CWE-89 · SQL Injection (page 32)
Page 32 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14223 | High | 7.3 | 2025-12-08 | A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php… |
CVE-2025-14222 | Medium | 6.3 | 2025-12-08 | A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This ma… |
CVE-2025-14218 | High | 7.3 | 2025-12-08 | A security flaw has been discovered in code-projects Currency Exchange System 1.0. The affected element is an unknown function of the file /editotheraccount.ph… |
CVE-2025-14217 | High | 7.3 | 2025-12-08 | A vulnerability was identified in code-projects Currency Exchange System 1.0. Impacted is an unknown function of the file /edittrns.php. Such manipulation of t… |
CVE-2025-14216 | High | 7.3 | 2025-12-08 | A vulnerability was determined in code-projects Currency Exchange System 1.0. This issue affects some unknown processing of the file /viewserial.php. This mani… |
CVE-2025-14215 | High | 7.3 | 2025-12-08 | A vulnerability was found in code-projects Currency Exchange System 1.0. This vulnerability affects unknown code of the file /edit.php. The manipulation of the… |
CVE-2025-14214 | Medium | 6.3 | 2025-12-08 | A vulnerability has been found in itsourcecode Student Information System 1.0. This affects an unknown part of the file /section_edit1.php. The manipulation of… |
CVE-2025-14212 | High | 7.3 | 2025-12-08 | A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /member_search… |
CVE-2025-14211 | High | 7.3 | 2025-12-08 | A vulnerability was detected in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2025-14210 | High | 7.3 | 2025-12-08 | A security vulnerability has been detected in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /delete_member… |
CVE-2025-14209 | High | 7.3 | 2025-12-08 | A weakness has been identified in Campcodes School File Management System 1.0. This impacts an unknown function of the file /update_query.php. This manipulatio… |
CVE-2025-14207 | High | 7.3 | 2025-12-08 | A vulnerability was identified in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. The impacted element is an unknown functi… |
CVE-2025-14203 | Medium | 6.3 | 2025-12-07 | A flaw has been found in code-projects Question Paper Generator up to 1.0. This vulnerability affects unknown code of the file /selectquestionuser.php. This ma… |
CVE-2025-14193 | Medium | 6.3 | 2025-12-07 | A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php… |
CVE-2025-14192 | High | 7.3 | 2025-12-07 | A vulnerability was found in RashminDungrani online-banking up to 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. This affects an unknown part of the file /site/dist… |
CVE-2025-14190 | High | 7.3 | 2025-12-07 | A flaw has been found in Chanjet TPlus up to 20251121. Affected by this vulnerability is an unknown functionality of the file /tplus/ajaxpro/Ufida.T.SM.UIP.Mul… |
CVE-2025-14189 | High | 7.3 | 2025-12-07 | A vulnerability was detected in Chanjet CRM up to 20251121. Affected is an unknown function of the file /tools/jxf_dump_table_demo.php. The manipulation of the… |
CVE-2025-14185 | Medium | 6.3 | 2025-12-07 | A vulnerability was identified in Yonyou U8 Cloud 5.0/5.0sp/5.1/5.1sp. The affected element is an unknown function of the file nc/pubitf/erm/mobile/appservice/… |
CVE-2025-13922 | Medium | 6.5 | 2025-12-06 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_term… |
CVE-2025-14091 | High | 7.3 | 2025-12-05 | A weakness has been identified in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555. This vulnerability affects unknown code of the… |
CVE-2025-14090 | Medium | 4.7 | 2025-12-05 | A security flaw has been discovered in AMTT Hotel Broadband Operation System 1.0. This affects an unknown part of the file /manager/card/cardmake_down.php. Per… |
CVE-2025-12850 | High | 7.5 | 2025-12-05 | The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to… |
CVE-2025-13373 | High | 7.5 | 2025-12-04 | Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands. |
CVE-2024-58276 | | 2025-12-04 | Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execut… | |
CVE-2023-53734 | | 2025-12-04 | dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain admin… | |
CVE-2025-14012 | Medium | 4.7 | 2025-12-04 | A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/del… |
CVE-2025-14011 | Medium | 4.7 | 2025-12-04 | A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component… |
CVE-2025-62173 | | 2025-12-04 | ## Summary Authenticated SQL Injection Vulnerability in Endpoint Module Rest API | |
CVE-2025-13359 | Medium | 6.5 | 2025-12-03 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" f… |
CVE-2025-13495 | Medium | 4.9 | 2025-12-03 | The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to ins… |
CVE-2025-65380 | Medium | 6.5 | 2025-12-02 | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user inp… |
CVE-2025-65877 | High | 7.5 | 2025-12-02 | Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms… |
CVE-2025-65379 | Medium | 6.5 | 2025-12-02 | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mobileno parameters a… |
CVE-2025-65896 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys. |
CVE-2025-60736 | Critical | 9.8 | 2025-12-02 | code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter. |
CVE-2025-65358 | Critical | 9.8 | 2025-12-02 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php. |
CVE-2025-13372 | Medium | 4.3 | 2025-12-02 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using… |
CVE-2025-41013 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by se… |
CVE-2025-12465 | | 2025-12-02 | A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allo… | |
CVE-2025-13090 | Medium | 4.9 | 2025-12-02 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insuffic… |
CVE-2025-13724 | High | 7.5 | 2025-12-02 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up t… |
CVE-2025-12483 | Medium | 6.5 | 2025-12-02 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'query' parameter in all versions up to, an… |
CVE-2025-13001 | Medium | 4.1 | 2025-12-02 | The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as a… |
CVE-2025-13000 | High | 7.7 | 2025-12-02 | The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQL… |
CVE-2025-66313 | High | 7.2 | 2025-12-01 | ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSe… |
CVE-2025-66205 | High | 7.1 | 2025-12-01 | Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of v… |
CVE-2025-51683 | Critical | 9.8 | 2025-12-01 | A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request… |
CVE-2025-63535 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize usersuppl… |
CVE-2025-63532 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The application fails to properly sanitize user-s… |
CVE-2025-63531 | Critical | 10.0 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize… |
CVE-2025-13811 | Medium | 6.3 | 2025-12-01 | A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/con… |
CVE-2025-13788 | High | 7.3 | 2025-11-30 | A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipula… |
CVE-2025-13783 | Medium | 6.3 | 2025-11-30 | A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file… |
CVE-2025-13782 | High | 7.3 | 2025-11-30 | A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file applic… |
CVE-2025-13770 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2025-13769 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2025-13757 | High | 8.8 | 2025-11-27 | SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-11461 | High | 8.8 | 2025-11-26 | Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue af… |
CVE-2025-65236 | Critical | 9.8 | 2025-11-26 | OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.p… |
CVE-2025-65235 | Critical | 9.8 | 2025-11-26 | OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByPr… |
CVE-2025-62728 | Medium | 5.4 | 2025-11-26 | SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulnerability is only exp… |
CVE-2025-66260 | Medium | 6.5 | 2025-11-26 | PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 35… |
CVE-2025-61167 | Medium | 6.5 | 2025-11-25 | SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id and datas parameter… |
CVE-2025-59369 | | 2025-11-25 | A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary… | |
CVE-2025-13385 | Medium | 4.9 | 2025-11-25 | The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter i… |
CVE-2025-13370 | Medium | 4.9 | 2025-11-25 | The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insuff… |
CVE-2025-10144 | Medium | 6.5 | 2025-11-24 | The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all… |
CVE-2025-56401 | High | 7.6 | 2025-11-24 | ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName. |
CVE-2025-13586 | Medium | 4.7 | 2025-11-24 | A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipu… |
CVE-2025-13585 | High | 7.3 | 2025-11-24 | A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of… |
CVE-2025-7402 | High | 7.5 | 2025-11-24 | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in… |
CVE-2025-13583 | High | 7.3 | 2025-11-24 | A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST… |
CVE-2025-13582 | High | 7.3 | 2025-11-24 | A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the com… |
CVE-2025-13581 | Medium | 6.3 | 2025-11-24 | A vulnerability was identified in itsourcecode Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /schedule… |
CVE-2025-13580 | Medium | 6.3 | 2025-11-24 | A vulnerability was determined in code-projects Library System 1.0. Affected is an unknown function of the file /mail.php. This manipulation of the argument ID… |
CVE-2025-13579 | Medium | 6.3 | 2025-11-24 | A vulnerability was found in code-projects Library System 1.0. This impacts an unknown function of the file /return.php. The manipulation of the argument ID re… |
CVE-2025-13578 | High | 7.3 | 2025-11-24 | A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipul… |
CVE-2025-13575 | Medium | 6.3 | 2025-11-24 | A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php o… |
CVE-2025-13572 | High | 7.3 | 2025-11-23 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipul… |
CVE-2025-13571 | Medium | 6.3 | 2025-11-23 | A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.ph… |
CVE-2025-13570 | Medium | 6.3 | 2025-11-23 | A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=state… |
CVE-2025-13569 | Medium | 6.3 | 2025-11-23 | A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/?page=city. Such manipulation of t… |
CVE-2025-13568 | Medium | 6.3 | 2025-11-23 | A flaw has been found in itsourcecode COVID Tracking System 1.0. This impacts an unknown function of the file /admin/?page=people. This manipulation of the arg… |
CVE-2025-13567 | Medium | 6.3 | 2025-11-23 | A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This affects an unknown function of the file /admin/?page=establishment. The manipulati… |
CVE-2025-13561 | High | 7.3 | 2025-11-23 | A vulnerability was determined in SourceCodester Company Website CMS 1.0. This vulnerability affects unknown code of the file /admin/index.php. This manipulati… |
CVE-2025-13560 | High | 7.3 | 2025-11-23 | A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The manipulation of th… |
CVE-2025-13557 | High | 7.3 | 2025-11-23 | A vulnerability has been found in Campcodes Online Polling System 1.0. Affected by this issue is some unknown functionality of the file /registeracc.php. The m… |
CVE-2025-13556 | High | 7.3 | 2025-11-23 | A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Exe… |
CVE-2025-13555 | High | 7.3 | 2025-11-23 | A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Per… |
CVE-2025-13554 | High | 7.3 | 2025-11-23 | A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the componen… |
CVE-2025-13546 | Medium | 6.3 | 2025-11-23 | A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality… |
CVE-2025-13545 | Medium | 4.7 | 2025-11-23 | A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an u… |
CVE-2025-66095 | High | 8.5 | 2025-11-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system… |
CVE-2025-13138 | High | 7.5 | 2025-11-21 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up… |
CVE-2025-12750 | Medium | 4.9 | 2025-11-21 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in all versions up to… |
CVE-2025-13485 | High | 7.3 | 2025-11-21 | A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=… |
CVE-2025-52410 | Critical | 9.8 | 2025-11-20 | Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is no… |
CVE-2025-60798 | Medium | 6.5 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['q… |
CVE-2025-60797 | Medium | 6.5 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries… |
CVE-2025-13451 | High | 7.3 | 2025-11-20 | A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.php. Such manipulatio… |