CWE-89 · SQL Injection (page 34)
Page 34 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2122 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The m… |
CVE-2026-2117 | High | 7.3 | 2026-02-08 | A vulnerability was found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/edit_activity.php. Perf… |
CVE-2026-2116 | High | 7.3 | 2026-02-08 | A vulnerability has been found in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/edit_expenses.php. Such manipu… |
CVE-2026-2115 | High | 7.3 | 2026-02-07 | A flaw has been found in itsourcecode Society Management System 1.0. This issue affects some unknown processing of the file /admin/delete_expenses.php. This ma… |
CVE-2026-2114 | High | 7.3 | 2026-02-07 | A vulnerability was detected in itsourcecode Society Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_admin.php. The mani… |
CVE-2026-2090 | High | 7.3 | 2026-02-07 | A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admin/message/search.p… |
CVE-2026-2089 | High | 7.3 | 2026-02-07 | A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php… |
CVE-2026-2088 | High | 7.3 | 2026-02-07 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/accepted-appointment.php. Su… |
CVE-2026-2087 | High | 7.3 | 2026-02-07 | A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. This… |
CVE-2026-2083 | High | 7.3 | 2026-02-07 | A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.php. Performing a ma… |
CVE-2025-15477 | Medium | 6.5 | 2026-02-07 | The Bucketlister plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode `category` and `id` attributes in all versions up to, and inclu… |
CVE-2026-2073 | High | 7.3 | 2026-02-07 | A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/user/index.php. Executing a… |
CVE-2020-37163 | High | 8.2 | 2026-02-07 | QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries through the '_located' parameter in the find… |
CVE-2020-37154 | High | 7.1 | 2026-02-07 | eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows attackers to manipulate database queries th… |
CVE-2020-37147 | High | 7.1 | 2026-02-07 | ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers to manipulate database queries through… |
CVE-2020-37141 | High | 8.2 | 2026-02-07 | AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module's maildetail.php script through the 'id' parameter. Attackers can manipulate the… |
CVE-2026-25544 | Critical | 9.8 | 2026-02-06 | Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded… |
CVE-2026-24418 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based S… |
CVE-2026-24417 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Bl… |
CVE-2026-24416 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Bl… |
CVE-2025-69216 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability… |
CVE-2025-69214 | High | 8.8 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the… |
CVE-2026-2060 | High | 7.3 | 2026-02-06 | A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /si… |
CVE-2026-24419 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based S… |
CVE-2026-2059 | High | 7.3 | 2026-02-06 | A vulnerability has been found in SourceCodester Medical Center Portal Management System 1.0. Affected is an unknown function of the file /emp_edit1.php. Such… |
CVE-2026-2058 | High | 7.3 | 2026-02-06 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file /… |
CVE-2019-25303 | High | 7.1 | 2026-02-06 | TheJshen ContentManagementSystem 1.04 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET paramete… |
CVE-2019-25300 | High | 7.1 | 2026-02-06 | thejshen Globitek CMS 1.4 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter. Attackers… |
CVE-2019-25299 | High | 7.1 | 2026-02-06 | RimbaLinux AhadPOS 1.11 contains a SQL injection vulnerability in the 'alamatCustomer' parameter that allows attackers to manipulate database queries through c… |
CVE-2019-25298 | Critical | 9.1 | 2026-02-06 | html5_snmp 1.11 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through Router_ID and Router_IP parameters… |
CVE-2026-2057 | High | 7.3 | 2026-02-06 | A vulnerability was detected in SourceCodester Medical Center Portal Management System 1.0. This affects an unknown function of the file /login.php. The manipu… |
CVE-2026-2018 | High | 7.3 | 2026-02-06 | A flaw has been found in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/settings/controller.php. This manipulati… |
CVE-2026-2014 | High | 7.3 | 2026-02-06 | A security flaw has been discovered in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /ramonsys/billing/index.php. Pe… |
CVE-2026-2013 | High | 7.3 | 2026-02-06 | A vulnerability was identified in itsourcecode Student Management System 1.0. This affects an unknown function of the file /ramonsys/soa/index.php. Such manipu… |
CVE-2026-2012 | High | 7.3 | 2026-02-06 | A vulnerability was determined in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /ramonsys/facultyloading/… |
CVE-2026-2011 | High | 7.3 | 2026-02-06 | A vulnerability was found in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /ramonsys/enrollment/controlle… |
CVE-2026-21643 | Critical | 9.8 | 2026-02-06 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthentic… |
CVE-2025-15325 | Medium | 6.3 | 2026-02-05 | Tanium addressed an improper input validation vulnerability in Discover. |
CVE-2020-37151 | High | 8.2 | 2026-02-05 | phpMyChat Plus 1.98 contains a SQL injection vulnerability in the deluser.php page through the pmc_username parameter that allows attackers to manipulate datab… |
CVE-2025-13379 | High | 8.6 | 2026-02-05 | IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2026-1517 | Medium | 4.7 | 2026-02-05 | A vulnerability was identified in iomad up to 5.0. Affected is an unknown function of the component Company Admin Block. Such manipulation leads to sql injecti… |
CVE-2025-10258 | Medium | 6.3 | 2026-02-05 | Infinera DNA is vulnerable to a time-based SQL injection vulnerability due to insufficient input validation, which may result in leaking of sensitive informati… |
CVE-2025-13192 | High | 8.2 | 2026-02-05 | The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Inject… |
CVE-2026-25514 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-25513 | High | 8.8 | 2026-02-04 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScripts contains a critical SQL injection… |
CVE-2026-22044 | Medium | 6.5 | 2026-02-04 | GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has… |
CVE-2025-69215 | High | 8.8 | 2026-02-04 | OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, there is a SQL Injection vulnerability… |
CVE-2025-69213 | High | 8.8 | 2026-02-04 | OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists i… |
CVE-2025-5329 | Critical | 9.8 | 2026-02-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc. Delta Course Automation allows SQL… |
CVE-2026-1370 | Medium | 4.9 | 2026-02-04 | The SIBS woocommerce payment gateway plugin for WordPress is vulnerable to time-based SQL Injection via the ‘referencedId’ parameter in all versions up to, and… |
CVE-2026-0816 | Medium | 4.9 | 2026-02-04 | The All push notification for WP plugin for WordPress is vulnerable to time-based SQL Injection via the 'delete_id' parameter in all versions up to, and includ… |
CVE-2025-15268 | High | 7.5 | 2026-02-04 | The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and inclu… |
CVE-2020-37089 | High | 8.2 | 2026-02-03 | School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to manipulate database queries through GET req… |
CVE-2020-37083 | High | 8.2 | 2026-02-03 | PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipulate database queries through the 'id' pa… |
CVE-2020-37081 | High | 7.1 | 2026-02-03 | Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calendar.php that allow attackers to inject m… |
CVE-2020-37076 | High | 8.2 | 2026-02-03 | Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote attackers to manipulate database queries… |
CVE-2019-25260 | High | 8.2 | 2026-02-03 | OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database con… |
CVE-2025-10878 | Critical | 10.0 | 2026-02-03 | A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are v… |
CVE-2026-25241 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<versi… |
CVE-2026-25240 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains()… |
CVE-2026-25239 | High | 7.5 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can a… |
CVE-2026-25238 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion ma… |
CVE-2026-25236 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe li… |
CVE-2026-25234 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow… |
CVE-2025-70311 | Medium | 6.5 | 2026-02-03 | JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 parameters in the /systemControl.do interface… |
CVE-2025-63624 | Critical | 9.8 | 2026-02-03 | SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker to execute arbitrary… |
CVE-2025-57529 | Critical | 9.8 | 2026-02-03 | YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input validation. This al… |
CVE-2020-37112 | High | 7.1 | 2026-02-03 | GUnet OpenEclass 1.7.3 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through unvalidated pa… |
CVE-2020-37110 | High | 8.2 | 2026-02-03 | 60CycleCMS 2.5.2 contains an SQL injection vulnerability in news.php and common/lib.php that allows attackers to manipulate database queries through unvalidate… |
CVE-2020-37108 | High | 7.1 | 2026-02-03 | PhpIX 2012 Professional contains a SQL injection vulnerability in the 'id' parameter of product_detail.php that allows remote attackers to manipulate database… |
CVE-2020-37105 | High | 7.1 | 2026-02-03 | PMB 5.6 contains a SQL injection vulnerability in the administration download script that allows authenticated attackers to execute arbitrary SQL commands thro… |
CVE-2026-25022 | High | 8.5 | 2026-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system… |
CVE-2026-1312 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases con… |
CVE-2026-1287 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via con… |
CVE-2026-1207 | Medium | 5.4 | 2026-02-03 | An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows r… |
CVE-2025-5319 | Critical | 9.8 | 2026-02-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Emit Informatics and Communication Technologies Industry… |
CVE-2026-1432 | | 2026-02-03 | SQL injection vulnerability in the Buroweb platform version 2505.0.12, specifically in the 'tablon' component. This vulnerability is present in several paramet… | |
CVE-2025-8587 | High | 8.6 | 2026-02-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSP… |
CVE-2026-1746 | Medium | 6.3 | 2026-02-02 | A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the componen… |
CVE-2021-47918 | High | 8.1 | 2026-02-01 | Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers… |
CVE-2021-47915 | High | 8.1 | 2026-02-01 | PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL comma… |
CVE-2021-47909 | High | 8.1 | 2026-02-01 | Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged ve… |
CVE-2026-0683 | Medium | 6.5 | 2026-01-31 | The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to SQL Injection via the Number-type custom field filter in all… |
CVE-2020-37057 | High | 8.2 | 2026-01-30 | Online-Exam-System 2015 contains a SQL injection vulnerability in the feedback module that allows attackers to manipulate database queries through the 'fid' pa… |
CVE-2020-37053 | High | 7.1 | 2026-01-30 | Navigate CMS 2.8.7 contains an authenticated SQL injection vulnerability that allows attackers to leak database information by manipulating the 'sidx' paramete… |
CVE-2020-37051 | High | 8.2 | 2026-01-30 | Online-Exam-System 2015 contains a time-based blind SQL injection vulnerability in the feedback form that allows attackers to extract database password hashes… |
CVE-2020-37035 | High | 8.2 | 2026-01-30 | e-Learning PHP Script 0.1.0 contains a SQL injection vulnerability in the search functionality that allows attackers to manipulate database queries through unv… |
CVE-2020-37033 | High | 8.2 | 2026-01-30 | Infor Storefront B2B 1.0 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'usr_name' parameter in login… |
CVE-2025-69662 | High | 8.6 | 2026-01-30 | SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write G… |
CVE-2026-1701 | High | 7.3 | 2026-01-30 | A security vulnerability has been detected in itsourcecode School Management System 1.0. This issue affects some unknown processing of the file /enrollment/ind… |
CVE-2026-24854 | High | 8.8 | 2026-01-30 | ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7… |
CVE-2026-1688 | High | 7.3 | 2026-01-30 | A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an unknown function of the file /admin/inde… |
CVE-2025-4686 | High | 8.6 | 2026-01-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry… |
CVE-2026-1595 | High | 7.3 | 2026-01-29 | A vulnerability was detected in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/edit_student_query.php. The manipul… |
CVE-2026-1594 | High | 7.3 | 2026-01-29 | A security vulnerability has been detected in itsourcecode Society Management System 1.0. Affected by this issue is some unknown functionality of the file /adm… |
CVE-2026-1593 | High | 7.3 | 2026-01-29 | A weakness has been identified in itsourcecode Society Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edi… |
CVE-2026-1590 | High | 7.3 | 2026-01-29 | A vulnerability was identified in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/faculty/index.php. Such man… |
CVE-2026-1589 | High | 7.3 | 2026-01-29 | A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/inquiry/index.php. This man… |
CVE-2025-7714 | High | 7.5 | 2026-01-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Man… |
CVE-2020-37006 | High | 8.2 | 2026-01-29 | berliCRM 1.0.24 contains a SQL injection vulnerability in the 'src_record' parameter that allows remote attackers to manipulate database queries. Attackers can… |