CWE-89 · SQL Injection (page 33)
Page 33 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69310 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Inj… |
CVE-2025-69309 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind S… |
CVE-2025-69308 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL… |
CVE-2025-69307 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL I… |
CVE-2025-69306 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL I… |
CVE-2025-69305 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injec… |
CVE-2025-69304 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Allmart allmart-core allows Blind SQL Inject… |
CVE-2025-69295 | Critical | 9.3 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core allows Blind SQL Injec… |
CVE-2025-67987 | High | 8.5 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-ne… |
CVE-2025-10970 | Critical | 9.8 | 2026-02-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kolay Software Inc. Talentics allows Blind SQL Injection… |
CVE-2026-2822 | Medium | 6.3 | 2026-02-20 | A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag… |
CVE-2026-2821 | High | 7.3 | 2026-02-20 | A weakness has been identified in Fujian Smart Integrated Management Platform System up to 7.5. Impacted is an unknown function of the file /Module/CRXT/Contro… |
CVE-2026-2820 | High | 7.3 | 2026-02-20 | A security flaw has been discovered in Fujian Smart Integrated Management Platform System up to 7.5. This issue affects some unknown processing of the file /Mo… |
CVE-2026-26990 | High | 8.8 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in… |
CVE-2026-26988 | Critical | 9.1 | 2026-02-20 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_tab… |
CVE-2026-26980 | Critical | 9.4 | 2026-02-20 | Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This… |
CVE-2026-2435 | Medium | 6.3 | 2026-02-20 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2026-2409 | | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suite allows Argument Injection.This issue… | |
CVE-2026-2232 | High | 7.5 | 2026-02-19 | The Product Table and List Builder for WooCommerce Lite plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versio… |
CVE-2026-1581 | High | 7.5 | 2026-02-19 | The wpForo Forum plugin for WordPress is vulnerable to time-based SQL Injection via the 'wpfob' parameter in all versions up to, and including, 2.4.14 due to i… |
CVE-2025-15560 | High | 8.8 | 2026-02-19 | An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Fireb… |
CVE-2026-25418 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bit Apps Bit Form bit-form allows SQL Injection.This issu… |
CVE-2026-25378 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows B… |
CVE-2026-23805 | High | 7.6 | 2026-02-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yoren Chang Media Search Enhanced media-search-enhanced a… |
CVE-2026-2706 | Medium | 6.3 | 2026-02-19 | A flaw has been found in code-projects Patient Record Management System 1.0. This affects an unknown function of the file /fecalysis_not.php. This manipulation… |
CVE-2026-2691 | High | 7.3 | 2026-02-19 | A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_regi… |
CVE-2026-2690 | High | 7.3 | 2026-02-19 | A flaw has been found in itsourcecode Event Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?actio… |
CVE-2026-2689 | High | 7.3 | 2026-02-19 | A vulnerability was detected in itsourcecode Event Management System 1.0. Affected is an unknown function of the file /admin/manage_booking.php. The manipulati… |
CVE-2026-0722 | Medium | 6.5 | 2026-02-19 | The Shield Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 21.0.8. This is due to the plugin al… |
CVE-2025-12707 | High | 7.5 | 2026-02-19 | The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3.2.1 due to in… |
CVE-2025-15585 | | 2026-02-19 | Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation req… | |
CVE-2026-2682 | Medium | 6.3 | 2026-02-18 | A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.210802(62532). Impacted is an unknown function of the file /mine/Publi… |
CVE-2025-12812 | | 2026-02-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Privileged Access Service. Remediation… | |
CVE-2026-27179 | High | 8.2 | 2026-02-18 | MajorDoMo (aka Major Domestic Module) contains an unauthenticated SQL injection vulnerability in the commands module. The commands_search.inc.php file directly… |
CVE-2026-2663 | Medium | 6.3 | 2026-02-18 | A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /frontend-api/system… |
CVE-2025-70152 | Critical | 9.8 | 2026-02-18 | code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /ad… |
CVE-2025-70149 | Critical | 9.8 | 2026-02-18 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter. |
CVE-2025-59920 | | 2026-02-18 | When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in… | |
CVE-2026-1317 | Medium | 6.5 | 2026-02-18 | The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is… |
CVE-2025-8781 | Medium | 4.9 | 2026-02-18 | The Bookster – WordPress Appointment Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘raw’ parameter in all versions up to, and incl… |
CVE-2026-2495 | High | 7.5 | 2026-02-18 | The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parame… |
CVE-2026-1639 | Medium | 6.5 | 2026-02-18 | The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort… |
CVE-2026-2576 | High | 7.5 | 2026-02-18 | The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'payment' paramet… |
CVE-2026-2621 | High | 7.3 | 2026-02-17 | A security vulnerability has been detected in Sciyon Koyuan Thermoelectricity Heat Network Management System 3.0. This affects an unknown part of the file /SIS… |
CVE-2026-2620 | High | 7.3 | 2026-02-17 | A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManag… |
CVE-2025-67102 | High | 7.6 | 2026-02-17 | A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the enti… |
CVE-2024-55270 | High | 8.8 | 2026-02-17 | phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. |
CVE-2025-70397 | High | 7.2 | 2026-02-17 | jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter. |
CVE-2026-2247 | | 2026-02-17 | SQL injection vulnerability (SQLi) in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker ex… | |
CVE-2025-7631 | High | 8.6 | 2026-02-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tumeva Internet Technologies Software Information Adverti… |
CVE-2026-2553 | Medium | 6.3 | 2026-02-16 | A security flaw has been discovered in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. This affects an unknown part of the… |
CVE-2026-1258 | Medium | 4.9 | 2026-02-14 | The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/import/tutorlms/map' AP… |
CVE-2026-2024 | High | 7.5 | 2026-02-14 | The PhotoStack Gallery plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 0.4.1 due to insuff… |
CVE-2025-69633 | Critical | 9.8 | 2026-02-13 | A SQL Injection vulnerability in the Advanced Popup Creator (advancedpopupcreator) module for PrestaShop 1.1.26 through 1.2.6 (Fixed in version 1.2.7) allows r… |
CVE-2019-25335 | High | 7.5 | 2026-02-12 | PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page. Attackers can bypass… |
CVE-2019-25325 | High | 8.2 | 2026-02-12 | Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by… |
CVE-2019-25320 | Medium | 6.5 | 2026-02-12 | E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating l… |
CVE-2019-25347 | High | 7.5 | 2026-02-12 | thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can i… |
CVE-2019-25346 | High | 7.5 | 2026-02-12 | TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter. Attackers can… |
CVE-2026-22821 | Medium | 4.9 | 2026-02-12 | mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vulnerability is fixed in 1.9.4. |
CVE-2025-70981 | Critical | 9.8 | 2026-02-12 | CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter. |
CVE-2025-10969 | Critical | 9.8 | 2026-02-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Pack… |
CVE-2025-13431 | Medium | 6.5 | 2026-02-11 | The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and including, 5.3.1 due… |
CVE-2026-25993 | Critical | 9.8 | 2026-02-10 | EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application embeds path / request_path values—derive… |
CVE-2026-25947 | High | 8.8 | 2026-02-10 | Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affec… |
CVE-2026-1602 | Medium | 6.5 | 2026-02-10 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-7636 | High | 8.8 | 2026-02-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc… |
CVE-2026-2094 | High | 8.8 | 2026-02-10 | Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read, modify, and… |
CVE-2026-2093 | High | 7.5 | 2026-02-10 | Docpedia developed by Flowring has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database c… |
CVE-2026-25495 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-element… |
CVE-2025-6830 | Critical | 9.8 | 2026-02-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module… |
CVE-2026-2225 | High | 7.3 | 2026-02-09 | A flaw has been found in itsourcecode News Portal Project 1.0. This vulnerability affects unknown code of the file /admin/index.php of the component Administra… |
CVE-2026-2236 | High | 7.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database cont… |
CVE-2026-2235 | Medium | 6.5 | 2026-02-09 | C&Cm@il developed by HGiga has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2026-2223 | High | 7.3 | 2026-02-09 | A security vulnerability has been detected in code-projects Online Reviewer System 1.0. Affected by this issue is some unknown functionality of the file /syste… |
CVE-2026-2221 | High | 7.3 | 2026-02-09 | A security flaw has been discovered in code-projects Online Reviewer System 1.0. Affected is an unknown function of the file /login/index.php of the component… |
CVE-2026-2220 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Reviewer System 1.0. This impacts an unknown function of the file /system/system/admins/assessments/pret… |
CVE-2026-2217 | High | 7.3 | 2026-02-09 | A vulnerability was found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. The mani… |
CVE-2026-2212 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /Administrator/PH… |
CVE-2026-2211 | High | 7.3 | 2026-02-09 | A vulnerability was determined in code-projects Online Music Site 1.0. Affected is an unknown function of the file /Administrator/PHP/AdminDeleteCategory.php… |
CVE-2026-2199 | High | 7.3 | 2026-02-09 | A security flaw has been discovered in code-projects Online Reviewer System 1.0. The impacted element is an unknown function of the file /reviewer/system/syste… |
CVE-2026-2198 | High | 7.3 | 2026-02-09 | A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /system/system/admins/asses… |
CVE-2026-2197 | High | 7.3 | 2026-02-09 | A vulnerability was determined in code-projects Online Reviewer System 1.0. Impacted is an unknown function of the file /system/system/admins/assessments/prete… |
CVE-2026-2196 | High | 7.3 | 2026-02-09 | A vulnerability was found in code-projects Online Reviewer System 1.0. This issue affects some unknown processing of the file /system/system/admins/assessments… |
CVE-2026-2195 | High | 7.3 | 2026-02-09 | A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /system/system/admins/assessmen… |
CVE-2026-2190 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. T… |
CVE-2026-2189 | High | 7.3 | 2026-02-08 | A vulnerability was identified in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/report/index.php. The manip… |
CVE-2026-2179 | Medium | 4.7 | 2026-02-08 | A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipul… |
CVE-2026-2176 | Medium | 6.3 | 2026-02-08 | A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unknown processing of the file index.py. Suc… |
CVE-2026-2173 | High | 7.3 | 2026-02-08 | A vulnerability was identified in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file login.php. The… |
CVE-2026-2172 | High | 7.3 | 2026-02-08 | A vulnerability was determined in code-projects Online Application System for Admission 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-2171 | High | 7.3 | 2026-02-08 | A vulnerability was found in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php of the component Logi… |
CVE-2026-2166 | High | 7.3 | 2026-02-08 | A security vulnerability has been detected in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /login/index.ph… |
CVE-2026-2162 | Medium | 4.7 | 2026-02-08 | A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the a… |
CVE-2026-2161 | High | 7.3 | 2026-02-08 | A vulnerability was found in itsourcecode Directory Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/forget-passw… |
CVE-2026-2158 | High | 7.3 | 2026-02-08 | A vulnerability was detected in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation o… |
CVE-2026-2136 | High | 7.3 | 2026-02-08 | A flaw has been found in projectworlds Online Food Ordering System 1.0. This affects an unknown function of the file /view-ticket.php. Executing a manipulation… |
CVE-2026-2134 | Medium | 4.7 | 2026-02-08 | A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/admin/man… |
CVE-2026-2132 | High | 7.3 | 2026-02-08 | A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpda… |
CVE-2026-2122 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The m… |