | High | 7.1 | 2026-03-04 | Tradebox 5.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the symbo… |
CVE-2019-25504 | High | 8.2 | 2026-03-04 | NCrypted Jobgator contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25503 | High | 7.1 | 2026-03-04 | PHPads 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through t… |
CVE-2019-25501 | High | 8.2 | 2026-03-04 | Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the app_… |
CVE-2019-25500 | High | 8.2 | 2026-03-04 | Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25499 | High | 8.2 | 2026-03-04 | Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25498 | High | 8.2 | 2026-03-04 | Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2025-66944 | Critical | 9.8 | 2026-03-04 | SQL Injection vulnerability in vran-dev databaseir v.1.0.7 and before allows a remote attacker to execute arbitrary code via the query parameter in the search… |
CVE-2025-66678 | Critical | 9.8 | 2026-03-04 | An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execute arbitrary read a… |
CVE-2023-7337 | High | 7.5 | 2026-03-04 | The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie… |
CVE-2026-2363 | Medium | 6.5 | 2026-03-04 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'order_by' attribute of the [wpmem_user_membership_posts] shortcod… |
CVE-2026-1651 | Medium | 6.5 | 2026-03-04 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'workflow_ids' parameter in all versions up to, and includ… |
CVE-2026-3487 | Medium | 4.7 | 2026-03-03 | A vulnerability was found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/class-result.php. Perfor… |
CVE-2026-3486 | Medium | 4.7 | 2026-03-03 | A vulnerability has been found in itsourcecode College Management System 1.0. This vulnerability affects unknown code of the file /admin/student-fee.php. Such… |
CVE-2026-26892 | High | 7.2 | 2026-03-03 | Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage_carrier.php. |
CVE-2026-26891 | Low | 2.7 | 2026-03-03 | Sourcecodester Logistic Hub Parcel's Management System v1.0 is vulnerable to SQL Injection in /manage_parcel_type.php. |
CVE-2026-26889 | Low | 2.7 | 2026-03-03 | Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_category.php. |
CVE-2026-26888 | Low | 2.7 | 2026-03-03 | Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_stock.php. |
CVE-2026-26887 | Low | 2.7 | 2026-03-03 | Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_supplier.php. |
CVE-2026-26890 | Low | 2.7 | 2026-03-03 | Sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_product.php. |
CVE-2021-35484 | High | 8.2 | 2026-03-03 | Nokia IMPACT through 19.11.2.10-20210118042150283 allows an authenticated user to perform a Time-based Boolean Blind SQL Injection attack on the endpoint /ui/r… |
CVE-2026-26886 | Low | 2.7 | 2026-03-03 | Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /admin/services/manage_service.php. |
CVE-2026-26885 | Low | 2.7 | 2026-03-03 | Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /classes/Master.php?f=delete_service. |
CVE-2026-26884 | Low | 2.7 | 2026-03-03 | Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/admin/appointments/view_appointment.php. |
CVE-2026-26883 | Low | 2.7 | 2026-03-03 | Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/classes/Master.php?f=delete_appointment. |
CVE-2025-70821 | Critical | 9.8 | 2026-03-03 | renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component |
CVE-2026-1487 | Medium | 6.5 | 2026-03-03 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up… |
CVE-2026-26713 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php. |
CVE-2026-26712 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php. |
CVE-2026-26711 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php. |
CVE-2026-26710 | Critical | 9.8 | 2026-03-02 | code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php. |
CVE-2026-26709 | Critical | 9.8 | 2026-03-02 | code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php. |
CVE-2025-48650 | High | 8.4 | 2026-03-02 | In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional exe… |
CVE-2026-3180 | High | 7.5 | 2026-03-02 | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to blind SQL Injection via the ‘cgLostPasswordE… |
CVE-2026-26707 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php. |
CVE-2026-26706 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php. |
CVE-2026-26705 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php. |
CVE-2026-26704 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php. |
CVE-2026-28399 | High | 8.8 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator role can inject arbitrary SQL via the D… |
CVE-2026-26708 | Critical | 9.8 | 2026-03-02 | sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php. |
CVE-2026-26700 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php. |
CVE-2026-26701 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php. |
CVE-2026-26703 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/advance_search.php. |
CVE-2026-26702 | Critical | 9.8 | 2026-03-02 | sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/myitem_reuse.php. |
CVE-2026-26696 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php. |
CVE-2026-26695 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php. |
CVE-2026-26694 | Critical | 9.8 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php. |
CVE-2025-50192 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. Thi… |
CVE-2025-50191 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes… |
CVE-2025-50190 | Critical | 9.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /in… |
CVE-2025-50189 | High | 8.8 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST… |
CVE-2025-50188 | High | 7.2 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET v… |
CVE-2026-26698 | Medium | 4.9 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php. |
CVE-2026-26697 | Medium | 4.9 | 2026-03-02 | code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?teacherID=. |
CVE-2025-12462 | | 2026-03-02 | A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in multiple… | |
CVE-2025-30062 | | 2026-03-02 | In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection. | |
CVE-2025-10350 | | 2026-03-02 | SQL Injection vulnerability in "imageserver" module when processing C-FIND queries in CGM NETRAAD software allows attacker connected to PACS gaining access to… | |
CVE-2026-2584 | | 2026-03-02 | A critical SQL Injection (SQLi) vulnerability has been identified in the authentication module of the system. An unauthenticated, remote attacker (AV:N/PR:N) c… | |
CVE-2026-3413 | High | 7.3 | 2026-03-02 | A flaw has been found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /admin_single_student.php. This man… |