CWE-89 · SQL Injection (page 36)
Page 36 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67081 | Medium | 4.9 | 2026-01-15 | An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a profile. An attacker with admin account ca… |
CVE-2025-12166 | High | 7.5 | 2026-01-14 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `a… |
CVE-2026-23492 | High | 8.8 | 2026-01-14 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API al… |
CVE-2025-37183 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37182 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37181 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-66169 | Medium | 5.3 | 2026-01-14 | Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, f… |
CVE-2025-14770 | High | 7.5 | 2026-01-14 | The Shipping Rate By Cities plugin for WordPress is vulnerable to SQL Injection via the 'city' parameter in all versions up to, and including, 2.0.0 due to ins… |
CVE-2026-0678 | Medium | 4.9 | 2026-01-14 | The Flat Shipping Rate by City for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'cities' parameter in all versions up to… |
CVE-2023-54340 | High | 8.2 | 2026-01-13 | WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password paramete… |
CVE-2023-54333 | High | 8.2 | 2026-01-13 | Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries. At… |
CVE-2022-50895 | Critical | 9.8 | 2026-01-13 | Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate database queries. Attackers can exploit boole… |
CVE-2022-50894 | Medium | 6.5 | 2026-01-13 | VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code t… |
CVE-2022-50892 | High | 8.2 | 2026-01-13 | VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials. Attackers… |
CVE-2022-50805 | High | 8.2 | 2026-01-13 | Senayan Library Management System 9.0.0 contains a SQL injection vulnerability in the 'class' parameter that allows attackers to inject malicious SQL queries… |
CVE-2026-20947 | High | 8.8 | 2026-01-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute co… |
CVE-2025-59922 | High | 7.2 | 2026-01-13 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 t… |
CVE-2025-69991 | Critical | 9.8 | 2026-01-13 | phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php. |
CVE-2025-13774 | High | 8.8 | 2026-01-13 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute u… |
CVE-2026-0501 | Critical | 9.9 | 2026-01-13 | Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL q… |
CVE-2025-67146 | Critical | 9.4 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search… |
CVE-2025-67147 | Critical | 9.8 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_c… |
CVE-2025-51567 | Critical | 9.1 | 2026-01-12 | A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL comma… |
CVE-2025-41006 | | 2026-01-12 | Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’. | |
CVE-2025-41005 | | 2026-01-12 | Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchange_offers.php’. | |
CVE-2025-41004 | | 2026-01-12 | Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter. | |
CVE-2025-52694 | Critical | 10.0 | 2026-01-12 | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable s… |
CVE-2026-0852 | High | 7.3 | 2026-01-12 | A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpd… |
CVE-2026-0851 | High | 7.3 | 2026-01-12 | A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser… |
CVE-2026-0850 | Medium | 4.7 | 2026-01-11 | A vulnerability was determined in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /admin/delete_activity.php… |
CVE-2026-0843 | Medium | 6.3 | 2026-01-11 | A vulnerability has been found in jiujiujia/victor123/wxw850227 jjjfood and jjjshop_food up to 20260103. This vulnerability affects unknown code of the file /i… |
CVE-2026-22687 | Medium | 5.6 | 2026-01-10 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.2.5, after WeKnora enables the Agent se… |
CVE-2025-65091 | Critical | 10.0 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (i… |
CVE-2026-22596 | Medium | 6.7 | 2026-01-10 | Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/… |
CVE-2025-51626 | Medium | 6.5 | 2026-01-09 | SQL injection vulnerability in pss.sale.com 1.0 via the id parameter to the userfiles/php/cancel_order.php endpoint. |
CVE-2025-67811 | Medium | 6.5 | 2026-01-09 | Area9 Rhapsode 1.47.3 allows SQL Injection via multiple API endpoints accessible to authenticated users. Insufficient input validation allows remote attackers… |
CVE-2026-22197 | High | 8.1 | 2026-01-09 | GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, se… |
CVE-2026-22196 | High | 8.1 | 2026-01-09 | GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation… |
CVE-2026-22195 | High | 8.1 | 2026-01-09 | GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL q… |
CVE-2025-15496 | Medium | 6.3 | 2026-01-09 | A vulnerability was determined in guchengwuyue yshopmall up to 1.9.1. Affected is the function getPage of the file /api/jobs. This manipulation of the argument… |
CVE-2025-15494 | Medium | 6.3 | 2026-01-09 | A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapper.xml. The manipul… |
CVE-2025-15493 | Medium | 6.3 | 2026-01-09 | A flaw has been found in RainyGao DocSys up to 2.02.36. The impacted element is an unknown function of the file src/com/DocSystem/mapping/ReposAuthMapper.xml… |
CVE-2026-0803 | Medium | 6.3 | 2026-01-09 | A vulnerability was found in PHPGurukul Online Course Registration System up to 3.1. This affects an unknown part of the file /enroll.php. The manipulation of… |
CVE-2025-67281 | Medium | 5.4 | 2026-01-09 | In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple SQL injection vulnerabilities exists which allow a low privileged and administrative user to access the datab… |
CVE-2025-15492 | Medium | 6.3 | 2026-01-09 | A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/mapping/GroupMemberMap… |
CVE-2025-14598 | Critical | 9.8 | 2026-01-09 | BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites. The vulnerability enables arbitrary SQ… |
CVE-2025-64092 | High | 7.5 | 2026-01-09 | This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database. |
CVE-2026-0733 | Medium | 6.3 | 2026-01-09 | A vulnerability was determined in PHPGurukul Online Course Registration System up to 3.1. This impacts an unknown function of the file /onlinecourse/admin/mana… |
CVE-2026-0729 | Medium | 4.7 | 2026-01-08 | A vulnerability was detected in code-projects Intern Membership Management System 1.0. Impacted is an unknown function of the file /intern/admin/add_activity.p… |
CVE-2026-0728 | Medium | 4.7 | 2026-01-08 | A security vulnerability has been detected in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /in… |
CVE-2025-61548 | Critical | 9.8 | 2026-01-08 | SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Sho… |
CVE-2025-61246 | Critical | 9.8 | 2026-01-08 | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter. |
CVE-2026-21892 | Medium | 5.3 | 2026-01-08 | Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The applic… |
CVE-2026-22242 | Medium | 4.9 | 2026-01-08 | CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authent… |
CVE-2025-67928 | Critical | 9.3 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQ… |
CVE-2025-67921 | High | 8.5 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue… |
CVE-2025-23993 | Critical | 9.3 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Inje… |
CVE-2025-22728 | High | 8.5 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL… |
CVE-2025-22713 | High | 8.5 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocomme… |
CVE-2026-0701 | Medium | 4.7 | 2026-01-08 | A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2026-0700 | High | 7.3 | 2026-01-08 | A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin… |
CVE-2026-0699 | Medium | 4.7 | 2026-01-08 | A vulnerability was found in code-projects Intern Membership Management System 1.0. This impacts an unknown function of the file /intern/admin/edit_activity.ph… |
CVE-2026-0698 | Medium | 4.7 | 2026-01-08 | A vulnerability has been found in code-projects Intern Membership Management System 1.0. This affects an unknown function of the file /intern/admin/edit_studen… |
CVE-2026-0697 | Medium | 4.7 | 2026-01-08 | A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown function of the file /intern/admin/edit_admi… |
CVE-2026-21875 | Critical | 9.8 | 2026-01-08 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind SQL Injection through the add comment… |
CVE-2023-7333 | Medium | 5.3 | 2026-01-07 | A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table Object Handler. This… |
CVE-2026-21856 | High | 7.2 | 2026-01-07 | The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to commit 9bdb3a75a98a7047b6d70144eb1da1655d6992a8, a time based blind SQL injection vu… |
CVE-2025-32303 | Critical | 9.3 | 2026-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue a… |
CVE-2025-69351 | High | 8.5 | 2026-01-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQ… |
CVE-2025-59379 | High | 7.5 | 2026-01-06 | DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 allows an attacker to retrieve sensitive information from the underlying SQL database via Bli… |
CVE-2025-9318 | Medium | 6.5 | 2026-01-06 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in… |
CVE-2025-14153 | Medium | 6.5 | 2026-01-06 | The Page Expire Popup/Redirection for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' shortcode attribute in all versions… |
CVE-2025-13652 | Medium | 6.5 | 2026-01-06 | The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.0.4… |
CVE-2025-13409 | Medium | 4.9 | 2026-01-06 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection via the 'params' parameter in all versions up to, and including… |
CVE-2026-0607 | High | 7.3 | 2026-01-06 | A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminViewSongs.php. Executing a manip… |
CVE-2026-0606 | High | 7.3 | 2026-01-05 | A vulnerability was detected in code-projects Online Music Site 1.0. Affected by this issue is some unknown functionality of the file /FrontEnd/Albums.php. Per… |
CVE-2026-0605 | High | 7.3 | 2026-01-05 | A security vulnerability has been detected in code-projects Online Music Site 1.0. Affected by this vulnerability is an unknown functionality of the file /logi… |
CVE-2025-39484 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects En… |
CVE-2026-0597 | Medium | 6.3 | 2026-01-05 | A flaw has been found in Campcodes Supplier Management System 1.0. Affected by this issue is some unknown functionality of the file /retailer/edit_profile.php… |
CVE-2025-15029 | Critical | 9.8 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQ… |
CVE-2026-0592 | High | 7.3 | 2026-01-05 | A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This affects an unknown function of the file /handgunner-administra… |
CVE-2026-0591 | Medium | 6.3 | 2026-01-05 | A vulnerability was identified in code-projects Online Product Reservation System 1.0. The impacted element is an unknown function of the file /app/checkout/up… |
CVE-2026-0590 | Medium | 6.3 | 2026-01-05 | A vulnerability was determined in code-projects Online Product Reservation System 1.0. The affected element is an unknown function of the file /app/checkout/de… |
CVE-2025-68865 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injec… |
CVE-2025-31044 | High | 8.5 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue… |
CVE-2025-30633 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL… |
CVE-2026-0585 | High | 7.3 | 2026-01-05 | A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. Impacted is an unknown function of the file /order_view.php… |
CVE-2026-0584 | Medium | 6.3 | 2026-01-05 | A weakness has been identified in code-projects Online Product Reservation System 1.0. This issue affects some unknown processing of the file app/products/left… |
CVE-2026-0583 | High | 7.3 | 2026-01-05 | A security flaw has been discovered in code-projects Online Product Reservation System 1.0. This vulnerability affects unknown code of the file app/user/login… |
CVE-2026-0582 | Medium | 6.3 | 2026-01-05 | A vulnerability was identified in itsourcecode Society Management System 1.0. This affects an unknown part of the file /admin/edit_activity_query.php. The mani… |
CVE-2025-15239 | Medium | 6.5 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary… |
CVE-2025-15238 | Medium | 6.5 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary… |
CVE-2025-15450 | Medium | 6.3 | 2026-01-05 | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderH… |
CVE-2026-0579 | High | 7.3 | 2026-01-04 | A vulnerability was found in code-projects Online Product Reservation System 1.0. This affects an unknown part of the file /handgunner-administrator/edit.php o… |
CVE-2026-0578 | High | 7.3 | 2026-01-04 | A vulnerability has been found in code-projects Online Product Reservation System 1.0. Affected by this issue is some unknown functionality of the file /handgu… |
CVE-2025-15443 | Medium | 4.7 | 2026-01-04 | A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation… |
CVE-2025-15442 | Medium | 4.7 | 2026-01-04 | A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of th… |
CVE-2026-0576 | High | 7.3 | 2026-01-04 | A vulnerability was detected in code-projects Online Product Reservation System 1.0. Affected is an unknown function of the file /handgunner-administrator/prod… |
CVE-2026-0575 | High | 7.3 | 2026-01-04 | A security vulnerability has been detected in code-projects Online Product Reservation System 1.0. This impacts an unknown function of the file /handgunner-adm… |
CVE-2026-0570 | High | 7.3 | 2026-01-02 | A vulnerability was found in code-projects Online Music Site 1.0. This impacts an unknown function of the file /Frontend/Feedback.php. Performing a manipulatio… |