CWE-89 · SQL Injection (page 35)
Page 35 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-37005 | High | 7.1 | 2026-01-29 | TimeClock Software 1.01 contains an authenticated time-based SQL injection vulnerability that allows attackers to enumerate valid usernames by manipulating the… |
CVE-2020-37004 | High | 8.2 | 2026-01-29 | The Ultimate Project Manager CRM PRO version 2.0.5 contains a blind SQL injection vulnerability that allows attackers to extract usernames and password hashes… |
CVE-2020-36999 | High | 8.2 | 2026-01-29 | Elaniin CMS 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard by manipulating the login page with SQL injection… |
CVE-2026-1552 | Medium | 6.3 | 2026-01-29 | A security vulnerability has been detected in SEMCMS 5.0. This vulnerability affects unknown code of the file /SEMCMS_Info.php. The manipulation of the argumen… |
CVE-2026-1551 | Medium | 6.3 | 2026-01-29 | A weakness has been identified in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/course/controller.php. Executin… |
CVE-2025-15344 | Medium | 6.3 | 2026-01-29 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2026-1546 | Medium | 6.3 | 2026-01-28 | A security vulnerability has been detected in jishenghua jshERP up to 3.6. The impacted element is the function getBillItemByParam of the file /jshERP-boot/dep… |
CVE-2026-1545 | High | 7.3 | 2026-01-28 | A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /course/index.php. Executi… |
CVE-2026-1535 | High | 7.3 | 2026-01-28 | A security vulnerability has been detected in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Administrator/PHP/AdminReply.p… |
CVE-2026-1534 | High | 7.3 | 2026-01-28 | A weakness has been identified in code-projects Online Music Site 1.0. This affects an unknown function of the file /Administrator/PHP/AdminEditUser.php. This… |
CVE-2026-1533 | Medium | 4.7 | 2026-01-28 | A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAdd… |
CVE-2025-57793 | High | 8.6 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application co… |
CVE-2025-57792 | Critical | 10.0 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. A… |
CVE-2020-36972 | High | 8.2 | 2026-01-28 | SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that allows attackers to extract database inf… |
CVE-2020-36945 | High | 8.2 | 2026-01-28 | WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulat… |
CVE-2026-22243 | High | 8.8 | 2026-01-28 | EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.202… |
CVE-2026-0702 | High | 7.5 | 2026-01-28 | The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in all versions up to… |
CVE-2026-1483 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1482 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1481 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1480 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1479 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1478 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1477 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1476 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1475 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1474 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1473 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2026-1472 | High | 7.5 | 2026-01-27 | An out-of-band SQL injection vulnerability (OOB SQLi) has been detected in the Performance Evaluation (EDD) application developed by Gabinete Técnico de Progra… |
CVE-2025-69563 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter. |
CVE-2025-69562 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter. |
CVE-2021-47902 | High | 8.2 | 2026-01-27 | Testa Online Test Management System 3.4.7 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'q' search pa… |
CVE-2020-36951 | High | 8.2 | 2026-01-27 | Phpscript-sgh 0.1.0 contains a time-based blind SQL injection vulnerability in the admin interface that allows attackers to manipulate database queries through… |
CVE-2020-36947 | High | 7.1 | 2026-01-27 | LibreNMS 1.46 contains an authenticated SQL injection vulnerability in the MAC accounting graph endpoint that allows remote attackers to extract database infor… |
CVE-2026-1449 | High | 7.3 | 2026-01-27 | A flaw has been found in Hisense TransTech Smart Bus Management System up to 20260113. Affected is the function Page_Load of the file YZSoft/Forms/XForm/BM/Bus… |
CVE-2025-59473 | High | 7.2 | 2026-01-26 | SQL Injection vulnerability in the Structure for Admin authenticated user |
CVE-2026-1443 | High | 7.3 | 2026-01-26 | A flaw has been found in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /Administrator/PHP/AdminDeleteUs… |
CVE-2026-1422 | High | 7.3 | 2026-01-26 | A vulnerability was found in code-projects Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of… |
CVE-2025-14973 | Medium | 6.8 | 2026-01-26 | The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors a… |
CVE-2026-0806 | Medium | 4.9 | 2026-01-24 | The WP-ClanWars plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.0.1 due to insufficient… |
CVE-2025-52025 | Critical | 9.4 | 2026-01-23 | An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28. The vulnerability ar… |
CVE-2026-24624 | High | 7.6 | 2026-01-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in saeros1984 Neoforum neoforum allows Blind SQL Injection.T… |
CVE-2026-24572 | High | 8.5 | 2026-01-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nelio Software Nelio Content nelio-content allows Blind S… |
CVE-2026-0603 | High | 8.3 | 2026-01-23 | A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, u… |
CVE-2026-24367 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.T… |
CVE-2026-22470 | High | 7.6 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FireStorm Plugins FireStorm Professional Real Estate fs-r… |
CVE-2025-69180 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind… |
CVE-2025-69045 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL… |
CVE-2025-68999 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-a… |
CVE-2025-68881 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal AppExperts appexperts allows SQL Injection.Thi… |
CVE-2025-68857 | Critical | 9.3 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL… |
CVE-2025-68034 | Critical | 9.3 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL In… |
CVE-2025-68017 | High | 7.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator a… |
CVE-2025-67945 | Critical | 9.3 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-maile… |
CVE-2025-49055 | Critical | 9.3 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allo… |
CVE-2025-49050 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allo… |
CVE-2025-49049 | High | 8.5 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Inje… |
CVE-2025-36588 | High | 8.8 | 2026-01-22 | Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabil… |
CVE-2025-4764 | High | 8.0 | 2026-01-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hot… |
CVE-2025-27378 | High | 8.6 | 2026-01-22 | AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configurat… |
CVE-2021-47872 | High | 7.1 | 2026-01-21 | SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate databas… |
CVE-2021-47848 | High | 8.2 | 2026-01-21 | Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter… |
CVE-2021-47846 | High | 8.2 | 2026-01-21 | Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers… |
CVE-2025-67261 | Medium | 6.5 | 2026-01-20 | Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page. |
CVE-2026-1179 | High | 7.3 | 2026-01-19 | A vulnerability was detected in Yonyou KSOA 9.0. This affects an unknown part of the file /kmf/user_popedom.jsp of the component HTTP GET Parameter Handler. Th… |
CVE-2026-1178 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /kmf/select.jsp of the componen… |
CVE-2026-1177 | High | 7.3 | 2026-01-19 | A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/save_folder.jsp of the component… |
CVE-2026-1176 | High | 7.3 | 2026-01-19 | A security flaw has been discovered in itsourcecode School Management System 1.0. Affected is an unknown function of the file /subject/index.php. Performing a… |
CVE-2026-22850 | High | 8.3 | 2026-01-19 | Koko Analytics is an open-source analytics plugin for WordPress. Versions prior to 2.1.3 are vulnerable to arbitrary SQL execution through unescaped analytics… |
CVE-2026-1160 | High | 7.3 | 2026-01-19 | A security vulnerability has been detected in PHPGurukul Directory Management System 1.0. Impacted is an unknown function of the file /index.php of the compone… |
CVE-2026-1159 | High | 7.3 | 2026-01-19 | A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This issue affects some unknown processing of the file /order_online.ph… |
CVE-2026-0610 | Critical | 9.8 | 2026-01-19 | SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
CVE-2026-1133 | High | 7.3 | 2026-01-19 | A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /kmf/folder.jsp of the component HTTP GET Parameter… |
CVE-2026-1132 | High | 7.3 | 2026-01-19 | A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /kmf/edit_folder.jsp of the component HTTP GET Parameter… |
CVE-2026-1131 | High | 7.3 | 2026-01-19 | A vulnerability has been found in Yonyou KSOA 9.0. Impacted is an unknown function of the file /kmc/save_catalog.jsp of the component HTTP GET Parameter Handle… |
CVE-2026-1130 | High | 7.3 | 2026-01-19 | A flaw has been found in Yonyou KSOA 9.0. This issue affects some unknown processing of the file /worksheet/worksadd_plan.jsp of the component HTTP GET Paramet… |
CVE-2026-1129 | High | 7.3 | 2026-01-19 | A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/worksadd.jsp of the component HTTP GET Paramete… |
CVE-2026-1124 | High | 7.3 | 2026-01-18 | A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_report.jsp of th… |
CVE-2026-1123 | High | 7.3 | 2026-01-18 | A vulnerability was identified in Yonyou KSOA 9.0. Affected is an unknown function of the file /worksheet/work_mod.jsp of the component HTTP GET Parameter Hand… |
CVE-2026-1122 | High | 7.3 | 2026-01-18 | A vulnerability was determined in Yonyou KSOA 9.0. This impacts an unknown function of the file /worksheet/work_info.jsp of the component HTTP GET Parameter Ha… |
CVE-2026-1121 | High | 7.3 | 2026-01-18 | A vulnerability was found in Yonyou KSOA 9.0. This affects an unknown function of the file /worksheet/del_workplan.jsp of the component HTTP GET Parameter Hand… |
CVE-2026-1120 | High | 7.3 | 2026-01-18 | A vulnerability has been found in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_work.jsp of the component HTTP GET Pa… |
CVE-2026-1119 | High | 7.3 | 2026-01-18 | A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/delete_activity.php. Execut… |
CVE-2026-1118 | Medium | 6.3 | 2026-01-18 | A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/add_activity.php. Performing a m… |
CVE-2026-1105 | High | 7.3 | 2026-01-18 | A vulnerability was identified in EasyCMS up to 1.6. This vulnerability affects unknown code of the file /UserAction.class.php. Such manipulation of the argume… |
CVE-2026-1059 | High | 7.3 | 2026-01-17 | A security vulnerability has been detected in FeMiner wms up to 9cad1f1b179a98b9547fd003c23b07c7594775fa. Affected by this vulnerability is an unknown function… |
CVE-2026-1050 | High | 7.3 | 2026-01-17 | A flaw has been found in risesoft-y9 Digital-Infrastructure up to 9.6.7. This affects an unknown function of the file source-code/src/main/java/net/risesoft/ut… |
CVE-2025-12984 | Medium | 4.9 | 2026-01-17 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 2.0… |
CVE-2026-23723 | High | 7.2 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaContr… |
CVE-2025-61943 | High | 8.4 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and… |
CVE-2021-47811 | Critical | 9.1 | 2026-01-16 | Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can… |
CVE-2021-47801 | High | 8.2 | 2026-01-16 | Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit t… |
CVE-2021-47782 | High | 8.2 | 2026-01-16 | Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to inject malicious databas… |
CVE-2025-70893 | High | 8.8 | 2026-01-15 | A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. The application fai… |
CVE-2025-70892 | Critical | 9.8 | 2026-01-15 | Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate u… |
CVE-2025-66417 | High | 7.5 | 2026-01-15 | GLPI is a free asset and IT management software package. From 11.0.0, < 11.0.3, an unauthenticated user can perform a SQL injection through the inventory endpo… |
CVE-2021-47777 | High | 8.2 | 2026-01-15 | Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint. Attackers can inj… |
CVE-2021-47766 | High | 7.1 | 2026-01-15 | Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that allows attackers to manipulate databas… |
CVE-2021-47763 | High | 8.2 | 2026-01-15 | Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attacker… |
CVE-2025-67082 | Medium | 6.5 | 2026-01-15 | An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An aut… |