CWE-89 · SQL Injection (page 4)
Page 4 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-94042 | Medium | 6.3 | 2026-09-20 | A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query… |
CVE-2026-94041 | Medium | 6.3 | 2026-09-20 | A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some un… |
CVE-2026-88855 | | 2026-09-20 | Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveGallery(… | |
CVE-2026-88854 | | 2026-09-20 | Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and… | |
CVE-2026-94032 | Medium | 6.3 | 2026-09-20 | A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of… |
CVE-2026-94015 | High | 7.3 | 2026-09-20 | A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user… |
CVE-2026-93997 | High | 7.3 | 2026-09-20 | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/edit_s… |
CVE-2026-93980 | High | 7.3 | 2026-09-20 | A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the c… |
CVE-2026-93979 | High | 7.3 | 2026-09-20 | A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing… |
CVE-2026-93978 | High | 7.3 | 2026-09-20 | A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php… |
CVE-2026-93974 | High | 7.3 | 2026-09-20 | A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/data… |
CVE-2026-93973 | High | 7.3 | 2026-09-20 | A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admin… |
CVE-2026-93972 | High | 7.3 | 2026-09-20 | A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /re… |
CVE-2026-93963 | Medium | 6.3 | 2026-09-20 | A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/control… |
CVE-2026-93959 | High | 7.3 | 2026-09-20 | A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admi… |
CVE-2026-93983 | Medium | 5.0 | 2026-09-19 | OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply… |
CVE-2026-9855 | Medium | 6.5 | 2026-09-19 | The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 d… |
CVE-2026-75959 | Medium | 4.9 | 2026-09-19 | The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including… |
CVE-2026-6295 | Medium | 4.9 | 2026-09-19 | The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe… |
CVE-2026-13200 | Medium | 6.5 | 2026-09-19 | The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficien… |
CVE-2026-13191 | Medium | 6.5 | 2026-09-19 | The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insuffic… |
CVE-2026-88926 | High | 8.6 | 2026-09-19 | The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL s… |
CVE-2026-84239 | High | 7.6 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special element… |
CVE-2026-84105 | High | 7.7 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special element… |
CVE-2026-84082 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an… |
CVE-2026-84073 | Critical | 9.1 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special eleme… |
CVE-2026-84064 | Critical | 9.9 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special eleme… |
CVE-2026-81933 | High | 8.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can… |
CVE-2026-81656 | High | 8.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user c… |
CVE-2026-81626 | High | 8.6 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL… |
CVE-2026-80441 | Critical | 9.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of chan… |
CVE-2026-76899 | Medium | 5.7 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/pag… |
CVE-2026-61820 | High | 8.5 | 2026-09-18 | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-ke… |
CVE-2026-61819 | High | 8.5 | 2026-09-18 | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true… |
CVE-2026-61818 | High | 8.5 | 2026-09-18 | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undo_partition() reads part_config.time_encoder as unrestri… |
CVE-2026-61817 | High | 8.5 | 2026-09-18 | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance(), show_partitions(), show_partition_info()… |
CVE-2026-61781 | Critical | 9.9 | 2026-09-18 | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_partition_time() reads the writable part_config.time… |
CVE-2026-52745 | Medium | 5.3 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page en… |
CVE-2026-17619 | High | 8.6 | 2026-09-18 | IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, mo… |
CVE-2023-54399 | Critical | 9.8 | 2026-09-18 | Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a databa… |
CVE-2021-48008 | High | 7.5 | 2026-09-18 | Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site_id G… |
CVE-2019-25776 | High | 7.5 | 2026-09-18 | Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious i… |
CVE-2026-77928 | Medium | 6.5 | 2026-09-18 | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitti… |
CVE-2026-77927 | Medium | 6.5 | 2026-09-18 | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by sub… |
CVE-2026-93591 | High | 7.6 | 2026-09-18 | SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string l… |
CVE-2026-4036 | Medium | 6.5 | 2026-09-18 | An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) befo… |
CVE-2026-13683 | Low | 2.7 | 2026-09-18 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DS… |
CVE-2026-85705 | High | 7.5 | 2026-09-18 | The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and… |
CVE-2026-85652 | Medium | 6.5 | 2026-09-18 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in… |
CVE-2026-75961 | Medium | 4.9 | 2026-09-18 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all ve… |
CVE-2026-67100 | Critical | 9.8 | 2026-09-18 | HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attac… |
CVE-2026-18442 | High | 7.5 | 2026-09-18 | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' p… |
CVE-2026-17607 | Medium | 6.5 | 2026-09-18 | The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up… |
CVE-2026-15275 | High | 7.5 | 2026-09-18 | The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up… |
CVE-2026-17576 | Medium | 6.5 | 2026-09-18 | The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to… |
CVE-2026-87775 | High | 8.6 | 2026-09-18 | The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action ava… |
CVE-2026-87774 | High | 8.6 | 2026-09-18 | The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action ava… |
CVE-2026-87771 | High | 8.6 | 2026-09-18 | The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions availab… |
CVE-2026-87770 | High | 8.6 | 2026-09-18 | The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action a… |
CVE-2026-87767 | High | 8.6 | 2026-09-18 | The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX… |
CVE-2026-18912 | High | 7.7 | 2026-09-18 | ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to exe… |
CVE-2026-93426 | High | 8.5 | 2026-09-17 | SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject… |
CVE-2026-54647 | High | 7.2 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_ex… |
CVE-2026-54646 | High | 7.2 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER… |
CVE-2026-53557 | | 2026-09-17 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName… | |
CVE-2026-53556 | | 2026-09-17 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend… | |
CVE-2026-54597 | High | 8.3 | 2026-09-17 | ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with mo… |
CVE-2026-54596 | High | 8.1 | 2026-09-17 | ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician o… |
CVE-2026-54354 | High | 8.2 | 2026-09-17 | MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPos… |
CVE-2025-55787 | Critical | 9.8 | 2026-09-17 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. |
CVE-2026-54524 | | 2026-09-17 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through fil… | |
CVE-2026-52851 | High | 7.1 | 2026-09-17 | Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can su… |
CVE-2026-92926 | High | 7.3 | 2026-09-17 | A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preferen… |
CVE-2026-93292 | High | 8.5 | 2026-09-17 | SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_nam… |
CVE-2026-79752 | | 2026-09-17 | CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, Function… | |
CVE-2026-66631 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions. |
CVE-2026-66630 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. |
CVE-2026-66628 | High | 7.6 | 2026-09-17 | Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions. |
CVE-2026-66626 | High | 7.6 | 2026-09-17 | Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions. |
CVE-2026-66625 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions. |
CVE-2026-66624 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions. |
CVE-2026-66619 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in Newsletters <= 4.18 versions. |
CVE-2026-66618 | High | 7.6 | 2026-09-17 | Administrator SQL Injection in WP Maps <= 4.9.9 versions. |
CVE-2026-66580 | High | 8.5 | 2026-09-17 | Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions. |
CVE-2026-92903 | High | 8.2 | 2026-09-17 | Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are exe… |
CVE-2026-87963 | High | 8.6 | 2026-09-17 | The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it be… |
CVE-2026-76449 | Medium | 4.9 | 2026-09-16 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to con… |
CVE-2026-76448 | Medium | 4.9 | 2026-09-16 | A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to con… |
CVE-2026-76428 | Medium | 4.9 | 2026-09-16 | A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the sess… |
CVE-2026-76426 | Medium | 4.9 | 2026-09-16 | A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monit… |
CVE-2026-76425 | High | 7.6 | 2026-09-16 | A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This v… |
CVE-2026-75513 | Critical | 9.1 | 2026-09-16 | Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths inte… |
CVE-2026-20344 | High | 8.8 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection att… |
CVE-2026-20300 | High | 7.1 | 2026-09-16 | A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerabilit… |
CVE-2026-20247 | High | 7.5 | 2026-09-16 | A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is d… |
CVE-2026-20235 | Medium | 4.9 | 2026-09-16 | A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected d… |
CVE-2026-92526 | Medium | 6.3 | 2026-09-16 | A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulati… |
CVE-2026-87105 | High | 8.8 | 2026-09-16 | Tanium addressed a SQL injection vulnerability in Threat Response. |
CVE-2026-87024 | High | 7.2 | 2026-09-16 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2026-86865 | High | 7.2 | 2026-09-16 | Tanium addressed a SQL injection vulnerability in Asset. |