CWE-89 · SQL Injection (page 34)
Page 34 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13172 | Medium | 6.3 | 2025-11-14 | A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-report.php. Performi… |
CVE-2025-13171 | Medium | 6.3 | 2025-11-14 | A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the argument keyword l… |
CVE-2025-13170 | High | 7.3 | 2025-11-14 | A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /admin/edit_ac… |
CVE-2025-13169 | High | 7.3 | 2025-11-14 | A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2024-55016 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php. |
CVE-2024-44640 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the course-short, course-full, and cdate parameters in add-course.php. |
CVE-2024-44639 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subject.php. |
CVE-2024-44636 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. |
CVE-2024-44633 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the currentpassword parameter in change-password.php. |
CVE-2024-44632 | Medium | 6.5 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. |
CVE-2024-44630 | Medium | 6.5 | 2025-11-14 | Multiple parameters in register.php in PHPGurukul Student Record System 3.20 are vulnerable to SQL injection. These include: c-full, fname, mname,lname, gname… |
CVE-2025-13168 | Medium | 6.3 | 2025-11-14 | A weakness has been identified in ury-erp ury up to 0.2.0. This affects the function overrided_past_order_list of the file ury/ury/api/pos_extend.py. This mani… |
CVE-2025-11981 | Medium | 4.9 | 2025-11-14 | The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and includin… |
CVE-2022-4984 | | 2025-11-13 | ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTao Open Source Edition < 16.5.beta1 contain an SQL injection vulnerability in th… | |
CVE-2025-13123 | Medium | 6.3 | 2025-11-13 | A flaw has been found in AMTT Hotel Broadband Operation System 1.0. The impacted element is an unknown function of the file /user/portal/get_firstdate.php. Exe… |
CVE-2025-13122 | High | 7.3 | 2025-11-13 | A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. The affected element is the function getPatientAppointment of… |
CVE-2025-13121 | High | 7.3 | 2025-11-13 | A security vulnerability has been detected in cameasy Liketea 1.0.0. Impacted is the function list of the file laravel/app/Http/Controllers/Front/StoreControll… |
CVE-2025-12620 | Medium | 4.9 | 2025-11-13 | The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to generic SQL Injection via the ‘filterbyauthor’ parameter in a… |
CVE-2025-13076 | Medium | 4.7 | 2025-11-12 | A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing man… |
CVE-2025-13075 | Medium | 4.7 | 2025-11-12 | A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/usersettingdel.php. Performing mani… |
CVE-2025-13060 | High | 7.3 | 2025-11-12 | A security vulnerability has been detected in SourceCodester Survey Application System 1.0. This affects an unknown function of the file /view_survey.php. Such… |
CVE-2025-13059 | Medium | 6.3 | 2025-11-12 | A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This… |
CVE-2025-56385 | Critical | 9.8 | 2025-11-12 | A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input… |
CVE-2025-13057 | Medium | 6.3 | 2025-11-12 | A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_studen… |
CVE-2025-64293 | High | 7.6 | 2025-11-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Golemiq 0 Day Analytics 0-day-analytics allows SQL Inject… |
CVE-2025-64280 | Critical | 9.8 | 2025-11-12 | A SQL Injection Vulnerability in CentralSquare Community Development 19.5.7 allows attackers to inject SQL via the permit_no field. |
CVE-2025-11454 | Medium | 6.5 | 2025-11-12 | The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplic… |
CVE-2025-59499 | High | 8.8 | 2025-11-11 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-8324 | Critical | 9.8 | 2025-11-11 | Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration. |
CVE-2025-42889 | Medium | 5.4 | 2025-11-11 | SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerabil… |
CVE-2025-64519 | High | 8.8 | 2025-11-10 | TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In versions up to and including 2.8.8, an authenticated SQL injection v… |
CVE-2025-63497 | High | 7.1 | 2025-11-10 | The patient prescription viewing functionality in his_doc_view_single_patient.php of rickxy Hospital Management System version 1.0 contains an SQL injection vu… |
CVE-2025-12939 | Medium | 6.3 | 2025-11-10 | A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-12938 | High | 7.3 | 2025-11-10 | A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of the file /process_lo… |
CVE-2025-12409 | | 2025-11-10 | A SQL injection vulnerability was discovered in Looker Studio that allowed for data exfiltration from BigQuery data sources. By creating a malicious report w… | |
CVE-2025-12397 | | 2025-11-10 | A SQL injection vulnerability was found in Looker Studio. A Looker Studio user with report view access could inject malicious SQL that would execute with the… | |
CVE-2025-12933 | Medium | 6.3 | 2025-11-10 | A vulnerability was identified in SourceCodester Baby Care System 1.0. This affects an unknown part of the file /updatewelcome.php?id=siteoptions&action=welcom… |
CVE-2025-12932 | Medium | 4.7 | 2025-11-10 | A vulnerability was determined in SourceCodester Baby Care System 1.0. Affected by this issue is some unknown functionality of the file /admin.php?id=inbox. Th… |
CVE-2025-12931 | Medium | 6.3 | 2025-11-10 | A vulnerability was found in SourceCodester Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /routers/edit-orde… |
CVE-2025-12930 | Medium | 6.3 | 2025-11-10 | A vulnerability has been found in SourceCodester Food Ordering System 1.0. Affected is an unknown function of the file /view-ticket.php. The manipulation of th… |
CVE-2025-12929 | High | 7.3 | 2025-11-10 | A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Exec… |
CVE-2025-12928 | High | 7.3 | 2025-11-10 | A vulnerability was detected in code-projects Online Job Search Engine 1.0. This affects an unknown function of the file /login.php. Performing manipulation of… |
CVE-2025-12927 | Medium | 4.7 | 2025-11-10 | A security vulnerability has been detected in DedeBIZ up to 6.3.2. The impacted element is an unknown function of the file /admin/archives_add.php. Such manipu… |
CVE-2025-12926 | Medium | 6.3 | 2025-11-10 | A weakness has been identified in SourceCodester Farm Management System 1.0. The affected element is an unknown function of the file /review.php. This manipula… |
CVE-2025-12865 | High | 8.8 | 2025-11-10 | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
CVE-2025-12864 | High | 8.8 | 2025-11-10 | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
CVE-2025-12914 | Medium | 4.7 | 2025-11-08 | A vulnerability has been found in aaPanel BaoTa up to 11.2.x. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the com… |
CVE-2025-12913 | Medium | 4.7 | 2025-11-08 | A flaw has been found in code-projects Responsive Hotel Site 1.0. This affects an unknown part of the file /admin/roomdel.php. Executing manipulation of the ar… |
CVE-2025-11980 | Medium | 4.9 | 2025-11-08 | The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 d… |
CVE-2025-11972 | Medium | 4.9 | 2025-11-08 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all v… |
CVE-2025-11452 | High | 7.5 | 2025-11-08 | The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and inclu… |
CVE-2025-64493 | Medium | 6.5 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenti… |
CVE-2025-64492 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind S… |
CVE-2025-64488 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through… |
CVE-2025-63718 | Medium | 6.5 | 2025-11-07 | A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. The appointment… |
CVE-2025-12873 | Medium | 4.7 | 2025-11-07 | A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipu… |
CVE-2025-63689 | Critical | 10.0 | 2025-11-07 | Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacke… |
CVE-2025-52425 | Critical | 9.8 | 2025-11-07 | An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. … |
CVE-2025-12861 | Medium | 4.7 | 2025-11-07 | A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/spec_add.php. This manipul… |
CVE-2025-12860 | Medium | 4.7 | 2025-11-07 | A vulnerability was found in DedeBIZ up to 6.3.2. Affected is an unknown function of the file /admin/freelist_main.php. The manipulation of the argument orderb… |
CVE-2025-12859 | Medium | 4.7 | 2025-11-07 | A vulnerability has been found in DedeBIZ up to 6.3.2. This impacts an unknown function of the file /admin/templets_one_edit.php. The manipulation of the argum… |
CVE-2025-12857 | Medium | 4.7 | 2025-11-07 | A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook… |
CVE-2025-12856 | Medium | 4.7 | 2025-11-07 | A weakness has been identified in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/reservation.php. This manipulatio… |
CVE-2025-12855 | Medium | 4.7 | 2025-11-07 | A security flaw has been discovered in code-projects Responsive Hotel Site 1.0. This issue affects some unknown processing of the file /admin/newsletterdel.php… |
CVE-2025-12853 | Medium | 4.7 | 2025-11-07 | A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php… |
CVE-2025-10968 | High | 8.8 | 2025-11-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Se… |
CVE-2025-10870 | | 2025-11-07 | SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests w… | |
CVE-2025-34247 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low… |
CVE-2025-34246 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated… |
CVE-2025-34245 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authent… |
CVE-2025-34244 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authent… |
CVE-2025-34243 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authen… |
CVE-2025-34242 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-pr… |
CVE-2025-34241 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated l… |
CVE-2025-34240 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticate… |
CVE-2022-50595 | High | 7.2 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50594 | High | 7.5 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50593 | Critical | 9.8 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50592 | High | 7.2 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50591 | Critical | 9.8 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50589 | Critical | 9.8 | 2025-11-06 | SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Success… |
CVE-2025-60239 | High | 8.5 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codexpert, Inc CoSchool LMS coschool allows Blind SQL Inj… |
CVE-2025-52773 | Critical | 9.3 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway… |
CVE-2025-48089 | Critical | 9.3 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histud… |
CVE-2025-28953 | High | 8.5 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This… |
CVE-2025-10683 | Medium | 4.9 | 2025-11-06 | The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insuff… |
CVE-2025-64114 | Medium | 6.5 | 2025-11-06 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to… |
CVE-2025-63585 | Medium | 6.5 | 2025-11-05 | OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter. |
CVE-2025-55343 | Critical | 9.9 | 2025-11-05 | Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_depe_codi, busqueda/busqueda.php txt_usu… |
CVE-2025-64459 | Critical | 9.1 | 2025-11-05 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get… |
CVE-2025-12197 | High | 7.5 | 2025-11-05 | The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient esca… |
CVE-2025-32786 | High | 7.5 | 2025-11-04 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerab… |
CVE-2025-12463 | Critical | 9.8 | 2025-11-03 | An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi`… |
CVE-2025-63453 | Critical | 9.8 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php. |
CVE-2025-63452 | Critical | 9.4 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. |
CVE-2025-63451 | Critical | 9.8 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. |
CVE-2025-12503 | Medium | 6.5 | 2025-11-03 | EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL comman… |
CVE-2025-12617 | High | 7.3 | 2025-11-03 | A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing a manipulation of t… |
CVE-2025-12614 | Medium | 4.7 | 2025-11-03 | A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php… |
CVE-2025-12612 | Medium | 6.3 | 2025-11-03 | A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?ac… |