CWE-89 · SQL Injection (page 43)
Page 43 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12307 | High | 7.3 | 2025-10-27 | A vulnerability was identified in code-projects Nero Social Networking Site 1.0. Affected by this vulnerability is an unknown functionality of the file /addfri… |
CVE-2025-12306 | High | 7.3 | 2025-10-27 | A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulati… |
CVE-2025-61385 | Critical | 9.6 | 2025-10-27 | SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python list input to func… |
CVE-2025-61247 | High | 8.2 | 2025-10-27 | indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php. |
CVE-2025-12294 | Medium | 4.7 | 2025-10-27 | A security flaw has been discovered in SourceCodester Point of Sales 1.0. Impacted is an unknown function of the file /delete_category.php. Performing manipula… |
CVE-2025-12293 | High | 7.3 | 2025-10-27 | A vulnerability was identified in SourceCodester Point of Sales 1.0. This issue affects some unknown processing of the file /category.php. Such manipulation of… |
CVE-2025-12292 | High | 7.3 | 2025-10-27 | A vulnerability was determined in SourceCodester Point of Sales 1.0. This vulnerability affects unknown code of the file /index.php. This manipulation of the a… |
CVE-2023-49440 | High | 8.8 | 2025-10-27 | AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." |
CVE-2025-12287 | Medium | 4.7 | 2025-10-27 | A security vulnerability has been detected in Bdtask Wholesale Inventory Control and Inventory Management System up to 20251013. This impacts an unknown functi… |
CVE-2025-12277 | High | 7.3 | 2025-10-27 | A flaw has been found in Abdullah-Hasan-Sajjad Online-School up to f09dda77b4c29aa083ff57f4b1eb991b98b68883. This affects an unknown part of the file /studentL… |
CVE-2025-41009 | | 2025-10-27 | SQL injection vulnerability in the DRED virtual campus platform. This vulnerability allows an attacker to retrieve, create, update, and delete data from the da… | |
CVE-2025-12263 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation… |
CVE-2025-12262 | Medium | 6.3 | 2025-10-27 | A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing man… |
CVE-2025-12261 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performi… |
CVE-2025-12257 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in SourceCodester Online Student Result System 1.0. This issue affects some unknown processing of the file /view_res… |
CVE-2025-12256 | Medium | 6.3 | 2025-10-27 | A weakness has been identified in code-projects Online Event Judging System 1.0. This vulnerability affects unknown code of the file /edit_contestant.php. Exec… |
CVE-2025-12255 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown part of the file /add_contestant.php. Performing… |
CVE-2025-12254 | Medium | 6.3 | 2025-10-27 | A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected by this issue is some unknown functionality of the file /add_judge.ph… |
CVE-2025-12253 | High | 7.3 | 2025-10-27 | A vulnerability was determined in AMTT Hotel Broadband Operation System 1.0. Affected by this vulnerability is an unknown functionality of the file /user/porta… |
CVE-2025-12252 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /ajax/action.php. The manipulation of t… |
CVE-2025-12248 | High | 7.3 | 2025-10-27 | A security vulnerability has been detected in CLTPHP 3.0. The affected element is an unknown function of the file /home/search.html. Such manipulation of the a… |
CVE-2025-12243 | Medium | 6.3 | 2025-10-27 | A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.ph… |
CVE-2025-12242 | Medium | 6.3 | 2025-10-27 | A vulnerability has been found in CodeAstro Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/actions/ch… |
CVE-2025-12238 | Medium | 6.3 | 2025-10-27 | A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Perf… |
CVE-2025-12237 | High | 7.3 | 2025-10-27 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /index.php. Such manipulati… |
CVE-2025-12226 | Medium | 4.7 | 2025-10-27 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0. Impacted is the function save_house of the file /admin_class.php. Performi… |
CVE-2025-12215 | High | 7.3 | 2025-10-27 | A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /login_submit.php. Executing a manipulation of t… |
CVE-2025-12208 | High | 7.3 | 2025-10-27 | A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /admin_class.php. Performing… |
CVE-2025-8709 | High | 7.3 | 2025-10-26 | A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation. The affected versio… |
CVE-2025-9322 | High | 7.5 | 2025-10-25 | The Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions plugin for WordPress is vulnerable to SQL Injection via the 'w… |
CVE-2025-8416 | High | 7.5 | 2025-10-25 | The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9… |
CVE-2025-4203 | High | 7.5 | 2025-10-25 | The wpForo Forum plugin for WordPress is vulnerable to error‐based or time-based SQL Injection via the get_members() function in all versions up to, and includ… |
CVE-2025-11893 | Medium | 6.5 | 2025-10-25 | The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donati… |
CVE-2025-8536 | | 2025-10-24 | A SQL injection vulnerability has been identified in DobryCMS. Improper neutralization of input provided by user into language functionality allows for SQL Inj… | |
CVE-2025-11253 | Critical | 9.8 | 2025-10-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. Th… |
CVE-2025-10748 | Medium | 6.5 | 2025-10-24 | The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficien… |
CVE-2025-10740 | Medium | 6.3 | 2025-10-24 | The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capabili… |
CVE-2025-61464 | Medium | 6.5 | 2025-10-23 | gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php. |
CVE-2025-62617 | High | 7.2 | 2025-10-22 | Admidio is an open-source user management solution. Prior to version 4.3.17, an authenticated SQL injection vulnerability exists in the member assignment data… |
CVE-2025-62606 | High | 8.8 | 2025-10-22 | my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to version 2.5.12, an authenticated SQL in… |
CVE-2025-62015 | High | 7.6 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons ad… |
CVE-2025-59557 | Critical | 9.3 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Learts Addons learts-addons allows SQL Injectio… |
CVE-2025-57870 | Critical | 10.0 | 2025-10-22 | A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, u… |
CVE-2025-49931 | Critical | 9.3 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetSearch jet-search allows Blind SQL Injectio… |
CVE-2025-49915 | Critical | 9.3 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allow… |
CVE-2025-49378 | High | 8.5 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection… |
CVE-2025-48091 | High | 8.5 | 2025-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alexander AnyComment anycomment allows SQL Injection.This… |
CVE-2025-10047 | Medium | 4.9 | 2025-10-22 | The Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerable to SQL Injection… |
CVE-2025-61194 | Medium | 6.5 | 2025-10-21 | daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php. |
CVE-2025-56450 | Medium | 6.5 | 2025-10-21 | Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the `lead_id` parameter in the `/l2s/api/selfcareLeadHistory` e… |
CVE-2025-9339 | | 2025-10-21 | SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potent… | |
CVE-2025-9428 | High | 8.3 | 2025-10-21 | Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api. |
CVE-2025-26392 | Medium | 5.4 | 2025-10-21 | SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerabilit… |
CVE-2025-62658 | | 2025-10-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extensi… | |
CVE-2025-60783 | Medium | 6.5 | 2025-10-20 | There is a SQL injection vulnerability in Restaurant Management System DBMS Project v1.0 via login.php. The vulnerability allows attackers to manipulate the ap… |
CVE-2025-47902 | High | 8.8 | 2025-10-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This is… |
CVE-2025-61455 | Critical | 9.8 | 2025-10-20 | SQL Injection vulnerability exists in Bhabishya-123 E-commerce 1.0, specifically within the signup.inc.php endpoint. The application directly incorporates unsa… |
CVE-2025-41028 | | 2025-10-20 | A SQL Injection vulnerability has been found in Epsilon RH by Grupo Castilla. This vulnerability allows an attacker to retrieve, create, update and delete data… | |
CVE-2025-11944 | Medium | 4.7 | 2025-10-19 | A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component R… |
CVE-2025-11691 | High | 7.5 | 2025-10-18 | The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_by_id() function in… |
CVE-2025-10187 | Medium | 4.9 | 2025-10-18 | The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' parameter in all versions up to, and incl… |
CVE-2025-62655 | | 2025-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows… | |
CVE-2025-11912 | Medium | 6.3 | 2025-10-17 | A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file /DeviceState.do?Action=Query. This mani… |
CVE-2025-11911 | Medium | 6.3 | 2025-10-17 | A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. T… |
CVE-2025-11910 | Medium | 6.3 | 2025-10-17 | A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?A… |
CVE-2025-56316 | Critical | 9.8 | 2025-10-17 | A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL q… |
CVE-2025-11909 | Medium | 6.3 | 2025-10-17 | A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord… |
CVE-2025-62422 | High | 8.8 | 2025-10-17 | DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datasetData/tableField interface is vulnerab… |
CVE-2025-60514 | Medium | 6.5 | 2025-10-17 | Tillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts. |
CVE-2025-11904 | Medium | 6.3 | 2025-10-17 | A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.2. This affects the function hasUse of the file /cms/model/hasUse. The manipulation of the arg… |
CVE-2025-11903 | Medium | 6.3 | 2025-10-17 | A flaw has been found in yanyutao0402 ChanCMS up to 3.3.2. Affected by this issue is the function update of the file /cms/article/update. Executing a manipulat… |
CVE-2025-11902 | Medium | 6.3 | 2025-10-17 | A vulnerability was detected in yanyutao0402 ChanCMS up to 3.3.2. Affected by this vulnerability is the function findField of the file /cms/article/findField… |
CVE-2025-62423 | Medium | 6.7 | 2025-10-16 | ClipBucket V5 provides open source video hosting with PHP. In version5.5.2 - #140 and earlier, a Blind SQL injection vulnerability exists in the Admin Area’s “… |
CVE-2025-60641 | Medium | 6.5 | 2025-10-16 | The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-c… |
CVE-2025-56700 | Medium | 5.4 | 2025-10-16 | Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has… |
CVE-2025-56699 | Medium | 5.4 | 2025-10-16 | SQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated user to execute arb… |
CVE-2025-61540 | Medium | 6.5 | 2025-10-16 | SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php. |
CVE-2025-41019 | | 2025-10-16 | SQL injection in Sergestec's SISTICK v7.2. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'id' parameter i… | |
CVE-2025-41018 | Critical | 9.8 | 2025-10-16 | SQL injection in Sergestec's Exito v8.0. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'cat' parameter in… |
CVE-2025-11365 | Medium | 6.5 | 2025-10-15 | The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'google_map' shortcode in all versions up to… |
CVE-2025-11177 | High | 7.5 | 2025-10-15 | The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient… |
CVE-2025-10743 | High | 7.5 | 2025-10-15 | The Outdoor plugin for WordPress is vulnerable to SQL Injection via the 'edit' action in all versions up to, and including, 1.3.2 due to insufficient escaping… |
CVE-2025-10730 | Medium | 6.5 | 2025-10-15 | The Wp tabber widget plugin for WordPress is vulnerable to SQL Injection via the 'wp-tabber-widget' shortcode in all versions up to, and including, 4.0 due to… |
CVE-2025-10682 | Medium | 6.5 | 2025-10-15 | The TARIFFUXX plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4. This is due to insufficient neutralization of user-sup… |
CVE-2025-10660 | Medium | 6.5 | 2025-10-15 | The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficien… |
CVE-2025-10575 | Medium | 6.5 | 2025-10-15 | The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryPaged::get_gallery_p… |
CVE-2025-10310 | Medium | 4.9 | 2025-10-15 | The Rich Snippet Site Report plugin for WordPress is vulnerable to SQL Injection via the 'last' parameter in all versions up to, and including, 2.0.0105 due t… |
CVE-2025-10045 | Medium | 4.9 | 2025-10-15 | The onOffice for WP-Websites plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 6.5.1 due to i… |
CVE-2025-11501 | High | 7.5 | 2025-10-15 | The Dynamically Display Posts plugin for WordPress is vulnerable to SQL Injection via the 'tax_query' parameter in all versions up to, and including, 1.1 due t… |
CVE-2025-61675 | | 2025-10-14 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17… | |
CVE-2025-11736 | High | 7.3 | 2025-10-14 | A flaw has been found in itsourcecode Online Examination System 1.0. Affected by this issue is some unknown functionality of the file /index.php. This manipula… |
CVE-2025-59213 | High | 8.8 | 2025-10-14 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elev… |
CVE-2025-55320 | Medium | 6.8 | 2025-10-14 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevat… |
CVE-2025-10610 | Critical | 9.8 | 2025-10-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SFS Consulting Information Processing Industry and Foreig… |
CVE-2025-40755 | High | 8.8 | 2025-10-14 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP1). Affected applications are vulnerable to SQL injection through getTotalAndFilterCoun… |
CVE-2025-62392 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62391 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62390 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62389 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |
CVE-2025-62388 | Medium | 6.5 | 2025-10-13 | SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database. |