CWE-89 · SQL Injection (page 4)
Page 4 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41453 | High | 8.8 | 2026-08-03 | Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrar… |
CVE-2026-69085 | Critical | 10.0 | 2026-08-03 | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenat… |
CVE-2026-69084 | Critical | 10.0 | 2026-08-03 | SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan… |
CVE-2026-69083 | Critical | 10.0 | 2026-08-03 | SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish R… |
CVE-2026-18592 | Medium | 4.7 | 2026-08-03 | A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/Em… |
CVE-2026-16572 | High | 8.6 | 2026-08-03 | The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated us… |
CVE-2026-16539 | High | 8.1 | 2026-08-03 | The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, a… |
CVE-2026-16532 | Critical | 9.1 | 2026-08-03 | The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthentic… |
CVE-2026-12965 | Critical | 9.1 | 2026-08-03 | The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing un… |
CVE-2026-65321 | Critical | 9.8 | 2026-08-02 | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-esca… |
CVE-2026-14920 | High | 8.2 | 2026-08-02 | ## Summary |
CVE-2026-6453 | Medium | 6.5 | 2026-08-01 | The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitiza… |
CVE-2026-17555 | Medium | 4.9 | 2026-08-01 | The WPvivid Backup & Migration plugin for WordPress is vulnerable to SQL Injection via the export_data parameter in versions up to, and including, 0.9.131. Thi… |
CVE-2026-16614 | Medium | 4.9 | 2026-08-01 | The GSheetConnector – CF7 Google Sheets Connector with Real-Time Sync plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all… |
CVE-2026-16087 | Medium | 6.5 | 2026-08-01 | The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in… |
CVE-2026-15951 | Medium | 4.9 | 2026-08-01 | The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insu… |
CVE-2026-15018 | Medium | 5.3 | 2026-08-01 | The Database Collation Fix plugin for WordPress is vulnerable to time-based SQL Injection via the 'force-collation-algorithm' parameter in all versions up to… |
CVE-2026-13596 | Critical | 9.1 | 2026-08-01 | The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allow… |
CVE-2026-15403 | Medium | 4.9 | 2026-08-01 | The Pinpoint Booking System – Version 2 plugin for WordPress is vulnerable to blind SQL Injection via the 'field' parameter in all versions up to, and includin… |
CVE-2026-45376 | Medium | 5.5 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/us… |
CVE-2025-69948 | Critical | 9.8 | 2026-07-31 | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. |
CVE-2025-69946 | Critical | 9.8 | 2026-07-31 | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and wa… |
CVE-2026-58048 | | 2026-07-31 | Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. | |
CVE-2026-17351 | Critical | 9.0 | 2026-07-31 | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exa… |
CVE-2026-17346 | High | 8.8 | 2026-07-31 | The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several… |
CVE-2026-46593 | | 2026-07-31 | A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.contr… | |
CVE-2025-67650 | | 2026-07-31 | An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated… | |
CVE-2025-67649 | | 2026-07-31 | A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters respon… | |
CVE-2026-15381 | Low | 3.7 | 2026-07-31 | The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated user… |
CVE-2026-15258 | High | 8.1 | 2026-07-31 | The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using the… |
CVE-2026-14554 | Medium | 6.5 | 2026-07-31 | The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with ad… |
CVE-2026-12721 | High | 8.6 | 2026-07-31 | The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing una… |
CVE-2026-63221 | Critical | 9.4 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into gene… |
CVE-2026-62845 | Medium | 4.7 | 2026-07-30 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolati… |
CVE-2025-69947 | Critical | 9.8 | 2026-07-30 | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. |
CVE-2025-69941 | Critical | 9.8 | 2026-07-30 | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. |
CVE-2025-69938 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. |
CVE-2025-69937 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. |
CVE-2025-69936 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. |
CVE-2025-69935 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter. |
CVE-2025-69934 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. |
CVE-2025-69933 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. |
CVE-2025-69931 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1. |
CVE-2025-69930 | Critical | 9.8 | 2026-07-30 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1. |
CVE-2025-65336 | Critical | 9.8 | 2026-07-30 | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. |
CVE-2026-4978 | Critical | 9.8 | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection… |
CVE-2026-54368 | High | 8.8 | 2026-07-30 | CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arb… |
CVE-2026-17543 | Critical | 9.8 | 2026-07-30 | Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* bef… |
CVE-2026-22620 | High | 8.6 | 2026-07-30 | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass a… |
CVE-2026-58046 | Critical | 9.9 | 2026-07-30 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Pl… |
CVE-2026-15153 | Medium | 6.8 | 2026-07-30 | The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query… |
CVE-2026-13395 | High | 8.6 | 2026-07-30 | The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauth… |
CVE-2026-48448 | High | 8.6 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could le… |
CVE-2026-16092 | Medium | 6.5 | 2026-07-30 | The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all ve… |
CVE-2026-15929 | | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL Injection. This iss… | |
CVE-2025-69949 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email. |
CVE-2025-69945 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1. |
CVE-2025-69944 | High | 7.3 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter. |
CVE-2025-69943 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid. |
CVE-2025-69942 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. |
CVE-2025-67408 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status. |
CVE-2025-67407 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class. |
CVE-2025-67406 | High | 7.3 | 2026-07-29 | https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The compone… |
CVE-2025-67405 | High | 7.3 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password. |
CVE-2025-67404 | Critical | 9.8 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class. |
CVE-2025-67403 | Critical | 9.8 | 2026-07-29 | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name. |
CVE-2025-65340 | Critical | 9.8 | 2026-07-29 | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php. |
CVE-2026-5490 | High | 8.8 | 2026-07-29 | DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of Driv… |
CVE-2026-8339 | | 2026-07-29 | A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat… | |
CVE-2026-65890 | Critical | 9.8 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in querie… |
CVE-2026-33385 | | 2026-07-29 | A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields… | |
CVE-2026-12895 | | 2026-07-29 | SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation us… | |
CVE-2026-11973 | Medium | 4.9 | 2026-07-29 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8… |
CVE-2026-63234 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint… |
CVE-2026-63233 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpo… |
CVE-2026-63232 | Critical | 9.9 | 2026-07-29 | A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoi… |
CVE-2026-63231 | High | 8.1 | 2026-07-29 | A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs u… |
CVE-2026-63230 | Critical | 9.1 | 2026-07-29 | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including… |
CVE-2026-63229 | Critical | 9.1 | 2026-07-29 | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endp… |
CVE-2026-15344 | Medium | 4.9 | 2026-07-29 | The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002… |
CVE-2026-54658 | Critical | 9.8 | 2026-07-28 | Hypequery is a TypeScript semantic layer for ClickHouse. Prior to 2.5.1, escapeValue() in packages/clickhouse/src/core/utils.ts did not escape backslashes befo… |
CVE-2026-6881 | | 2026-07-28 | A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive informatio… | |
CVE-2026-11391 | Medium | 6.3 | 2026-07-28 | Tanium addressed a SQL injection vulnerability in Patch. |
CVE-2026-7769 | High | 8.1 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6… |
CVE-2026-50736 | | 2026-07-28 | The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the su… | |
CVE-2026-15304 | Medium | 6.5 | 2026-07-28 | The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is d… |
CVE-2026-15444 | Medium | 4.9 | 2026-07-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all version… |
CVE-2026-16462 | Critical | 9.8 | 2026-07-28 | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands. |
CVE-2026-14785 | High | 7.5 | 2026-07-28 | The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due… |
CVE-2026-10207 | High | 7.5 | 2026-07-28 | The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitiz… |
CVE-2026-15267 | Medium | 6.5 | 2026-07-28 | The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' pa… |
CVE-2026-14516 | High | 7.5 | 2026-07-28 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in a… |
CVE-2026-13161 | High | 7.5 | 2026-07-28 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parame… |
CVE-2026-12800 | High | 7.5 | 2026-07-28 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/… |
CVE-2026-15673 | Medium | 4.4 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'check… |
CVE-2026-15671 | Medium | 4.9 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'i… |
CVE-2026-15670 | Medium | 4.9 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the… |
CVE-2026-12741 | High | 7.5 | 2026-07-28 | The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all vers… |
CVE-2026-6251 | Medium | 6.5 | 2026-07-28 | The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetc… |
CVE-2026-16811 | Medium | 4.9 | 2026-07-28 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' para… |