CWE-89 · SQL Injection (page 32)
Page 32 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3411 | High | 7.3 | 2026-03-02 | A security vulnerability has been detected in itsourcecode University Management System 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2026-3410 | High | 7.3 | 2026-03-02 | A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/che… |
CVE-2026-3406 | High | 7.3 | 2026-03-02 | A vulnerability was found in projectworlds Online Art Gallery Shop 1.0. The impacted element is an unknown function of the file /admin/registration.php of the… |
CVE-2026-28562 | High | 8.2 | 2026-02-28 | wpForo 2.4.14 contains an unauthenticated SQL injection vulnerability in Topics::get_topics() where the ORDER BY clause relies on ineffective esc_sql() sanitiz… |
CVE-2025-13673 | High | 7.5 | 2026-02-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to… |
CVE-2026-28516 | High | 8.8 | 2026-02-27 | openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php h… |
CVE-2026-27832 | High | 8.8 | 2026-02-27 | Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.8, 25.0.87, and 6.8.153 have a SQL Injection (SQLi) v… |
CVE-2019-25497 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25496 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25495 | High | 8.2 | 2026-02-27 | osCommerce 2.3.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25494 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains an SQL injection vulnerability in the administration panel login that allows unauthenticated attackers to bypass authentication by inject… |
CVE-2019-25493 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'va… |
CVE-2019-25492 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'pt… |
CVE-2019-25491 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the cat… |
CVE-2019-25490 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'id'… |
CVE-2019-25489 | High | 8.2 | 2026-02-27 | Homey BNB V4 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the host… |
CVE-2026-2751 | High | 8.3 | 2026-02-27 | Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dep… |
CVE-2025-15498 | | 2026-02-27 | Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass auth… | |
CVE-2025-11252 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm… |
CVE-2026-2831 | Medium | 4.9 | 2026-02-27 | The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient… |
CVE-2025-11251 | Critical | 9.8 | 2026-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platf… |
CVE-2026-3292 | Medium | 6.3 | 2026-02-27 | A security vulnerability has been detected in jizhiCMS up to 2.5.6. Affected is the function findAll in the library frphp/lib/Model.php of the component Batch… |
CVE-2026-3287 | Medium | 6.3 | 2026-02-27 | A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/c… |
CVE-2026-28226 | Medium | 6.5 | 2026-02-26 | Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL injection vulnerability exists in the Get… |
CVE-2026-3261 | High | 7.3 | 2026-02-26 | A flaw has been found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /settings/index.php of the component Setting H… |
CVE-2026-27149 | Medium | 6.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (`list_private_messages… |
CVE-2026-22206 | High | 8.8 | 2026-02-26 | SPIP versions prior to 4.4.10 contain a SQL injection vulnerability that allows authenticated low-privilege users to execute arbitrary SQL queries by manipulat… |
CVE-2026-1198 | | 2026-02-26 | SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker… | |
CVE-2026-28136 | High | 7.6 | 2026-02-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VeronaLabs WP SMS wp-sms allows SQL Injection.This issue… |
CVE-2026-26186 | High | 8.8 | 2026-02-26 | Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL… |
CVE-2026-27497 | High | 8.8 | 2026-02-25 | n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify wo… |
CVE-2026-3200 | High | 7.3 | 2026-02-25 | A vulnerability was identified in z-9527 admin 1.0/2.0. The affected element is the function checkName/register/login/getUser/getUsers of the file /server/cont… |
CVE-2026-25746 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulner… |
CVE-2026-24908 | Critical | 9.9 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability… |
CVE-2026-23627 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability… |
CVE-2026-25554 | Medium | 6.5 | 2026-02-25 | OpenSIPS versions 3.1 before 3.6.4 containing the auth_jwt module (prior to commit 3822d33) contain a SQL injection vulnerability in the jwt_db_authorize() fun… |
CVE-2026-27847 | Critical | 9.8 | 2026-02-25 | Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be used to inject known… |
CVE-2026-3118 | Medium | 6.5 | 2026-02-25 | A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQ… |
CVE-2026-2416 | High | 7.5 | 2026-02-25 | The Geo Mashup plugin for WordPress is vulnerable to SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.17. This is due to insuf… |
CVE-2026-3164 | High | 7.3 | 2026-02-25 | A vulnerability was found in itsourcecode News Portal Project 1.0. This issue affects some unknown processing of the file /admin/contactus.php. The manipulatio… |
CVE-2026-3153 | High | 7.3 | 2026-02-25 | A vulnerability has been found in itsourcecode Document Management System 1.0. Impacted is an unknown function of the file /register.php. Such manipulation of… |
CVE-2026-3152 | High | 7.3 | 2026-02-25 | A flaw has been found in itsourcecode College Management System 1.0. This issue affects some unknown processing of the file /admin/teacher-salary.php. This man… |
CVE-2026-3151 | High | 7.3 | 2026-02-25 | A vulnerability was detected in itsourcecode College Management System 1.0. This vulnerability affects unknown code of the file /login/login.php. The manipulat… |
CVE-2026-3150 | Medium | 6.3 | 2026-02-25 | A security vulnerability has been detected in itsourcecode College Management System 1.0. This affects an unknown part of the file /admin/display-teacher.php… |
CVE-2026-3149 | Medium | 6.3 | 2026-02-25 | A weakness has been identified in itsourcecode College Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/asign-sin… |
CVE-2026-3148 | High | 7.3 | 2026-02-25 | A vulnerability was determined in SourceCodester Simple and Nice Shopping Cart Script 1.0. This impacts an unknown function of the file /signup.php. This manip… |
CVE-2026-27747 | High | 8.8 | 2026-02-25 | The SPIP interface_traduction_objets plugin versions prior to 2.2.2 contain an authenticated SQL injection vulnerability in interface_traduction_objets_pipelin… |
CVE-2026-27743 | Critical | 9.8 | 2026-02-25 | The SPIP referer_spam plugin versions prior to 1.3.0 contain an unauthenticated SQL injection vulnerability in the referer_spam_ajouter and referer_spam_suppri… |
CVE-2026-3135 | High | 7.3 | 2026-02-25 | A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This m… |
CVE-2026-3134 | High | 7.3 | 2026-02-25 | A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-cat… |
CVE-2026-3133 | High | 7.3 | 2026-02-25 | A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the compon… |
CVE-2026-21410 | Critical | 9.8 | 2026-02-24 | InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able… |
CVE-2026-3105 | High | 7.6 | 2026-02-24 | SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query co… |
CVE-2026-23980 | Medium | 6.5 | 2026-02-24 | Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read acc… |
CVE-2026-23969 | Medium | 6.5 | 2026-02-24 | Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab a… |
CVE-2025-11165 | Critical | 9.9 | 2026-02-24 | A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class… |
CVE-2026-3069 | High | 7.3 | 2026-02-24 | A security vulnerability has been detected in itsourcecode Document Management System 1.0. Affected is an unknown function of the file /edtlbls.php. The manipu… |
CVE-2026-3068 | High | 7.3 | 2026-02-24 | A weakness has been identified in itsourcecode Document Management System 1.0. This impacts an unknown function of the file /deluser.php. Executing a manipulat… |
CVE-2026-27461 | Medium | 4.9 | 2026-02-24 | Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the depend… |
CVE-2026-3057 | Medium | 6.3 | 2026-02-24 | A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model… |
CVE-2026-26198 | Critical | 9.8 | 2026-02-24 | Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user… |
CVE-2026-3046 | High | 7.3 | 2026-02-24 | A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This vulnerability affects unknown code of… |
CVE-2026-3042 | High | 7.3 | 2026-02-24 | A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing… |
CVE-2025-41002 | | 2026-02-23 | SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create, update, and delete the database by s… | |
CVE-2026-1367 | High | 8.3 | 2026-02-23 | Zohocorp ManageEngine ADSelfService Plus versions 6522 and below are vulnerable to authenticated SQL Injection in the search report option. |
CVE-2026-24494 | Critical | 9.8 | 2026-02-23 | SQL Injection vulnerability in the /api/integrations/getintegrations endpoint of Order Up Online Ordering System 1.0 allows an unauthenticated attacker to acce… |
CVE-2026-2963 | Medium | 6.3 | 2026-02-23 | A vulnerability was determined in Jinher OA C6 up to 20260210. This issue affects some unknown processing of the file /C6/Jhsoft.Web.officesupply/OfficeSupplyT… |
CVE-2019-25462 | High | 8.2 | 2026-02-22 | Web Ofisi Rent a Car v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code thro… |
CVE-2019-25461 | High | 7.5 | 2026-02-22 | Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL c… |
CVE-2019-25460 | High | 7.5 | 2026-02-22 | Web Ofisi Platinum E-Ticaret v5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL c… |
CVE-2019-25459 | Critical | 9.8 | 2026-02-22 | Web Ofisi Emlak V2 contains multiple SQL injection vulnerabilities in the endpoint that allow unauthenticated attackers to manipulate database queries through… |
CVE-2019-25458 | Critical | 9.8 | 2026-02-22 | Web Ofisi Firma Rehberi v1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code t… |
CVE-2019-25457 | High | 7.5 | 2026-02-22 | Web Ofisi Firma v13 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2019-25456 | Critical | 9.1 | 2026-02-22 | Web Ofisi Emlak v2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t… |
CVE-2019-25455 | High | 7.5 | 2026-02-22 | Web Ofisi E-Ticaret v3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code throu… |
CVE-2019-25452 | High | 7.5 | 2026-02-22 | Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers… |
CVE-2019-25450 | High | 7.5 | 2026-02-22 | Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2019-25446 | High | 8.2 | 2026-02-22 | DIGIT CENTRIS ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th… |
CVE-2019-25443 | High | 8.2 | 2026-02-22 | Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET… |
CVE-2019-25442 | High | 7.5 | 2026-02-22 | Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through… |
CVE-2019-25440 | High | 8.2 | 2026-02-22 | WebIncorp ERP contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pr… |
CVE-2019-25439 | High | 8.2 | 2026-02-22 | NoviSmart CMS contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the Ref… |
CVE-2019-25433 | High | 8.2 | 2026-02-22 | XOOPS CMS 2.5.9 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the… |
CVE-2019-25391 | High | 8.2 | 2026-02-22 | Ashop Shopping Cart Software contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through the blacklist… |
CVE-2019-25366 | High | 8.2 | 2026-02-22 | microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code… |
CVE-2026-2912 | High | 7.3 | 2026-02-22 | A vulnerability was found in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/students/assessments/results/… |
CVE-2026-2867 | High | 7.3 | 2026-02-21 | A vulnerability was determined in itsourcecode Vehicle Management System 1.0. Affected is an unknown function of the file /billaction.php. Executing a manipula… |
CVE-2026-2865 | High | 7.3 | 2026-02-21 | A vulnerability was found in itsourcecode Agri-Trading Online Shopping System 1.0. This impacts an unknown function of the file admin/productcontroller.php of… |
CVE-2026-27470 | High | 8.8 | 2026-02-21 | ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-o… |
CVE-2019-25438 | High | 7.5 | 2026-02-20 | LabCollector 5.423 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting maliciou… |
CVE-2019-25432 | High | 7.5 | 2026-02-20 | Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication paramete… |
CVE-2019-25431 | High | 8.2 | 2026-02-20 | delpino73 Blue-Smiley-Organizer 1.32 contains an SQL injection vulnerability in the datetime parameter that allows unauthenticated attackers to manipulate data… |
CVE-2019-25444 | Critical | 9.1 | 2026-02-20 | Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code th… |
CVE-2026-2848 | High | 7.3 | 2026-02-20 | A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/… |
CVE-2026-26745 | Medium | 5.3 | 2026-02-20 | OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially… |
CVE-2026-24959 | High | 8.5 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL I… |
CVE-2026-24956 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-eleme… |
CVE-2025-69366 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Inj… |
CVE-2025-69365 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injec… |
CVE-2025-69337 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Wolmart Core wolmart-core allows Blind SQL Inj… |