CWE-89 · SQL Injection (page 40)
Page 40 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66205 | High | 7.1 | 2025-12-01 | Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of v… |
CVE-2025-51683 | Critical | 9.8 | 2025-12-01 | A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request… |
CVE-2025-63535 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize usersuppl… |
CVE-2025-63532 | Critical | 9.6 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The application fails to properly sanitize user-s… |
CVE-2025-63531 | Critical | 10.0 | 2025-12-01 | A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize… |
CVE-2025-13811 | Medium | 6.3 | 2025-12-01 | A vulnerability was determined in jsnjfz WebStack-Guns 1.0. This vulnerability affects unknown code of the file src/main/java/com/jsnjfz/manage/core/common/con… |
CVE-2025-13788 | High | 7.3 | 2025-11-30 | A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /tools/upgradeattribute.php. The manipula… |
CVE-2025-13783 | Medium | 6.3 | 2025-11-30 | A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file… |
CVE-2025-13782 | High | 7.3 | 2025-11-30 | A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file applic… |
CVE-2025-13770 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2025-13769 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2025-13757 | High | 8.8 | 2025-11-27 | SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-11461 | High | 8.8 | 2025-11-26 | Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue af… |
CVE-2025-65236 | Critical | 9.8 | 2025-11-26 | OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.p… |
CVE-2025-65235 | Critical | 9.8 | 2025-11-26 | OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByPr… |
CVE-2025-62728 | Medium | 5.4 | 2025-11-26 | SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. The vulnerability is only exp… |
CVE-2025-66260 | Medium | 6.5 | 2025-11-26 | PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 35… |
CVE-2025-61167 | Medium | 6.5 | 2025-11-25 | SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id and datas parameter… |
CVE-2025-59369 | | 2025-11-25 | A SQL injection vulnerability has been identified in bwdpi. A remote, authenticated attacker could leverage this vulnerability to potentially execute arbitrary… | |
CVE-2025-13385 | Medium | 4.9 | 2025-11-25 | The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter i… |
CVE-2025-13370 | Medium | 4.9 | 2025-11-25 | The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insuff… |
CVE-2025-10144 | Medium | 6.5 | 2025-11-24 | The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all… |
CVE-2025-56401 | High | 7.6 | 2025-11-24 | ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName. |
CVE-2025-13586 | Medium | 4.7 | 2025-11-24 | A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipu… |
CVE-2025-13585 | High | 7.3 | 2025-11-24 | A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of… |
CVE-2025-7402 | High | 7.5 | 2025-11-24 | The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘site_id’ parameter in… |
CVE-2025-13583 | High | 7.3 | 2025-11-24 | A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /signupscript.php of the component POST… |
CVE-2025-13582 | High | 7.3 | 2025-11-24 | A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Affected by this issue is some unknown functionality of the file /detail.php of the com… |
CVE-2025-13581 | Medium | 6.3 | 2025-11-24 | A vulnerability was identified in itsourcecode Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /schedule… |
CVE-2025-13580 | Medium | 6.3 | 2025-11-24 | A vulnerability was determined in code-projects Library System 1.0. Affected is an unknown function of the file /mail.php. This manipulation of the argument ID… |
CVE-2025-13579 | Medium | 6.3 | 2025-11-24 | A vulnerability was found in code-projects Library System 1.0. This impacts an unknown function of the file /return.php. The manipulation of the argument ID re… |
CVE-2025-13578 | High | 7.3 | 2025-11-24 | A vulnerability has been found in code-projects Library System 1.0. This affects an unknown function of the file /index.php of the component Login. The manipul… |
CVE-2025-13575 | Medium | 6.3 | 2025-11-24 | A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php o… |
CVE-2025-13572 | High | 7.3 | 2025-11-23 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This affects an unknown part of the file /delete_admin.php. The manipul… |
CVE-2025-13571 | Medium | 6.3 | 2025-11-23 | A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file /listorder.ph… |
CVE-2025-13570 | Medium | 6.3 | 2025-11-23 | A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=state… |
CVE-2025-13569 | Medium | 6.3 | 2025-11-23 | A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/?page=city. Such manipulation of t… |
CVE-2025-13568 | Medium | 6.3 | 2025-11-23 | A flaw has been found in itsourcecode COVID Tracking System 1.0. This impacts an unknown function of the file /admin/?page=people. This manipulation of the arg… |
CVE-2025-13567 | Medium | 6.3 | 2025-11-23 | A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This affects an unknown function of the file /admin/?page=establishment. The manipulati… |
CVE-2025-13561 | High | 7.3 | 2025-11-23 | A vulnerability was determined in SourceCodester Company Website CMS 1.0. This vulnerability affects unknown code of the file /admin/index.php. This manipulati… |
CVE-2025-13560 | High | 7.3 | 2025-11-23 | A vulnerability was found in SourceCodester Company Website CMS 1.0. This affects an unknown part of the file /admin/reset-password.php. The manipulation of th… |
CVE-2025-13557 | High | 7.3 | 2025-11-23 | A vulnerability has been found in Campcodes Online Polling System 1.0. Affected by this issue is some unknown functionality of the file /registeracc.php. The m… |
CVE-2025-13556 | High | 7.3 | 2025-11-23 | A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Exe… |
CVE-2025-13555 | High | 7.3 | 2025-11-23 | A vulnerability was detected in Campcodes School File Management System 1.0. Affected is an unknown function of the file /index.php of the component Login. Per… |
CVE-2025-13554 | High | 7.3 | 2025-11-23 | A security vulnerability has been detected in Campcodes Supplier Management System 1.0. This impacts an unknown function of the file /index.php of the componen… |
CVE-2025-13546 | Medium | 6.3 | 2025-11-23 | A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this issue is some unknown functionality… |
CVE-2025-13545 | Medium | 4.7 | 2025-11-23 | A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an u… |
CVE-2025-66095 | High | 8.5 | 2025-11-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system… |
CVE-2025-13138 | High | 7.5 | 2025-11-21 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up… |
CVE-2025-12750 | Medium | 4.9 | 2025-11-21 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in all versions up to… |
CVE-2025-13485 | High | 7.3 | 2025-11-21 | A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=… |
CVE-2025-52410 | Critical | 9.8 | 2025-11-20 | Institute-of-Current-Students v1.0 contains a time-based blind SQL injection vulnerability in the mydetailsstudent.php endpoint. The `myds` GET parameter is no… |
CVE-2025-60798 | Medium | 6.5 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['q… |
CVE-2025-60797 | Medium | 6.5 | 2025-11-20 | phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries… |
CVE-2025-13451 | High | 7.3 | 2025-11-20 | A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.php. Such manipulatio… |
CVE-2025-13449 | High | 7.3 | 2025-11-20 | A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the… |
CVE-2025-13424 | Medium | 4.7 | 2025-11-20 | A vulnerability has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_product.php. The manipulati… |
CVE-2025-13422 | High | 7.3 | 2025-11-20 | A vulnerability was detected in freeprojectscodes Sports Club Management System 1.0. The affected element is an unknown function of the file /dashboard/admin/c… |
CVE-2025-13421 | High | 7.3 | 2025-11-19 | A security vulnerability has been detected in itsourcecode Human Resource Management System 1.0. Impacted is an unknown function of the file /src/store/NoticeS… |
CVE-2025-13420 | High | 7.3 | 2025-11-19 | A weakness has been identified in itsourcecode Human Resource Management System 1.0. This issue affects some unknown processing of the file /src/store/EventSto… |
CVE-2025-63719 | High | 7.3 | 2025-11-19 | Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username. |
CVE-2025-13410 | High | 7.3 | 2025-11-19 | A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected is an unknown function of the file /admin/receipt.php. Such manip… |
CVE-2025-65103 | High | 8.8 | 2025-11-19 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerabili… |
CVE-2025-12743 | | 2025-11-19 | The Looker endpoint for generating new projects from database connections allows users to specify "looker" as a connection name, which is a reserved internal n… | |
CVE-2025-65024 | High | 7.2 | 2025-11-19 | i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the… |
CVE-2025-65023 | High | 7.2 | 2025-11-19 | i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the… |
CVE-2025-65022 | High | 7.2 | 2025-11-19 | i-Educar is free, fully online school management software. In versions 2.10.0 and prior, an authenticated time-based SQL injection vulnerability exists in the… |
CVE-2025-63878 | Medium | 6.5 | 2025-11-19 | Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page. |
CVE-2025-13396 | Medium | 6.3 | 2025-11-19 | A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation… |
CVE-2025-10437 | Critical | 9.8 | 2025-11-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Tra… |
CVE-2025-13395 | High | 7.3 | 2025-11-19 | A security flaw has been discovered in codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8. The impacted element is the function Login of the file… |
CVE-2025-12646 | High | 7.5 | 2025-11-19 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'dayofyear' parameter in all versions up to, and including, 1.5.4 due to insuf… |
CVE-2025-65093 | Medium | 5.5 | 2025-11-18 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based blind SQL injection vulnerability was i… |
CVE-2025-63694 | Critical | 9.8 | 2025-11-18 | DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage. |
CVE-2025-63512 | Medium | 6.5 | 2025-11-18 | kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic. The application fails… |
CVE-2025-58692 | High | 8.8 | 2025-11-18 | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiVoice 7.2.0 throu… |
CVE-2025-9977 | | 2025-11-18 | Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which allows an unauthent… | |
CVE-2025-13347 | Medium | 6.3 | 2025-11-18 | A flaw has been found in SourceCodester Train Station Ticketing System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=save_user. Exe… |
CVE-2025-13346 | Medium | 6.3 | 2025-11-18 | A vulnerability was detected in SourceCodester Train Station Ticketing System 1.0. This affects an unknown part of the file /ajax.php?action=save_station. Perf… |
CVE-2025-41348 | Critical | 9.8 | 2025-11-18 | SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by… |
CVE-2025-13345 | Medium | 6.3 | 2025-11-18 | A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-13344 | High | 7.3 | 2025-11-18 | A weakness has been identified in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file /aj… |
CVE-2025-12411 | High | 7.1 | 2025-11-18 | The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1… |
CVE-2025-13325 | Medium | 6.3 | 2025-11-18 | A vulnerability was determined in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /enrollment_edit1.php. E… |
CVE-2025-13323 | High | 7.3 | 2025-11-18 | A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /listorder.php. Performing m… |
CVE-2025-13303 | Medium | 6.3 | 2025-11-17 | A vulnerability was determined in code-projects Courier Management System 1.0. Affected by this issue is some unknown functionality of the file /search-edit.ph… |
CVE-2025-13302 | Medium | 4.7 | 2025-11-17 | A vulnerability was identified in code-projects Courier Management System 1.0. This affects an unknown part of the file /add-new-officer.php. Such manipulation… |
CVE-2025-13301 | High | 7.3 | 2025-11-17 | A vulnerability was found in itsourcecode Web-Based Internet Laboratory Management System 1.0. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-13300 | High | 7.3 | 2025-11-17 | A vulnerability has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. Affected is an unknown function of the file /settings/contr… |
CVE-2025-13299 | High | 7.3 | 2025-11-17 | A flaw has been found in itsourcecode Web-Based Internet Laboratory Management System 1.0. This impacts an unknown function of the file /user/controller.php. E… |
CVE-2025-13298 | High | 7.3 | 2025-11-17 | A vulnerability was detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. This affects an unknown function of the file /enrollment/cont… |
CVE-2024-44664 | Medium | 6.5 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in product-details.php. |
CVE-2024-44659 | Critical | 9.8 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php. |
CVE-2024-44663 | Medium | 6.5 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the product parameter in search-result.php. |
CVE-2024-44662 | Medium | 6.5 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in the admin page. |
CVE-2024-44660 | Medium | 6.5 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the fullname, emailid, and contactno parameters in login.php. |
CVE-2024-44658 | Medium | 6.5 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the subcategory and category parameters in subcategory.php. |
CVE-2024-44654 | Medium | 6.5 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the email and mobileno parameters in reset-password.php. |
CVE-2025-13297 | High | 7.3 | 2025-11-17 | A security vulnerability has been detected in itsourcecode Web-Based Internet Laboratory Management System 1.0. The impacted element is an unknown function of… |
CVE-2024-44657 | Medium | 6.5 | 2025-11-17 | PHPGurukul Complaint Management System 2.0 is vulnerable to SQL Injection via the fromdate and todate parameters in between-date-userreport.php. |