CWE-89 · SQL Injection (page 48)
Page 48 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-40691 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-40690 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'te… |
CVE-2025-40689 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-40687 | Critical | 9.8 | 2025-09-11 | SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via '… |
CVE-2025-9451 | Medium | 6.5 | 2025-09-11 | The Smartcat Translator for WPML plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and includin… |
CVE-2025-9073 | High | 7.5 | 2025-09-11 | The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 3.2 due to insuff… |
CVE-2025-8692 | Medium | 4.9 | 2025-09-11 | The Coupon API plugin for WordPress is vulnerable to SQL Injection via the ‘log_duration’ parameter in all versions up to, and including, 6.2.12 due to insuffi… |
CVE-2025-9776 | Medium | 6.5 | 2025-09-11 | The CatFolders – Tame Your WordPress Media Library by Category plugin for WordPress is vulnerable to time-based SQL Injection via the CSV Import contents in al… |
CVE-2025-10218 | Medium | 6.3 | 2025-09-10 | A flaw has been found in lostvip-com ruoyi-go 2.1. This affects the function SelectListPage of the file modules/system/dao/SysRoleDao.go of the component Backg… |
CVE-2025-10210 | Medium | 6.3 | 2025-09-10 | A weakness has been identified in yanyutao0402 ChanCMS up to 3.3.0. Impacted is the function Search of the file app/modules/api/service/Api.js. Executing manip… |
CVE-2025-56407 | High | 8.8 | 2025-09-10 | A vulnerability has been found in HuangDou UTCMS V9 and classified as critical. This vulnerability affects the function RunSql of the file app/modules/ut-data/… |
CVE-2025-9943 | Critical | 9.1 | 2025-09-10 | An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is… |
CVE-2025-9463 | Medium | 6.5 | 2025-09-10 | The Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net plugin for WordPress is vulnerable to time-based SQL Injection v… |
CVE-2025-7826 | Medium | 6.5 | 2025-09-10 | The Testimonial plugin for WordPress is vulnerable to SQL Injection via the 'iNICtestimonial' shortcode in all versions up to, and including, 2.3 due to insuff… |
CVE-2025-6189 | Medium | 6.5 | 2025-09-10 | The Duplicate Page and Post plugin for WordPress is vulnerable to time-based SQL Injection via the ‘meta_key’ parameter in all versions up to, and including, 2… |
CVE-2025-10142 | Medium | 4.9 | 2025-09-10 | The PagBank / PagSeguro Connect para WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'status' parameter in all versions up to, and incl… |
CVE-2025-10197 | Medium | 6.3 | 2025-09-10 | A vulnerability was found in HJSoft HCM Human Resources Management System up to 20250822. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-58448 | Critical | 9.1 | 2025-09-09 | rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection… |
CVE-2025-58462 | Critical | 9.8 | 2025-09-09 | OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0 allows SQL injection via SearchPopularDocs.aspx. A remote, unauthenticated attacker could r… |
CVE-2025-59008 | High | 7.6 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection zip-code-ba… |
CVE-2025-58993 | High | 7.6 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue a… |
CVE-2025-47569 | Critical | 9.3 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultim… |
CVE-2025-10095 | | 2025-09-09 | A SQL injection vulnerability has been identified in the SMPP server component of the SMSEagle firmware, specifically affecting the handling of certain paramet… | |
CVE-2025-10122 | Medium | 4.7 | 2025-09-09 | A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulati… |
CVE-2025-10121 | Medium | 6.3 | 2025-09-09 | A flaw has been found in uverif up to 3.2. This affects the function addbatch of the file /admin/kami_list. This manipulation of the argument note causes sql i… |
CVE-2025-10118 | High | 7.3 | 2025-09-09 | A security vulnerability has been detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. The affected element is an unknown functio… |
CVE-2025-10115 | High | 7.3 | 2025-09-09 | A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation of the argument name… |
CVE-2025-10114 | High | 7.3 | 2025-09-09 | A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the a… |
CVE-2025-10113 | High | 7.3 | 2025-09-09 | A security vulnerability has been detected in itsourcecode Student Information Management System 1.0. This affects an unknown function of the file /admin/modul… |
CVE-2025-10112 | High | 7.3 | 2025-09-09 | A weakness has been identified in itsourcecode Student Information Management System 1.0. The impacted element is an unknown function of the file /admin/module… |
CVE-2025-58454 | High | 8.2 | 2025-09-08 | WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in WeGIA versions 3.4.10 and prior inthe endpoint /WeGIA/html/… |
CVE-2025-58453 | High | 8.2 | 2025-09-08 | WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in WeGIA versions 3.4.10 and prior in the endpoint /WeGIA/html… |
CVE-2025-10111 | High | 7.3 | 2025-09-08 | A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function of the file /admin/m… |
CVE-2025-10110 | Medium | 6.3 | 2025-09-08 | A vulnerability was identified in ChanCMS up to 3.3.1. Impacted is an unknown function of the file /search/. The manipulation with the input '%20or%201=1%20%23… |
CVE-2025-10109 | High | 7.3 | 2025-09-08 | A vulnerability was determined in Campcodes Online Loan Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_p… |
CVE-2025-58450 | | 2025-09-08 | pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The va… | |
CVE-2025-10108 | High | 7.3 | 2025-09-08 | A vulnerability was found in Campcodes Online Loan Management System 1.0. This vulnerability affects unknown code of the file /ajax.php?action=delete_loan. Per… |
CVE-2025-10106 | Medium | 6.3 | 2025-09-08 | A vulnerability has been found in yanyutao0402 ChanCMS up to 3.3.1. This affects an unknown part of the file /cms/collect/search. Such manipulation of the argu… |
CVE-2025-10105 | Medium | 6.3 | 2025-09-08 | A flaw has been found in yanyutao0402 ChanCMS up to 3.3.1. Affected by this issue is some unknown functionality of the file /cms/article/search. This manipulat… |
CVE-2025-10104 | High | 7.3 | 2025-09-08 | A security vulnerability has been detected in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /review_search.php. Th… |
CVE-2025-55849 | High | 8.4 | 2025-09-08 | WeiPHP v5.0 and before is vulnerable to SQL Injection via the SucaiController.class.php file and the cancelTemplatee |
CVE-2025-10103 | High | 7.3 | 2025-09-08 | A weakness has been identified in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /home.php. Executing manipulation… |
CVE-2025-10102 | High | 7.3 | 2025-09-08 | A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown function of the file /index.php. Performing manip… |
CVE-2025-10100 | High | 7.3 | 2025-09-08 | A vulnerability was detected in SourceCodester Simple Forum Discussion System 1.0. This impacts an unknown function of the file /admin_class.php?action=login… |
CVE-2025-10098 | Medium | 6.3 | 2025-09-08 | A security flaw has been discovered in PHPGurukul User Management System 1.0. Affected is an unknown function of the file /admin/edit-user-profile.php. The man… |
CVE-2025-56630 | High | 7.3 | 2025-09-08 | FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Column.php file. |
CVE-2025-10090 | High | 7.3 | 2025-09-08 | A flaw has been found in Jinher OA up to 1.2. The impacted element is an unknown function of the file /C6/Jhsoft.Web.departments/GetTreeDate.aspx. Executing ma… |
CVE-2025-10087 | Medium | 4.7 | 2025-09-08 | A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/profit_re… |
CVE-2025-10082 | High | 7.3 | 2025-09-08 | A vulnerability has been found in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/manage-admins.php. Such manipula… |
CVE-2025-10079 | High | 7.3 | 2025-09-08 | A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Executing manipulatio… |
CVE-2025-10078 | High | 7.3 | 2025-09-08 | A vulnerability was detected in SourceCodester Online Polling System 1.0. Affected is an unknown function of the file /admin/candidates.php. Performing manipul… |
CVE-2025-10077 | High | 7.3 | 2025-09-08 | A security vulnerability has been detected in SourceCodester Online Polling System 1.0. This impacts an unknown function of the file /registeracc.php. Such man… |
CVE-2025-10076 | High | 7.3 | 2025-09-08 | A weakness has been identified in SourceCodester Online Polling System 1.0. This affects an unknown function of the file /manage-profile.php. This manipulation… |
CVE-2025-10068 | High | 7.3 | 2025-09-07 | A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views.php. Executing man… |
CVE-2025-10062 | High | 7.3 | 2025-09-06 | A vulnerability was determined in itsourcecode Student Information Management System 1.0. This affects an unknown part of the file /admin/login.php. Executing… |
CVE-2025-10033 | High | 7.3 | 2025-09-06 | A vulnerability has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin. Such manipulation of the argum… |
CVE-2025-10031 | High | 7.3 | 2025-09-06 | A security vulnerability has been detected in Campcodes Grocery Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=de… |
CVE-2025-10030 | High | 7.3 | 2025-09-06 | A weakness has been identified in Campcodes Grocery Sales and Inventory System 1.0. This issue affects some unknown processing of the file /ajax.php?action=sav… |
CVE-2025-10046 | Medium | 4.9 | 2025-09-06 | The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versio… |
CVE-2025-9085 | Medium | 4.9 | 2025-09-06 | The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient esca… |
CVE-2025-10003 | Medium | 6.5 | 2025-09-06 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to time-based S… |
CVE-2025-58439 | High | 8.1 | 2025-09-06 | ERP is a free and open source Enterprise Resource Planning tool. In versions below 14.89.2 and 15.0.0 through 15.75.1, lack of validation of parameters left ce… |
CVE-2025-58375 | High | 8.1 | 2025-09-06 | Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable… |
CVE-2025-10025 | High | 7.3 | 2025-09-05 | A vulnerability has been found in PHPGurukul Online Course Registration 3.1. Affected is an unknown function of the file /admin/semester.php. The manipulation… |
CVE-2025-58628 | Critical | 9.3 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Miraculous miraculous allows Blind SQL Injec… |
CVE-2025-58780 | High | 7.2 | 2025-09-05 | index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. NOTE: this is disputed by the Supplier because it "inaccurately… |
CVE-2025-10012 | Medium | 6.3 | 2025-09-05 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_… |
CVE-2025-58881 | High | 8.5 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus New Simple Gallery new-simple-gallery allows Bli… |
CVE-2025-58789 | High | 7.6 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free wp-full-stripe-free allows… |
CVE-2025-58788 | High | 7.6 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal License Manager for WooCommerce license-manage… |
CVE-2025-10011 | Medium | 6.3 | 2025-09-05 | A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArredondamento/edit. Th… |
CVE-2025-48544 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection. This could lead to local escalation of privilege wit… |
CVE-2025-32327 | High | 7.8 | 2025-09-04 | In multiple functions of PickerDbFacade.java, there is a possible unauthorized data access due to SQL injection. This could lead to local escalation of privile… |
CVE-2025-8311 | | 2025-09-04 | dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query… | |
CVE-2025-57263 | High | 7.2 | 2025-09-04 | An authenticated SQL injection vulnerability in VX Guestbook 1.07 allows attackers with admin access to inject malicious SQL payloads via the "word" POST param… |
CVE-2025-7385 | | 2025-09-04 | Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability, which might be exploited by an unauthen… | |
CVE-2025-41034 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-41033 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-41032 | Critical | 9.8 | 2025-09-04 | An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database… |
CVE-2025-9933 | High | 7.3 | 2025-09-04 | A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view… |
CVE-2025-9932 | High | 7.3 | 2025-09-04 | A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this vulnerability is an unknown functionality of the file /admin/update-… |
CVE-2025-9930 | High | 7.3 | 2025-09-04 | A security vulnerability has been detected in 1000projects Beauty Parlour Management System 1.0. This impacts an unknown function of the file /admin/contact-us… |
CVE-2025-9928 | High | 7.3 | 2025-09-03 | A security flaw has been discovered in projectworlds Travel Management System 1.0. The impacted element is an unknown function of the file /viewcategory.php. P… |
CVE-2025-9927 | High | 7.3 | 2025-09-03 | A vulnerability was identified in projectworlds Travel Management System 1.0. The affected element is an unknown function of the file /viewpackage.php. Such ma… |
CVE-2025-57833 | High | 7.1 | 2025-09-03 | An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, u… |
CVE-2025-9926 | High | 7.3 | 2025-09-03 | A vulnerability was determined in projectworlds Travel Management System 1.0. Impacted is an unknown function of the file /viewsubcategory.php. This manipulati… |
CVE-2025-9925 | High | 7.3 | 2025-09-03 | A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php. The manipulation o… |
CVE-2025-9924 | High | 7.3 | 2025-09-03 | A vulnerability has been found in projectworlds Travel Management System 1.0. This vulnerability affects unknown code of the file /enquiry.php. The manipulatio… |
CVE-2025-9919 | High | 7.3 | 2025-09-03 | A vulnerability was identified in 1000projects Beauty Parlour Management System 1.0. This affects an unknown function of the file /admin/bwdates-reports-detail… |
CVE-2025-56435 | Medium | 5.3 | 2025-09-03 | SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. file /DataBackup.php and the operation on t… |
CVE-2025-58604 | High | 7.6 | 2025-09-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This i… |
CVE-2025-57149 | Medium | 6.5 | 2025-09-03 | phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter. |
CVE-2025-57147 | High | 7.5 | 2025-09-03 | A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple paramet… |
CVE-2025-57146 | High | 8.1 | 2025-09-03 | phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter. |
CVE-2025-9840 | Medium | 6.3 | 2025-09-02 | A weakness has been identified in itsourcecode Sports Management System 1.0. The impacted element is an unknown function of the file /Admin/gametype.php. Execu… |
CVE-2025-9839 | High | 7.3 | 2025-09-02 | A security flaw has been discovered in itsourcecode Student Information Management System 1.0. The affected element is an unknown function of the file /admin/m… |
CVE-2025-9838 | High | 7.3 | 2025-09-02 | A vulnerability was identified in itsourcecode Student Information Management System 1.0. Impacted is an unknown function of the file /admin/modules/subject/in… |
CVE-2025-9837 | High | 7.3 | 2025-09-02 | A vulnerability was determined in itsourcecode Student Information Management System 1.0. This issue affects some unknown processing of the file /admin/modules… |
CVE-2025-9833 | High | 7.3 | 2025-09-02 | A vulnerability was detected in SourceCodester Online Farm Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login… |
CVE-2025-9832 | High | 7.3 | 2025-09-02 | A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file /routers/register… |