CWE-89 · SQL Injection (page 39)
Page 39 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14169 | High | 7.5 | 2025-12-12 | The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all ve… |
CVE-2025-14068 | High | 7.5 | 2025-12-12 | The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 0.6.3 due to ins… |
CVE-2025-62192 | Medium | 5.4 | 2025-12-12 | SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5… |
CVE-2024-58309 | Critical | 9.8 | 2025-12-11 | xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL c… |
CVE-2024-58308 | Critical | 9.8 | 2025-12-11 | Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form. Attac… |
CVE-2024-58307 | High | 8.8 | 2025-12-11 | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database… |
CVE-2024-58301 | | 2025-12-11 | Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parame… | |
CVE-2024-58290 | | 2025-12-11 | Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through… | |
CVE-2025-14537 | High | 7.3 | 2025-12-11 | A weakness has been identified in code-projects Class and Exam Timetable Management 1.0. Affected by this issue is some unknown functionality of the file /prev… |
CVE-2025-14536 | High | 7.3 | 2025-12-11 | A security flaw has been discovered in code-projects Class and Exam Timetable Management 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-13214 | High | 7.6 | 2025-12-11 | IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow th… |
CVE-2025-14529 | High | 7.3 | 2025-12-11 | A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The affected element is an unknown function of the file /admin/admin_running.php. T… |
CVE-2025-14527 | High | 7.3 | 2025-12-11 | A weakness has been identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /view_book.php. Exe… |
CVE-2025-14515 | High | 7.3 | 2025-12-11 | A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_u… |
CVE-2025-14514 | High | 7.3 | 2025-12-11 | A flaw has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/add_distributor.php. This manipulation of… |
CVE-2025-10163 | Medium | 6.5 | 2025-12-11 | The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versio… |
CVE-2025-67644 | High | 7.3 | 2025-12-11 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and belo… |
CVE-2025-65950 | High | 8.8 | 2025-12-10 | WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to… |
CVE-2025-67501 | High | 8.8 | 2025-12-10 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain an SQL Injection vulnerability… |
CVE-2021-47708 | | 2025-12-09 | COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitrary SQL code throu… | |
CVE-2021-47704 | Medium | 6.5 | 2025-12-09 | OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attack… |
CVE-2025-14337 | High | 7.3 | 2025-12-09 | A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This manipulation of the… |
CVE-2025-14336 | High | 7.3 | 2025-12-09 | A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /promote.php. The man… |
CVE-2025-14335 | High | 7.3 | 2025-12-09 | A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_schoo… |
CVE-2025-14334 | High | 7.3 | 2025-12-09 | A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /new_adviser.php. Executing manipulation of th… |
CVE-2025-64156 | High | 7.2 | 2025-12-09 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7… |
CVE-2025-63742 | Critical | 9.8 | 2025-12-09 | SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive… |
CVE-2025-63740 | Medium | 4.3 | 2025-12-09 | SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information… |
CVE-2025-67520 | High | 7.6 | 2025-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tiny Solutions Media Library Tools media-library-tools al… |
CVE-2025-67519 | High | 7.6 | 2025-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows SQL Inje… |
CVE-2025-67518 | High | 8.5 | 2025-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Accordion Slider PRO accordion_slider_pro al… |
CVE-2025-67517 | High | 8.5 | 2025-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in artplacer ArtPlacer Widget artplacer-widget allows Blind… |
CVE-2025-67516 | High | 8.5 | 2025-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress agile-store-locator a… |
CVE-2025-62093 | High | 8.5 | 2025-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Image&Video FullScreen Background lbg_fullsc… |
CVE-2025-12807 | | 2025-12-09 | A security issue was discovered in DataMosaix Private Cloud, allowing users with low privilege to perform sensitive database operations through exposed API end… | |
CVE-2025-12504 | Critical | 9.8 | 2025-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Talent Software UNIS allows SQL Injection. This issue af… |
CVE-2025-10655 | High | 8.8 | 2025-12-09 | SQL Injection in Frappe HelpDesk in the dashboard get_dashboard_data due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.This… |
CVE-2025-14285 | High | 7.3 | 2025-12-09 | A vulnerability was found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file edit_personnel.php. The manipula… |
CVE-2025-64081 | Critical | 9.8 | 2025-12-08 | SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arb… |
CVE-2025-14259 | Medium | 6.3 | 2025-12-08 | A vulnerability was found in Jihai Jshop MiniProgram Mall System 2.9.0. Affected by this issue is some unknown functionality of the file /index.php/api.html. T… |
CVE-2025-14258 | High | 7.3 | 2025-12-08 | A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /newsubjec… |
CVE-2025-14257 | High | 7.3 | 2025-12-08 | A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /newrecord.php. Executing manipulation of the… |
CVE-2025-14256 | High | 7.3 | 2025-12-08 | A vulnerability was detected in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /newcurriculm.php. Performing manipula… |
CVE-2025-14251 | High | 7.3 | 2025-12-08 | A security vulnerability has been detected in code-projects Online Ordering System 1.0. This affects an unknown function of the file /admin/ of the component A… |
CVE-2025-14250 | High | 7.3 | 2025-12-08 | A weakness has been identified in code-projects Online Ordering System 1.0. The impacted element is an unknown function of the file /user_contact.php. This man… |
CVE-2025-14249 | High | 7.3 | 2025-12-08 | A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /user_school.php. The… |
CVE-2025-14248 | High | 7.3 | 2025-12-08 | A vulnerability was identified in code-projects Simple Shopping Cart 1.0. Impacted is an unknown function of the file /adminlogin.php. The manipulation of the… |
CVE-2025-14247 | Medium | 6.3 | 2025-12-08 | A vulnerability was determined in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Admin/additems.php. Executing… |
CVE-2025-14246 | Medium | 6.3 | 2025-12-08 | A vulnerability was found in code-projects Simple Shopping Cart 1.0. This vulnerability affects unknown code of the file /Customers/settings.php. Performing ma… |
CVE-2025-14245 | High | 7.3 | 2025-12-08 | A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such manipulation of the… |
CVE-2025-14230 | Medium | 6.3 | 2025-12-08 | A vulnerability was detected in code-projects Daily Time Recording System 4.5.0. The impacted element is an unknown function of the file /admin/add_payroll.php… |
CVE-2025-14227 | Medium | 6.3 | 2025-12-08 | A security flaw has been discovered in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. This issue affects some unknown processing of… |
CVE-2025-14226 | High | 7.3 | 2025-12-08 | A vulnerability was identified in itsourcecode Student Management System 1.0. This vulnerability affects unknown code of the file /edit_user.php. The manipulat… |
CVE-2025-14255 | Medium | 6.5 | 2025-12-08 | Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to… |
CVE-2025-14254 | Medium | 6.5 | 2025-12-08 | Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to… |
CVE-2025-14223 | High | 7.3 | 2025-12-08 | A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php… |
CVE-2025-14222 | Medium | 6.3 | 2025-12-08 | A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This ma… |
CVE-2025-14218 | High | 7.3 | 2025-12-08 | A security flaw has been discovered in code-projects Currency Exchange System 1.0. The affected element is an unknown function of the file /editotheraccount.ph… |
CVE-2025-14217 | High | 7.3 | 2025-12-08 | A vulnerability was identified in code-projects Currency Exchange System 1.0. Impacted is an unknown function of the file /edittrns.php. Such manipulation of t… |
CVE-2025-14216 | High | 7.3 | 2025-12-08 | A vulnerability was determined in code-projects Currency Exchange System 1.0. This issue affects some unknown processing of the file /viewserial.php. This mani… |
CVE-2025-14215 | High | 7.3 | 2025-12-08 | A vulnerability was found in code-projects Currency Exchange System 1.0. This vulnerability affects unknown code of the file /edit.php. The manipulation of the… |
CVE-2025-14214 | Medium | 6.3 | 2025-12-08 | A vulnerability has been found in itsourcecode Student Information System 1.0. This affects an unknown part of the file /section_edit1.php. The manipulation of… |
CVE-2025-14212 | High | 7.3 | 2025-12-08 | A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /member_search… |
CVE-2025-14211 | High | 7.3 | 2025-12-08 | A vulnerability was detected in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2025-14210 | High | 7.3 | 2025-12-08 | A security vulnerability has been detected in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /delete_member… |
CVE-2025-14209 | High | 7.3 | 2025-12-08 | A weakness has been identified in Campcodes School File Management System 1.0. This impacts an unknown function of the file /update_query.php. This manipulatio… |
CVE-2025-14207 | High | 7.3 | 2025-12-08 | A vulnerability was identified in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. The impacted element is an unknown functi… |
CVE-2025-14203 | Medium | 6.3 | 2025-12-07 | A flaw has been found in code-projects Question Paper Generator up to 1.0. This vulnerability affects unknown code of the file /selectquestionuser.php. This ma… |
CVE-2025-14193 | Medium | 6.3 | 2025-12-07 | A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php… |
CVE-2025-14192 | High | 7.3 | 2025-12-07 | A vulnerability was found in RashminDungrani online-banking up to 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. This affects an unknown part of the file /site/dist… |
CVE-2025-14190 | High | 7.3 | 2025-12-07 | A flaw has been found in Chanjet TPlus up to 20251121. Affected by this vulnerability is an unknown functionality of the file /tplus/ajaxpro/Ufida.T.SM.UIP.Mul… |
CVE-2025-14189 | High | 7.3 | 2025-12-07 | A vulnerability was detected in Chanjet CRM up to 20251121. Affected is an unknown function of the file /tools/jxf_dump_table_demo.php. The manipulation of the… |
CVE-2025-14185 | Medium | 6.3 | 2025-12-07 | A vulnerability was identified in Yonyou U8 Cloud 5.0/5.0sp/5.1/5.1sp. The affected element is an unknown function of the file nc/pubitf/erm/mobile/appservice/… |
CVE-2025-13922 | Medium | 6.5 | 2025-12-06 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'existing_term… |
CVE-2025-14091 | High | 7.3 | 2025-12-05 | A weakness has been identified in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555. This vulnerability affects unknown code of the… |
CVE-2025-14090 | Medium | 4.7 | 2025-12-05 | A security flaw has been discovered in AMTT Hotel Broadband Operation System 1.0. This affects an unknown part of the file /manager/card/cardmake_down.php. Per… |
CVE-2025-12850 | High | 7.5 | 2025-12-05 | The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to… |
CVE-2025-13373 | High | 7.5 | 2025-12-04 | Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands. |
CVE-2024-58276 | | 2025-12-04 | Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execut… | |
CVE-2023-53734 | | 2025-12-04 | dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain admin… | |
CVE-2025-14012 | Medium | 4.7 | 2025-12-04 | A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/del… |
CVE-2025-14011 | Medium | 4.7 | 2025-12-04 | A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component… |
CVE-2025-62173 | | 2025-12-04 | ## Summary Authenticated SQL Injection Vulnerability in Endpoint Module Rest API | |
CVE-2025-13359 | Medium | 6.5 | 2025-12-03 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" f… |
CVE-2025-13495 | Medium | 4.9 | 2025-12-03 | The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to ins… |
CVE-2025-65380 | Medium | 6.5 | 2025-12-02 | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user inp… |
CVE-2025-65877 | High | 7.5 | 2025-12-02 | Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms… |
CVE-2025-65379 | Medium | 6.5 | 2025-12-02 | PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mobileno parameters a… |
CVE-2025-65896 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys. |
CVE-2025-60736 | Critical | 9.8 | 2025-12-02 | code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter. |
CVE-2025-65358 | Critical | 9.8 | 2025-12-02 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php. |
CVE-2025-13372 | Medium | 4.3 | 2025-12-02 | An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using… |
CVE-2025-41013 | Critical | 9.8 | 2025-12-02 | SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by se… |
CVE-2025-12465 | | 2025-12-02 | A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allo… | |
CVE-2025-13090 | Medium | 4.9 | 2025-12-02 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insuffic… |
CVE-2025-13724 | High | 7.5 | 2025-12-02 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up t… |
CVE-2025-12483 | Medium | 6.5 | 2025-12-02 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'query' parameter in all versions up to, an… |
CVE-2025-13001 | Medium | 4.1 | 2025-12-02 | The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as a… |
CVE-2025-13000 | High | 7.7 | 2025-12-02 | The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQL… |
CVE-2025-66313 | High | 7.2 | 2025-12-01 | ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSe… |