CWE-89 · SQL Injection (page 36)
Page 36 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47902 | High | 8.8 | 2025-10-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This is… |
CVE-2025-61455 | Critical | 9.8 | 2025-10-20 | SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsa… |
CVE-2025-41028 | | 2025-10-20 | A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to retrieve, create, update and delete data… | |
CVE-2025-11944 | Medium | 4.7 | 2025-10-19 | A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component R… |
CVE-2025-11691 | High | 7.5 | 2025-10-18 | The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in… |
CVE-2025-10187 | Medium | 4.9 | 2025-10-18 | The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and incl… |
CVE-2025-62655 | | 2025-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows… | |
CVE-2025-11912 | Medium | 6.3 | 2025-10-17 | A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file /DeviceState.do?Action=Query. This mani… |
CVE-2025-11911 | Medium | 6.3 | 2025-10-17 | A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. T… |
CVE-2025-11910 | Medium | 6.3 | 2025-10-17 | A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?A… |
CVE-2025-56316 | Critical | 9.8 | 2025-10-17 | A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL q… |
CVE-2025-11909 | Medium | 6.3 | 2025-10-17 | A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord… |
CVE-2025-62422 | High | 8.8 | 2025-10-17 | DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerab… |
CVE-2025-60514 | Medium | 6.5 | 2025-10-17 | Tillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts. |
CVE-2025-11904 | Medium | 6.3 | 2025-10-17 | A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.2. This affects the function hasUse of the file /cms/model/hasUse. The manipulation of the arg… |
CVE-2025-11903 | Medium | 6.3 | 2025-10-17 | A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2. Affected by this issue is the function update of the file /cms/article/update. Executing a manipulat… |
CVE-2025-11902 | Medium | 6.3 | 2025-10-17 | A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2. Affected by this vulnerability is the function findField of the file /cms/article/findField… |
CVE-2025-62423 | Medium | 6.7 | 2025-10-16 | ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “… |
CVE-2025-60641 | Medium | 6.5 | 2025-10-16 | The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-c… |
CVE-2025-56700 | Medium | 5.4 | 2025-10-16 | Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has… |
CVE-2025-56699 | Medium | 5.4 | 2025-10-16 | SQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated user to execute arb… |
CVE-2025-61540 | Medium | 6.5 | 2025-10-16 | SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php. |
CVE-2025-41019 | | 2025-10-16 | SQL injection in Sergestec's SISTICK v7.2. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'id' parameter i… | |
CVE-2025-41018 | Critical | 9.8 | 2025-10-16 | SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in… |
CVE-2025-11365 | Medium | 6.5 | 2025-10-15 | The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'google_map' shortcode in all versions up to… |
CVE-2025-11177 | High | 7.5 | 2025-10-15 | The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient… |
CVE-2025-10743 | High | 7.5 | 2025-10-15 | The Outdoor plugin for WordPress is vulnerable to SQL Injection via the 'edit' action in all versions up to, and including, 1.3.2 due to insufficient escaping… |
CVE-2025-10730 | Medium | 6.5 | 2025-10-15 | The Wp tabber widget plugin for WordPress is vulnerable to SQL Injection via the 'wp-tabber-widget' shortcode in all versions up to, and including, 4.0 due to… |
CVE-2025-10682 | Medium | 6.5 | 2025-10-15 | The TARIFFUXX plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4. This is due to insufficient neutralization of user-sup… |
CVE-2025-10660 | Medium | 6.5 | 2025-10-15 | The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficien… |
CVE-2025-10575 | Medium | 6.5 | 2025-10-15 | The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_p… |
CVE-2025-10310 | Medium | 4.9 | 2025-10-15 | The Rich Snippet Site Report plugin for WordPress is vulnerable to SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due t… |
CVE-2025-10045 | Medium | 4.9 | 2025-10-15 | The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to i… |
CVE-2025-11501 | High | 7.5 | 2025-10-15 | The Dynamically Display Posts plugin for WordPress is vulnerable to SQL Injection via the 'tax_query' parameter in all versions up to, and including, 1.1 due t… |
CVE-2025-61675 | | 2025-10-14 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17… | |
CVE-2025-11736 | High | 7.3 | 2025-10-14 | A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipula… |
CVE-2025-59213 | High | 8.8 | 2025-10-14 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elev… |
CVE-2025-55320 | Medium | 6.8 | 2025-10-14 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevat… |
CVE-2025-10610 | Critical | 9.8 | 2025-10-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreig… |
CVE-2025-40755 | High | 8.8 | 2025-10-14 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP1). Affected applications are vulnerable to SQL injection through getTotalAndFilterCoun… |
CVE-2025-62392 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62391 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62390 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62389 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62388 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62387 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62386 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62385 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62384 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62383 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62360 | High | 8.8 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in… |
CVE-2025-62179 | High | 8.8 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in… |
CVE-2025-62177 | High | 8.8 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in… |
CVE-2025-11623 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-6919 | Critical | 9.8 | 2025-10-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technolo… |
CVE-2025-11668 | Medium | 4.7 | 2025-10-13 | A vulnerability was determined in code-projects Automated Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/update_use… |
CVE-2025-11667 | Medium | 6.3 | 2025-10-13 | A vulnerability was found in code-projects Automated Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_candi… |
CVE-2025-11664 | Medium | 4.7 | 2025-10-13 | A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown function of the file /ad… |
CVE-2025-11663 | Medium | 4.7 | 2025-10-13 | A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-s… |
CVE-2025-11662 | High | 7.3 | 2025-10-13 | A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. Impacted is an unknown function of the file /booking.php. The manipulat… |
CVE-2025-11654 | High | 7.3 | 2025-10-13 | A vulnerability was identified in yousaf530 Inferno Online Clothing Store up to 827dd42bfbe380e8de76fdc67958c24cf1246208. The affected element is an unknown fu… |
CVE-2025-11629 | Medium | 6.3 | 2025-10-12 | A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. Such manipulation le… |
CVE-2025-11628 | Medium | 4.7 | 2025-10-12 | A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file… |
CVE-2025-11615 | High | 7.3 | 2025-10-11 | A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Perfor… |
CVE-2025-11614 | High | 7.3 | 2025-10-11 | A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/edit… |
CVE-2025-11613 | Medium | 6.3 | 2025-10-11 | A vulnerability was found in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file /addcategory.php. The manipulation of t… |
CVE-2025-11612 | Medium | 6.3 | 2025-10-11 | A vulnerability has been found in code-projects Simple Food Ordering System 1.0. This impacts an unknown function of the file /addproduct.php. The manipulation… |
CVE-2025-11611 | Medium | 6.3 | 2025-10-11 | A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the a… |
CVE-2025-11610 | Medium | 6.3 | 2025-10-11 | A security flaw has been discovered in SourceCodester Simple Inventory System 1.0. This issue affects some unknown processing of the file /brand.php. The manip… |
CVE-2025-11608 | High | 7.3 | 2025-10-11 | A security vulnerability has been detected in code-projects E-Banking System 1.0. This affects an unknown function of the file /register.php of the component P… |
CVE-2025-11606 | Medium | 6.3 | 2025-10-11 | A security flaw has been discovered in iPynch Social Network Website up to b6933b6d7f82c84819abe458ccf0e59d61119541. The affected element is an unknown functio… |
CVE-2025-11605 | Medium | 6.3 | 2025-10-11 | A vulnerability was identified in code-projects Client Details System 1.0. Impacted is an unknown function of the file /admin/update-profile.php. Such manipula… |
CVE-2025-11604 | High | 7.3 | 2025-10-11 | A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This m… |
CVE-2025-11603 | Medium | 6.3 | 2025-10-11 | A vulnerability was found in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /editproduct.php. The manipulat… |
CVE-2025-11601 | High | 7.3 | 2025-10-11 | A vulnerability was detected in SourceCodester Online Student Result System 1.0. Affected by this vulnerability is an unknown functionality of the file /login… |
CVE-2025-11600 | Medium | 6.3 | 2025-10-11 | A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file editcategory.php. Such… |
CVE-2025-11599 | High | 7.3 | 2025-10-11 | A weakness has been identified in Campcodes Online Apartment Visitor Management System 1.0. This impacts an unknown function of the file /forgot-password.php… |
CVE-2025-11597 | Medium | 6.3 | 2025-10-11 | A vulnerability was identified in code-projects E-Commerce Website 1.0. The impacted element is an unknown function of the file /pages/product_add_qty.php. The… |
CVE-2025-9947 | Medium | 4.9 | 2025-10-11 | The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and including, 3.12.0 due to… |
CVE-2025-11596 | High | 7.3 | 2025-10-11 | A vulnerability was determined in code-projects E-Commerce Website 1.0. The affected element is an unknown function of the file /pages/delete_order_details.php… |
CVE-2025-11595 | Medium | 4.7 | 2025-10-11 | A vulnerability was found in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /admin-profile.php. Performi… |
CVE-2025-10175 | Medium | 6.5 | 2025-10-11 | The WP Links Page plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 4.9.6 due to insufficient es… |
CVE-2025-10185 | Medium | 4.9 | 2025-10-11 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in the action nf_load_form… |
CVE-2025-10048 | Medium | 4.9 | 2025-10-11 | The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 3.6.31 due to insuf… |
CVE-2025-11593 | Medium | 6.3 | 2025-10-11 | A flaw has been found in CodeAstro Gym Management System 1.0. This vulnerability affects unknown code of the file /admin/actions/delete-equipment.php. This man… |
CVE-2025-11592 | Medium | 6.3 | 2025-10-11 | A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation o… |
CVE-2025-11591 | Medium | 6.3 | 2025-10-11 | A security vulnerability has been detected in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/acti… |
CVE-2025-11590 | Medium | 6.3 | 2025-10-11 | A weakness has been identified in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/equipment-… |
CVE-2025-11589 | Medium | 6.3 | 2025-10-10 | A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/user-payment.php. Performing a m… |
CVE-2025-11588 | Medium | 6.3 | 2025-10-10 | A vulnerability was identified in CodeAstro Gym Management System 1.0. This impacts an unknown function of the file /customer/index.php. Such manipulation of t… |
CVE-2025-11585 | High | 7.3 | 2025-10-10 | A vulnerability was found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /useredit.php. The manipulati… |
CVE-2025-11584 | High | 7.3 | 2025-10-10 | A vulnerability has been found in code-projects Online Job Search Engine 1.0. The affected element is an unknown function of the file /searchjob.php. The manip… |
CVE-2025-11583 | High | 7.3 | 2025-10-10 | A flaw has been found in code-projects Online Job Search Engine 1.0. Impacted is an unknown function of the file /postjob.php. Executing manipulation of the ar… |
CVE-2025-11582 | High | 7.3 | 2025-10-10 | A vulnerability was detected in code-projects Online Job Search Engine 1.0. This issue affects some unknown processing of the file /registration.php. Performin… |
CVE-2025-60269 | Critical | 9.4 | 2025-10-10 | JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/controller/excel/CgExport… |
CVE-2025-60307 | Critical | 9.8 | 2025-10-10 | code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on the login page can… |
CVE-2025-11188 | High | 7.3 | 2025-10-10 | The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding da… |
CVE-2025-11558 | High | 7.3 | 2025-10-09 | A vulnerability was found in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/user_index_search.php. Performing manipul… |
CVE-2025-11557 | High | 7.3 | 2025-10-09 | A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add-pass.php. Such man… |
CVE-2025-11556 | High | 7.3 | 2025-10-09 | A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipulation of the argume… |