CWE-89 · SQL Injection (page 45)
Page 45 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10587 | Critical | 9.8 | 2025-10-08 | The Community Events plugin for WordPress is vulnerable to SQL Injection via the event_category parameter in all versions up to, and including, 1.5.1 due to in… |
CVE-2025-11424 | High | 7.3 | 2025-10-08 | A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. This impacts an unknown function of the file /login.php. Executing mani… |
CVE-2025-11422 | High | 7.3 | 2025-10-08 | A vulnerability has been found in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /admin/login… |
CVE-2025-11420 | High | 7.3 | 2025-10-08 | A vulnerability was detected in code-projects E-Commerce Website 1.0. Impacted is an unknown function of the file /pages/edit_order_details.php. The manipulati… |
CVE-2025-11416 | High | 7.3 | 2025-10-07 | A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/invoices.php. Performin… |
CVE-2025-11415 | High | 7.3 | 2025-10-07 | A vulnerability was identified in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/cust… |
CVE-2025-11410 | Medium | 6.3 | 2025-10-07 | A flaw has been found in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/voters_add.php. Executing… |
CVE-2025-11409 | Medium | 6.3 | 2025-10-07 | A vulnerability was detected in Campcodes Advanced Online Voting Management System 1.0. The impacted element is an unknown function of the file /index.php. Per… |
CVE-2025-11405 | Medium | 6.3 | 2025-10-07 | A vulnerability was identified in SourceCodester Hotel and Lodge Management System 1.0. This vulnerability affects unknown code of the file /del_tax.php. The m… |
CVE-2025-11404 | Medium | 6.3 | 2025-10-07 | A vulnerability was determined in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown part of the file /pages/save_tax.php. Executing… |
CVE-2025-11403 | Medium | 6.3 | 2025-10-07 | A vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this issue is some unknown functionality of the file /del_bookin… |
CVE-2025-11402 | Medium | 6.3 | 2025-10-07 | A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-52021 | Critical | 9.8 | 2025-10-07 | A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The product_id GET parameter is unsafe… |
CVE-2025-11401 | Medium | 6.3 | 2025-10-07 | A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected is an unknown function of the file /pages/save_curr.php. This manipulat… |
CVE-2025-11400 | Medium | 6.3 | 2025-10-07 | A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This impacts an unknown function of the file /del_room.php. The manipulat… |
CVE-2025-11399 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /pages/save_ro… |
CVE-2025-11397 | High | 7.3 | 2025-10-07 | A security flaw has been discovered in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the file /login.php… |
CVE-2025-40888 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated user with limited priv… |
CVE-2025-40887 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited pr… |
CVE-2025-40886 | High | 7.5 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited pr… |
CVE-2025-40885 | Medium | 5.3 | 2025-10-07 | A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with li… |
CVE-2025-11396 | High | 7.3 | 2025-10-07 | A vulnerability was identified in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /product.php. Such manipulation of… |
CVE-2025-0603 | Critical | 9.8 | 2025-10-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQ… |
CVE-2025-11359 | Medium | 6.3 | 2025-10-07 | A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the file /transfermoney.p… |
CVE-2025-11358 | Medium | 6.3 | 2025-10-07 | A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /removeuser.php. Executing manipulation… |
CVE-2025-11357 | Medium | 6.3 | 2025-10-07 | A security flaw has been discovered in code-projects Simple Banking System 1.0. This issue affects some unknown processing of the file /createuser.php. Perform… |
CVE-2025-11350 | High | 7.3 | 2025-10-07 | A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. The affected element is an unknown function of the file /bwdat… |
CVE-2025-11349 | High | 7.3 | 2025-10-07 | A vulnerability was identified in Campcodes Online Apartment Visitor Management System 1.0. Impacted is an unknown function of the file /search-visitor.php. Th… |
CVE-2025-11348 | High | 7.3 | 2025-10-07 | A vulnerability was determined in Campcodes Online Apartment Visitor Management System 1.0. This issue affects some unknown processing of the file /index.php… |
CVE-2025-57515 | Critical | 9.8 | 2025-10-06 | A SQL injection vulnerability has been identified in Uniclare Student Portal v2. This flaw allows remote attackers to inject arbitrary SQL commands via vulnera… |
CVE-2025-11343 | High | 7.3 | 2025-10-06 | A security vulnerability has been detected in code-projects Student Crud Operation 3.3. Affected is an unknown function of the file delete.php. The manipulatio… |
CVE-2025-11342 | Medium | 4.7 | 2025-10-06 | A weakness has been identified in code-projects Online Course Registration 1.0. This impacts an unknown function of the file /admin/edit-course.php. Executing… |
CVE-2025-52472 | | 2025-10-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versi… | |
CVE-2025-11334 | High | 7.3 | 2025-10-06 | A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0. Affected is an unknown function of the file /visitor-detail.ph… |
CVE-2025-11330 | Medium | 6.3 | 2025-10-06 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. The affected element is an unknown function of the file /admin/sales-reports… |
CVE-2025-11329 | High | 7.3 | 2025-10-06 | A flaw has been found in code-projects Online Course Registration 1.0. Impacted is an unknown function of the file /admin/manage-students.php. This manipulatio… |
CVE-2025-11319 | Medium | 6.3 | 2025-10-06 | A weakness has been identified in nahiduddinahammed Hospital-Management-System-Website up to e6562429e14b2f88bd2139cae16e87b965024097. This issue affects some… |
CVE-2025-11317 | High | 7.3 | 2025-10-06 | A vulnerability was identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findRolePage of the file findSin… |
CVE-2025-11316 | High | 7.3 | 2025-10-06 | A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of… |
CVE-2025-11315 | High | 7.3 | 2025-10-06 | A vulnerability was found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this vulnerability is the function findUserPage of… |
CVE-2025-11314 | High | 7.3 | 2025-10-06 | A vulnerability has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected is the function findRolePage of the file findSing… |
CVE-2025-11313 | High | 7.3 | 2025-10-06 | A flaw has been found in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This impacts the function findRolePage of the file findRolePage.do… |
CVE-2025-11312 | High | 7.3 | 2025-10-06 | A vulnerability was detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. This affects the function findModulePage of the file findMod… |
CVE-2025-11311 | High | 7.3 | 2025-10-06 | A security vulnerability has been detected in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The impacted element is the function findTenan… |
CVE-2025-11310 | High | 7.3 | 2025-10-06 | A weakness has been identified in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. The affected element is the function findFileServerPage of… |
CVE-2025-11309 | High | 7.3 | 2025-10-05 | A security flaw has been discovered in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Impacted is the function doFilter of the file findDep… |
CVE-2025-11288 | Medium | 6.3 | 2025-10-05 | A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET P… |
CVE-2025-10692 | | 2025-10-03 | The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter bindi… | |
CVE-2025-54153 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-53595 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2024-56804 | High | 8.8 | 2025-10-03 | An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-57423 | Medium | 6.5 | 2025-10-03 | A SQL injection vulnerability was discovered in the /articles endpoint of MyClub 0.5, affecting the query parameters Content, GroupName, PersonName, lastUpdate… |
CVE-2025-9200 | High | 7.5 | 2025-10-03 | The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the nh_ynaa_comments()… |
CVE-2025-9199 | Medium | 6.5 | 2025-10-03 | The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideshow' shortcode in… |
CVE-2025-9198 | Medium | 6.5 | 2025-10-03 | The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, and including, 8.1 due… |
CVE-2025-40636 | | 2025-10-03 | SQL injection vulnerability in Joomla module mod_vvisit_counter v2.0.4j3. This vulnerability allows an attacker to retrieve database content via the ‘cip_vvisi… | |
CVE-2025-10726 | Critical | 9.1 | 2025-10-03 | The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, and including, 2.0. This is due to insuf… |
CVE-2025-10582 | High | 8.8 | 2025-10-03 | The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due to insufficient es… |
CVE-2025-0616 | High | 8.2 | 2025-10-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Lt… |
CVE-2025-61605 | Critical | 9.8 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identif… |
CVE-2025-61603 | Critical | 9.8 | 2025-10-02 | WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/cont… |
CVE-2025-56162 | Medium | 6.5 | 2025-10-02 | YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint. The getListByIds function concatenates… |
CVE-2025-61096 | Medium | 6.5 | 2025-10-02 | PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname parameter. |
CVE-2025-59743 | Critical | 9.8 | 2025-10-02 | SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending… |
CVE-2025-59742 | Critical | 9.8 | 2025-10-02 | SQL injection vulnerability in AndSoft's e-TMS v25.03. This vulnerability could allow an attacker to retrieve, create, update, and delete databases by sending… |
CVE-2025-56381 | Medium | 6.5 | 2025-10-02 | ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.reportview.get endpoint via the order_by and g… |
CVE-2025-56380 | Medium | 6.5 | 2025-10-02 | Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the frappe.client.get_value API endpoint and a… |
CVE-2025-11020 | High | 8.8 | 2025-10-02 | An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with… |
CVE-2025-59681 | High | 7.1 | 2025-10-01 | An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), and… |
CVE-2025-52042 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to… |
CVE-2025-52041 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Inje… |
CVE-2025-52040 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can ext… |
CVE-2025-52039 | High | 8.2 | 2025-10-01 | In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable t… |
CVE-2025-57254 | Medium | 6.5 | 2025-09-30 | An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 allows remote attackers to execute arbitrar… |
CVE-2025-52050 | Medium | 6.5 | 2025-09-30 | In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_program/loyalty_program.py is vulnerable… |
CVE-2025-52049 | Medium | 6.5 | 2025-09-30 | In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py is vulnerable to SQL Injection, which a… |
CVE-2025-52047 | Medium | 6.5 | 2025-09-30 | In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker to ext… |
CVE-2025-52043 | Medium | 6.5 | 2025-09-30 | In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_accounts_importer.py is vulnerable to SQL… |
CVE-2025-8877 | High | 7.5 | 2025-09-30 | The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in all versions up to, and including, 2.2… |
CVE-2025-8122 | High | 8.8 | 2025-09-30 | Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects… |
CVE-2025-8121 | High | 8.8 | 2025-09-30 | Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects… |
CVE-2024-13150 | Critical | 9.8 | 2025-09-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Fayton Software and Consulting Services fayton.Pro ERP al… |
CVE-2025-8868 | Critical | 9.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-6724 | High | 8.8 | 2025-09-29 | In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functio… |
CVE-2025-11118 | High | 7.3 | 2025-09-28 | A vulnerability was identified in CodeAstro Student Grading System 1.0. This issue affects some unknown processing of the file /adminLogin.php. Such manipulati… |
CVE-2025-11116 | High | 7.3 | 2025-09-28 | A vulnerability was found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /add.home.php. The manipulation of the argume… |
CVE-2025-11115 | High | 7.3 | 2025-09-28 | A vulnerability has been found in code-projects Simple Scheduling System 1.0. Affected by this issue is some unknown functionality of the file /addtime.php. Th… |
CVE-2025-11114 | Medium | 6.3 | 2025-09-28 | A flaw has been found in CodeAstro Online Leave Application 1.0. Affected by this vulnerability is an unknown functionality of the file /leaveAplicationForm.ph… |
CVE-2025-11113 | Medium | 6.3 | 2025-09-28 | A vulnerability was detected in CodeAstro Online Leave Application 1.0. Affected is an unknown function of the file /signup.php. Performing manipulation of the… |
CVE-2025-11111 | High | 7.3 | 2025-09-28 | A weakness has been identified in Campcodes Advanced Online Voting Management System 1.0. This affects an unknown function of the file /admin/candidates_edit.p… |
CVE-2025-11110 | High | 7.3 | 2025-09-28 | A security flaw has been discovered in Campcodes Online Learning Management System 1.0. The impacted element is an unknown function of the file /admin/school_y… |
CVE-2025-11109 | High | 7.3 | 2025-09-28 | A vulnerability was identified in Campcodes Computer Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/us_edit.php… |
CVE-2025-11108 | High | 7.3 | 2025-09-28 | A vulnerability was determined in code-projects Simple Scheduling System 1.0. Impacted is an unknown function of the file /schedulingsystem/addroom.php. Execut… |
CVE-2025-11107 | High | 7.3 | 2025-09-28 | A vulnerability was found in code-projects Simple Scheduling System 1.0. This issue affects some unknown processing of the file /schedulingsystem/addcourse.php… |
CVE-2025-11106 | High | 7.3 | 2025-09-28 | A vulnerability has been found in code-projects Simple Scheduling System 1.0. This vulnerability affects unknown code of the file /schedulingsystem/addfaculty… |
CVE-2025-11105 | High | 7.3 | 2025-09-28 | A flaw has been found in code-projects Simple Scheduling System 1.0. This affects an unknown part of the file /schedulingsystem/addsubject.php. This manipulati… |
CVE-2025-11104 | Medium | 6.3 | 2025-09-28 | A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /admin/bill.php. The… |
CVE-2025-11102 | High | 7.3 | 2025-09-28 | A weakness has been identified in Campcodes Online Learning Management System 1.0. Affected is an unknown function of the file /admin/edit_content.php. Executi… |
CVE-2025-11101 | High | 7.3 | 2025-09-28 | A security flaw has been discovered in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/company/index.php… |
CVE-2025-11094 | High | 7.3 | 2025-09-28 | A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/admin_product_details.php… |