CWE-89 · SQL Injection (page 42)
Page 42 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12864 | High | 8.8 | 2025-11-10 | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
CVE-2025-12914 | Medium | 4.7 | 2025-11-08 | A vulnerability has been found in aaPanel BaoTa up to 11.2.x. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the com… |
CVE-2025-12913 | Medium | 4.7 | 2025-11-08 | A flaw has been found in code-projects Responsive Hotel Site 1.0. This affects an unknown part of the file /admin/roomdel.php. Executing manipulation of the ar… |
CVE-2025-11980 | Medium | 4.9 | 2025-11-08 | The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 d… |
CVE-2025-11972 | Medium | 4.9 | 2025-11-08 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all v… |
CVE-2025-11452 | High | 7.5 | 2025-11-08 | The Asgaros Forum plugin for WordPress is vulnerable to SQL Injection via the '$_COOKIE['asgarosforum_unread_exclude']' cookie in all versions up to, and inclu… |
CVE-2025-64493 | Medium | 6.5 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenti… |
CVE-2025-64492 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind S… |
CVE-2025-64488 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through… |
CVE-2025-63718 | Medium | 6.5 | 2025-11-07 | A SQL injection vulnerability exists in the SourceCodester PQMS (Patient Queue Management System) 1.0 in the api_patient_schedule.php endpoint. The appointment… |
CVE-2025-12873 | Medium | 4.7 | 2025-11-07 | A security flaw has been discovered in Campcodes School File Management 1.0. This affects an unknown part of the file /admin/update_user.php. Performing manipu… |
CVE-2025-63689 | Critical | 10.0 | 2025-11-07 | Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacke… |
CVE-2025-52425 | Critical | 9.8 | 2025-11-07 | An SQL injection vulnerability has been reported to affect QuMagie. A remote attacker can exploit the vulnerability to execute unauthorized code or commands. … |
CVE-2025-12861 | Medium | 4.7 | 2025-11-07 | A vulnerability was determined in DedeBIZ up to 6.3.2. Affected by this vulnerability is an unknown functionality of the file /admin/spec_add.php. This manipul… |
CVE-2025-12860 | Medium | 4.7 | 2025-11-07 | A vulnerability was found in DedeBIZ up to 6.3.2. Affected is an unknown function of the file /admin/freelist_main.php. The manipulation of the argument orderb… |
CVE-2025-12859 | Medium | 4.7 | 2025-11-07 | A vulnerability has been found in DedeBIZ up to 6.3.2. This impacts an unknown function of the file /admin/templets_one_edit.php. The manipulation of the argum… |
CVE-2025-12857 | Medium | 4.7 | 2025-11-07 | A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook… |
CVE-2025-12856 | Medium | 4.7 | 2025-11-07 | A weakness has been identified in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/reservation.php. This manipulatio… |
CVE-2025-12855 | Medium | 4.7 | 2025-11-07 | A security flaw has been discovered in code-projects Responsive Hotel Site 1.0. This issue affects some unknown processing of the file /admin/newsletterdel.php… |
CVE-2025-12853 | Medium | 4.7 | 2025-11-07 | A vulnerability was determined in SourceCodester Best House Rental Management System 1.0. This affects the function delete_house of the file /admin_class.php… |
CVE-2025-10968 | High | 8.8 | 2025-11-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in GG Soft Software Se… |
CVE-2025-10870 | | 2025-11-07 | SQL injection vulnerability in DIAL's CentrosNet v2.64. Allows an attacker to retrieve, create, update, and delete databases by sending POST and GET requests w… | |
CVE-2025-34247 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low… |
CVE-2025-34246 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated… |
CVE-2025-34245 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authent… |
CVE-2025-34244 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authent… |
CVE-2025-34243 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authen… |
CVE-2025-34242 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-pr… |
CVE-2025-34241 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated l… |
CVE-2025-34240 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticate… |
CVE-2022-50595 | High | 7.2 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50594 | High | 7.5 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50593 | Critical | 9.8 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50592 | High | 7.2 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50591 | Critical | 9.8 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50589 | Critical | 9.8 | 2025-11-06 | SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Success… |
CVE-2025-60239 | High | 8.5 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codexpert, Inc CoSchool LMS coschool allows Blind SQL Inj… |
CVE-2025-52773 | Critical | 9.3 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway… |
CVE-2025-48089 | Critical | 9.3 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-Themes Education WordPress Theme | HiStudy histud… |
CVE-2025-28953 | High | 8.5 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This… |
CVE-2025-10683 | Medium | 4.9 | 2025-11-06 | The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insuff… |
CVE-2025-64114 | Medium | 6.5 | 2025-11-06 | ClipBucket v5 is an open source video sharing platform. Versions 5.5.2 - #151 and below allow authenticated administrators with plugin management privileges to… |
CVE-2025-63585 | Medium | 6.5 | 2025-11-05 | OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter. |
CVE-2025-55343 | Critical | 9.9 | 2025-11-05 | Quipux 4.0.1 through e1774ac allows authenticated users to conduct SQL injection attacks via busqueda/busqueda.php txt_depe_codi, busqueda/busqueda.php txt_usu… |
CVE-2025-64459 | Critical | 9.1 | 2025-11-05 | An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get… |
CVE-2025-12197 | High | 7.5 | 2025-11-05 | The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient esca… |
CVE-2025-32786 | High | 7.5 | 2025-11-04 | The GLPI Inventory Plugin handles network discovery, inventory, software deployment, and data collection for GLPI agents. Versions 1.5.0 and below are vulnerab… |
CVE-2025-12463 | Critical | 9.8 | 2025-11-03 | An unauthenticated SQL Injection was discovered within the Geutebruck G-Cam E-Series Cameras through the `Group` parameter in the `/uapi-cgi/viewer/Param.cgi`… |
CVE-2025-63453 | Critical | 9.8 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php. |
CVE-2025-63452 | Critical | 9.4 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php. |
CVE-2025-63451 | Critical | 9.8 | 2025-11-03 | Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php. |
CVE-2025-12503 | Medium | 6.5 | 2025-11-03 | EasyFlow .NET and EasyFlow AiNet developed by Digiwin has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL comman… |
CVE-2025-12617 | High | 7.3 | 2025-11-03 | A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing a manipulation of t… |
CVE-2025-12614 | Medium | 4.7 | 2025-11-03 | A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the file /admin_class.php… |
CVE-2025-12612 | Medium | 6.3 | 2025-11-03 | A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of the file /ajax.php?ac… |
CVE-2025-12610 | Medium | 4.7 | 2025-11-03 | A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.php. Executing a ma… |
CVE-2025-12609 | Medium | 4.7 | 2025-11-03 | A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php… |
CVE-2025-12608 | High | 7.3 | 2025-11-03 | A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php… |
CVE-2025-12607 | High | 7.3 | 2025-11-03 | A vulnerability was identified in itsourcecode Online Loan Management System 1.0. Impacted is an unknown function of the file /manage_payment.php. Such manipul… |
CVE-2025-12606 | High | 7.3 | 2025-11-03 | A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manage_borrower.php… |
CVE-2025-12605 | High | 7.3 | 2025-11-02 | A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manage_loan.php. The manipula… |
CVE-2025-12604 | High | 7.3 | 2025-11-02 | A vulnerability has been found in itsourcecode Online Loan Management System 1.0. This affects an unknown part of the file /load_fields.php. The manipulation o… |
CVE-2025-12598 | Medium | 4.7 | 2025-11-02 | A flaw has been found in SourceCodester Best House Rental Management System 1.0. Affected by this issue is the function save_tenant of the file /admin_class.ph… |
CVE-2025-12597 | Medium | 4.7 | 2025-11-02 | A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. Affected by this vulnerability is the function save_category of the fil… |
CVE-2025-12594 | Medium | 4.7 | 2025-11-02 | A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. This affects an unknown function of the file /admin/add_accoun… |
CVE-2025-11740 | Medium | 6.5 | 2025-11-01 | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insuffici… |
CVE-2025-64366 | High | 7.6 | 2025-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-managem… |
CVE-2025-6520 | Critical | 9.8 | 2025-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection. This… |
CVE-2025-52664 | High | 8.8 | 2025-10-31 | SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted payloads are sent by logged in users |
CVE-2021-47693 | High | 8.8 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.3 / Nagios XI 5.8.5 contains a SQL injection vulnerability in the search text handling. Un… |
CVE-2020-36869 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrat… |
CVE-2020-36859 | High | 8.8 | 2025-10-30 | The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.0.7 / Nagios XI 5.7.4 contains multiple SQL injection vulnerabilities in the object edit pag… |
CVE-2020-36857 | High | 7.2 | 2025-10-30 | Nagios XI versions prior to 5.6.14 contain a post-authentication SQL injection vulnerability in the SNMP Trap Interface page. Exploitation requires an account… |
CVE-2016-15050 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 5.2.4 contain a SQL injection vulnerability in the notification search functionality. User-supplied search parameters were incorpor… |
CVE-2012-10063 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in the legacy Core Configuration Manager (CCM) interface. Authenticated users could… |
CVE-2025-63608 | Medium | 5.4 | 2025-10-30 | A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form… |
CVE-2025-64104 | High | 7.3 | 2025-10-29 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGr… |
CVE-2025-60542 | Medium | 6.5 | 2025-10-29 | SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjec… |
CVE-2025-63622 | Critical | 9.8 | 2025-10-29 | A vulnerability was found in code-projects Online Complaint Site 1.0. This issue affects some unknown processing of the file /cms/admin/subcategory.php. This m… |
CVE-2015-10147 | Medium | 4.9 | 2025-10-29 | The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due… |
CVE-2015-10146 | Medium | 4.9 | 2025-10-29 | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due t… |
CVE-2025-4665 | Critical | 9.6 | 2025-10-29 | WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into inse… |
CVE-2025-62367 | Medium | 4.8 | 2025-10-28 | Taiga is an open source project management platform. In versions 6.8.3 and earlier, Taiga API is vulnerable to time-based blind SQL injection allowing sensitiv… |
CVE-2025-34304 | Medium | 6.5 | 2025-10-28 | IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used wh… |
CVE-2025-11735 | High | 7.5 | 2025-10-28 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions u… |
CVE-2025-12342 | High | 7.3 | 2025-10-28 | A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of the component Login… |
CVE-2025-12339 | High | 7.3 | 2025-10-28 | A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-12338 | High | 7.3 | 2025-10-28 | A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/admin_product.p… |
CVE-2025-12337 | High | 7.3 | 2025-10-28 | A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1.0. This affects an unknown part of the file /admin/admin_feature.php. Pe… |
CVE-2025-12336 | High | 7.3 | 2025-10-28 | A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/ad… |
CVE-2025-12329 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. The affected element is an unknown function of the fil… |
CVE-2025-12328 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. Impacted is an unknown function of the file /contestproblem… |
CVE-2025-12327 | Medium | 6.3 | 2025-10-27 | A vulnerability was determined in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This issue affects some unknown processing of the file /des… |
CVE-2025-12326 | High | 7.3 | 2025-10-27 | A vulnerability was found in shawon100 RUET OJ up to 18fa45b0a669fa1098a0b8fc629cf6856369d9a5. This vulnerability affects unknown code of the file /process.php… |
CVE-2025-12325 | High | 7.3 | 2025-10-27 | A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The man… |
CVE-2025-12316 | High | 7.3 | 2025-10-27 | A vulnerability was identified in code-projects Courier Management System 1.0. This impacts an unknown function of the file /courier/edit-courier.php. The mani… |
CVE-2025-12315 | Medium | 4.7 | 2025-10-27 | A vulnerability was determined in code-projects Food Ordering System 1.0. This affects an unknown function of the file /admin/menu.php. Executing a manipulatio… |
CVE-2025-12314 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in code-projects Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/deleteitem.php. Performing… |
CVE-2025-12309 | High | 7.3 | 2025-10-27 | A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipul… |
CVE-2025-12308 | High | 7.3 | 2025-10-27 | A security flaw has been discovered in code-projects Nero Social Networking Site 1.0. Affected by this issue is some unknown functionality of the file /deletem… |