CWE-89 · SQL Injection (page 38)
Page 38 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10726 | Critical | 9.1 | 2025-10-03 | The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insuf… |
CVE-2025-10582 | High | 8.8 | 2025-10-03 | The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient es… |
CVE-2025-0616 | High | 8.2 | 2025-10-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Lt… |
CVE-2025-61605 | Critical | 9.8 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identif… |
CVE-2025-61603 | Critical | 9.8 | 2025-10-02 | WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/cont… |
CVE-2025-56162 | Medium | 6.5 | 2025-10-02 | YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates… |
CVE-2025-61096 | Medium | 6.5 | 2025-10-02 | PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter. |
CVE-2025-59743 | Critical | 9.8 | 2025-10-02 | SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending… |
CVE-2025-59742 | Critical | 9.8 | 2025-10-02 | SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending… |
CVE-2025-56381 | Medium | 6.5 | 2025-10-02 | ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and g… |
CVE-2025-56380 | Medium | 6.5 | 2025-10-02 | Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a… |
CVE-2025-11020 | High | 8.8 | 2025-10-02 | An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with… |
CVE-2025-59681 | High | 7.1 | 2025-10-01 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and… |
CVE-2025-52042 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to… |
CVE-2025-52041 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Inje… |
CVE-2025-52040 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can ext… |
CVE-2025-52039 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable t… |
CVE-2025-57254 | Medium | 6.5 | 2025-09-30 | An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers to execute arbitrar… |
CVE-2025-52050 | Medium | 6.5 | 2025-09-30 | In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable… |
CVE-2025-52049 | Medium | 6.5 | 2025-09-30 | In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which a… |
CVE-2025-52047 | Medium | 6.5 | 2025-09-30 | In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to ext… |
CVE-2025-52043 | Medium | 6.5 | 2025-09-30 | In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL… |
CVE-2025-8877 | High | 7.5 | 2025-09-30 | The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in all versions up to, and including, 2.2… |
CVE-2025-8122 | High | 8.8 | 2025-09-30 | Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects… |
CVE-2025-8121 | High | 8.8 | 2025-09-30 | Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects… |
CVE-2024-13150 | Critical | 9.8 | 2025-09-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fayton Software and Consulting Services fayton.Pro ERP al… |
CVE-2025-8868 | Critical | 9.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-6724 | High | 8.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-11118 | High | 7.3 | 2025-09-28 | A vulnerability was identified in CodeAstro Student Grading System 1.0. This issue affects some unknown processing of the file /adminLogin.php. Such manipulati… |
CVE-2025-11116 | High | 7.3 | 2025-09-28 | A vulnerability was found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /add.home.php. The manipulation of the argume… |
CVE-2025-11115 | High | 7.3 | 2025-09-28 | A vulnerability has been found in code-projects Simple Scheduling System 1.0. Affected by this issue is some unknown functionality of the file /addtime.php. Th… |
CVE-2025-11114 | Medium | 6.3 | 2025-09-28 | A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.ph… |
CVE-2025-11113 | Medium | 6.3 | 2025-09-28 | A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the… |
CVE-2025-11111 | High | 7.3 | 2025-09-28 | A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/candidates_edit.p… |
CVE-2025-11110 | High | 7.3 | 2025-09-28 | A security flaw has been discovered in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/school_y… |
CVE-2025-11109 | High | 7.3 | 2025-09-28 | A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/us_edit.php… |
CVE-2025-11108 | High | 7.3 | 2025-09-28 | A vulnerability was determined in code-projects Simple Scheduling System 1.0. Impacted is an unknown function of the file /schedulingsystem/addroom.php. Execut… |
CVE-2025-11107 | High | 7.3 | 2025-09-28 | A vulnerability was found in code-projects Simple Scheduling System 1.0. This issue affects some unknown processing of the file /schedulingsystem/addcourse.php… |
CVE-2025-11106 | High | 7.3 | 2025-09-28 | A vulnerability has been found in code-projects Simple Scheduling System 1.0. This vulnerability affects unknown code of the file /schedulingsystem/addfaculty… |
CVE-2025-11105 | High | 7.3 | 2025-09-28 | A flaw has been found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /schedulingsystem/addsubject.php. This manipulati… |
CVE-2025-11104 | Medium | 6.3 | 2025-09-28 | A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /admin/bill.php. The… |
CVE-2025-11102 | High | 7.3 | 2025-09-28 | A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/edit_content.php. Executi… |
CVE-2025-11101 | High | 7.3 | 2025-09-28 | A security flaw has been discovered in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/company/index.php… |
CVE-2025-11094 | High | 7.3 | 2025-09-28 | A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/admin_product_details.php… |
CVE-2025-11090 | Medium | 6.3 | 2025-09-28 | A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected is an unknown function of the file /admin/employee/index.php?view=edit. The… |
CVE-2025-11089 | High | 7.3 | 2025-09-28 | A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This impacts an unknown function of the file /Pr… |
CVE-2025-11088 | Medium | 6.3 | 2025-09-28 | A weakness has been identified in itsourcecode Open Source Job Portal 1.0. Impacted is an unknown function of the file /admin/vacancy/index.php?view=edit. This… |
CVE-2025-11077 | High | 7.3 | 2025-09-27 | A vulnerability was determined in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/add_content.php. Executin… |
CVE-2025-11076 | High | 7.3 | 2025-09-27 | A vulnerability was found in Campcodes Online Learning Management System 1.0. This impacts an unknown function of the file /admin/edit_teacher.php. Performing… |
CVE-2025-11075 | High | 7.3 | 2025-09-27 | A vulnerability has been found in Campcodes Online Learning Management System 1.0. This affects an unknown function of the file /admin/de_activate.php. Such ma… |
CVE-2025-11074 | High | 7.3 | 2025-09-27 | A flaw has been found in code-projects Project Monitoring System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of… |
CVE-2025-11071 | Medium | 4.7 | 2025-09-27 | A security vulnerability has been detected in SeaCMS 13.3.20250820. Impacted is an unknown function of the file /admin_cron.php of the component Cron Task Mana… |
CVE-2025-11070 | High | 7.3 | 2025-09-27 | A vulnerability was identified in Projectworlds Online Shopping System 1.0. This affects an unknown part of the file /store/cart_add.php. Such manipulation of… |
CVE-2025-11066 | High | 7.3 | 2025-09-27 | A flaw has been found in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/bidlist.php. Executing manipulati… |
CVE-2025-11064 | High | 7.3 | 2025-09-27 | A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Impacted is an unknown function of the file /admin/teachers.php. The ma… |
CVE-2025-11063 | High | 7.3 | 2025-09-27 | A vulnerability was identified in Campcodes Online Learning Management System 1.0. This issue affects some unknown processing of the file /admin/edit_departmen… |
CVE-2025-11062 | High | 7.3 | 2025-09-27 | A vulnerability was determined in Campcodes Online Learning Management System 1.0. This vulnerability affects unknown code of the file /admin/save_student.php… |
CVE-2025-11061 | High | 7.3 | 2025-09-27 | A vulnerability was found in Campcodes Online Learning Management System 1.0. This affects an unknown part of the file /admin/edit_student.php. Performing mani… |
CVE-2025-11057 | High | 7.3 | 2025-09-27 | A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality of the file /admin/… |
CVE-2025-11056 | Medium | 6.3 | 2025-09-27 | A flaw has been found in ProjectsAndPrograms School Management System 1.0. Affected by this vulnerability is an unknown functionality of the file owner_panel/f… |
CVE-2025-11055 | High | 7.3 | 2025-09-27 | A vulnerability was detected in SourceCodester Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/updateaddress.php. The m… |
CVE-2025-11054 | Medium | 6.3 | 2025-09-27 | A security vulnerability has been detected in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/category/i… |
CVE-2025-11053 | High | 7.3 | 2025-09-27 | A weakness has been identified in PHPGurukul Small CRM 4.0. This affects an unknown function of the file /forgot-password.php. Executing manipulation of the ar… |
CVE-2025-11052 | High | 7.3 | 2025-09-27 | A security flaw has been discovered in kidaze CourseSelectionSystem 1.0/5.php. The impacted element is an unknown function of the file /Profilers/PriProfile/CO… |
CVE-2025-59939 | High | 8.8 | 2025-09-27 | WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the f… |
CVE-2025-11041 | Medium | 6.3 | 2025-09-26 | A vulnerability has been found in itsourcecode Open Source Job Portal 1.0. Affected by this issue is some unknown functionality of the file /admin/user/index.p… |
CVE-2025-11040 | High | 7.3 | 2025-09-26 | A vulnerability was detected in code-projects Hostel Management System 1.0. Affected by this issue is some unknown functionality of the file /justines/admin/mo… |
CVE-2025-11039 | High | 7.3 | 2025-09-26 | A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-11038 | Medium | 6.3 | 2025-09-26 | A weakness has been identified in itsourcecode Online Clinic Management System 1.0. Affected is an unknown function of the file /details.php?action=post. Execu… |
CVE-2025-11037 | High | 7.3 | 2025-09-26 | A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/admin_index_search.php. Perfor… |
CVE-2025-11036 | High | 7.3 | 2025-09-26 | A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/admin_account_update.php. Such mani… |
CVE-2025-11033 | High | 7.3 | 2025-09-26 | A vulnerability has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. Impacted is an unknown function of the file /Pro… |
CVE-2025-11032 | High | 7.3 | 2025-09-26 | A flaw has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This issue affects some unknown processing of the file /P… |
CVE-2025-60118 | High | 8.5 | 2025-09-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions PGS Core pgs-core allows SQL Injec… |
CVE-2025-60110 | High | 8.5 | 2025-09-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerR… |
CVE-2025-60109 | High | 8.5 | 2025-09-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all… |
CVE-2025-60108 | High | 8.5 | 2025-09-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbn… |
CVE-2025-60107 | High | 8.5 | 2025-09-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playli… |
CVE-2025-10037 | Medium | 4.9 | 2025-09-26 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_posts_with_internal_featured_image() function in all version… |
CVE-2025-10036 | Medium | 4.9 | 2025-09-26 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to SQL Injection via the get_all_urls() function in all versions up to, and including, 5… |
CVE-2025-10973 | High | 7.3 | 2025-09-25 | A flaw has been found in JackieDYH Resume-management-system up to fb6b857d852dd796e748ce30c606fe5e61c18273. Affected by this issue is some unknown functionalit… |
CVE-2025-59816 | High | 7.3 | 2025-09-25 | This vulnerability allows attackers to directly query the underlying database, potentially retrieving all data stored in the Billing Admin database, including… |
CVE-2025-59814 | High | 8.8 | 2025-09-25 | This vulnerability allows malicious actors to gain unauthorized access to the Zenitel ICX500 and ICX510 Gateway Billing Admin endpoint, enabling them to read t… |
CVE-2025-10967 | High | 7.3 | 2025-09-25 | A vulnerability was detected in MuFen-mker PHP-Usermm up to 37f2d24e51b04346dfc565b93fc2fc6b37bdaea9. This affects an unknown part of the file /chkuser.php. Pe… |
CVE-2025-27261 | Critical | 9.8 | 2025-09-25 | Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if exploited can result in unauthorized disclosure or modification of data. |
CVE-2025-40698 | | 2025-09-25 | SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases b… | |
CVE-2025-29084 | Medium | 6.5 | 2025-09-23 | SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Upgrade.php file. |
CVE-2025-10184 | | 2025-09-23 | The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permissi… | |
CVE-2025-10857 | High | 7.3 | 2025-09-23 | A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the file /login.php. Per… |
CVE-2025-10851 | High | 7.3 | 2025-09-23 | A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing mani… |
CVE-2025-10848 | Medium | 6.3 | 2025-09-23 | A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the file /check_student.ph… |
CVE-2025-10846 | Medium | 6.3 | 2025-09-23 | A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This m… |
CVE-2025-10845 | Medium | 6.3 | 2025-09-23 | A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The manipulation of th… |
CVE-2025-10844 | Medium | 6.3 | 2025-09-23 | A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/Cadastro/aluno. The… |
CVE-2025-10843 | High | 7.3 | 2025-09-23 | A flaw has been found in Reservation Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /reservation/p… |
CVE-2025-10842 | High | 7.3 | 2025-09-23 | A vulnerability was detected in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /administrator/wew.php. Performing manipul… |
CVE-2025-10841 | High | 7.3 | 2025-09-23 | A security vulnerability has been detected in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/weweee.php… |
CVE-2025-10840 | Medium | 6.3 | 2025-09-23 | A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/print-payment.php. T… |
CVE-2025-10839 | Medium | 6.3 | 2025-09-23 | A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. The impacted element is an unknown function of the file /admin/inv-… |
CVE-2025-10836 | High | 7.3 | 2025-09-23 | A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/print1.php. Executing… |