CWE-89 · SQL Injection (page 5)
Page 5 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-20361 | High | 8.8 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive inter… |
CVE-2026-92406 | High | 7.3 | 2026-09-16 | A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments… |
CVE-2026-92405 | High | 7.3 | 2026-09-16 | A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /inde… |
CVE-2026-84993 | Medium | 6.5 | 2026-09-16 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 and 7.1.7, the shared SQL layer validate… |
CVE-2026-92366 | High | 7.3 | 2026-09-16 | A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. T… |
CVE-2026-84859 | Medium | 6.5 | 2026-09-16 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing… |
CVE-2026-92364 | Medium | 6.3 | 2026-09-16 | A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/empl… |
CVE-2026-92465 | High | 7.6 | 2026-09-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This is… |
CVE-2026-8462 | | 2026-09-16 | SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthenticated attacker to… | |
CVE-2026-78472 | High | 8.6 | 2026-09-16 | The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenti… |
CVE-2026-76557 | Medium | 6.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statem… |
CVE-2026-76556 | Medium | 6.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, a… |
CVE-2026-16588 | Medium | 6.5 | 2026-09-16 | The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to… |
CVE-2026-92221 | Medium | 4.7 | 2026-09-16 | A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function… |
CVE-2026-87238 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87212 | High | 7.4 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87207 | High | 7.2 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87202 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-87184 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26… |
CVE-2026-83210 | High | 8.8 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7… |
CVE-2026-83208 | High | 8.8 | 2026-09-15 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration). Supported versions that are affected are 17.0-26.7. Easily exp… |
CVE-2026-32599 | | 2026-09-15 | Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statemen… | |
CVE-2026-81567 | | 2026-09-15 | Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unau… | |
CVE-2026-61667 | Critical | 9.9 | 2026-09-15 | DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileC… |
CVE-2026-81895 | High | 7.2 | 2026-09-15 | In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID[] without validating them as integers, and when… |
CVE-2026-81894 | Medium | 5.4 | 2026-09-15 | Concrete CMS 9.5.2 and below is vulnerable to stored DOM-based Cross-site Scripting (XSS) via the Gallery block's per-image Caption field because the bundled M… |
CVE-2024-58385 | Critical | 9.8 | 2026-09-15 | Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 paramete… |
CVE-2026-91848 | High | 7.3 | 2026-09-15 | A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=articl… |
CVE-2026-79303 | Critical | 9.9 | 2026-09-15 | kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without… |
CVE-2026-91004 | High | 7.3 | 2026-09-15 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1… |
CVE-2026-16593 | Medium | 6.8 | 2026-09-15 | The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authentica… |
CVE-2026-90879 | High | 7.3 | 2026-09-15 | A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Pu… |
CVE-2026-90877 | High | 7.3 | 2026-09-15 | A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update_requi… |
CVE-2026-90876 | High | 7.3 | 2026-09-15 | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2026-90855 | High | 7.3 | 2026-09-15 | A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. Thi… |
CVE-2026-90854 | High | 7.3 | 2026-09-15 | A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /we… |
CVE-2026-90849 | High | 7.3 | 2026-09-15 | A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown function… |
CVE-2026-90846 | High | 7.3 | 2026-09-15 | A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manip… |
CVE-2026-90844 | High | 7.3 | 2026-09-15 | A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the compone… |
CVE-2026-90841 | High | 7.3 | 2026-09-15 | A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ap… |
CVE-2026-82028 | High | 8.8 | 2026-09-14 | Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attacker… |
CVE-2026-90805 | High | 7.3 | 2026-09-14 | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file… |
CVE-2026-90796 | Medium | 6.3 | 2026-09-14 | A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipul… |
CVE-2026-76461 | Critical | 9.8 | 2026-09-14 | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitr… |
CVE-2026-55416 | High | 8.8 | 2026-09-14 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports_config permission… |
CVE-2026-55072 | High | 8.5 | 2026-09-14 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious Cl… |
CVE-2026-90789 | High | 7.3 | 2026-09-14 | A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Execut… |
CVE-2026-7848 | | 2026-09-14 | Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCateg… | |
CVE-2026-15600 | | 2026-09-14 | Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts valu… | |
CVE-2026-77051 | Critical | 9.8 | 2026-09-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entit… |
CVE-2026-90708 | High | 7.3 | 2026-09-14 | A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Hand… |
CVE-2026-89180 | High | 7.5 | 2026-09-14 | EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands… |
CVE-2026-86460 | Critical | 9.8 | 2026-09-14 | Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0… |
CVE-2026-82232 | Critical | 9.8 | 2026-09-14 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitle… |
CVE-2026-78375 | | 2026-09-14 | Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0 - plgContentSp… | |
CVE-2026-90701 | High | 7.3 | 2026-09-14 | A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown… |
CVE-2026-90700 | Medium | 6.3 | 2026-09-14 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Su… |
CVE-2026-90600 | Medium | 6.3 | 2026-09-13 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulat… |
CVE-2026-90597 | Medium | 6.3 | 2026-09-13 | A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_e… |
CVE-2026-36989 | Medium | 5.8 | 2026-09-13 | A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php. |
CVE-2020-15875 | Medium | 5.0 | 2026-09-13 | An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via… |
CVE-2026-90574 | Medium | 6.3 | 2026-09-13 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emp_transac.php?action=… |
CVE-2026-90526 | High | 7.3 | 2026-09-13 | A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_c… |
CVE-2026-90525 | Medium | 6.3 | 2026-09-13 | A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_trans.php. Executin… |
CVE-2026-90516 | High | 7.3 | 2026-09-13 | A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_r… |
CVE-2026-90515 | High | 7.3 | 2026-09-13 | A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/… |
CVE-2026-90514 | High | 7.3 | 2026-09-13 | A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.ph… |
CVE-2026-90511 | Medium | 6.3 | 2026-09-13 | A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file sr… |
CVE-2026-90496 | Medium | 4.7 | 2026-09-13 | A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file ap… |
CVE-2026-90495 | High | 7.3 | 2026-09-13 | A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file application/models… |
CVE-2026-85198 | Medium | 6.5 | 2026-09-12 | The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versio… |
CVE-2026-77161 | Medium | 6.5 | 2026-09-12 | The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions up to, and includi… |
CVE-2026-16482 | High | 7.5 | 2026-09-12 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versi… |
CVE-2026-84047 | High | 8.6 | 2026-09-12 | The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticate… |
CVE-2026-80491 | High | 8.6 | 2026-09-12 | The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated action… |
CVE-2026-52630 | Critical | 9.8 | 2026-09-11 | SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in Us… |
CVE-2026-62112 | High | 7.6 | 2026-09-11 | Editor SQL Injection in Amelia <= 2.4.9 versions. |
CVE-2026-62109 | High | 7.6 | 2026-09-11 | Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions. |
CVE-2026-72708 | High | 7.5 | 2026-09-11 | SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbi… |
CVE-2026-15439 | Medium | 6.5 | 2026-09-11 | The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (ac… |
CVE-2026-82583 | High | 8.3 | 2026-09-11 | NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could r… |
CVE-2026-18561 | High | 7.5 | 2026-09-11 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16… |
CVE-2026-15462 | High | 7.5 | 2026-09-11 | The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX acti… |
CVE-2026-89089 | Medium | 6.5 | 2026-09-10 | A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authen… |
CVE-2026-73698 | High | 7.2 | 2026-09-10 | FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the descri… |
CVE-2026-81800 | Critical | 9.3 | 2026-09-10 | Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions. |
CVE-2026-88890 | High | 8.5 | 2026-09-10 | OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers befo… |
CVE-2026-38626 | Critical | 9.8 | 2026-09-10 | Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. |
CVE-2026-9163 | Critical | 9.8 | 2026-09-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GIS Informatics GisLab Laboratory Management System allow… |
CVE-2026-78082 | | 2026-09-10 | Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4 - The property search and listing… | |
CVE-2026-7188 | Critical | 9.8 | 2026-09-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Armiya Information Technologies Ltd. Co. Access Control S… |
CVE-2026-87925 | High | 7.3 | 2026-09-10 | A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function st… |
CVE-2026-87921 | High | 7.3 | 2026-09-09 | A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function update_record o… |
CVE-2026-79387 | Medium | 4.3 | 2026-09-09 | SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords… |
CVE-2026-71808 | High | 8.8 | 2026-09-09 | A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string c… |
CVE-2026-79322 | High | 8.6 | 2026-09-09 | SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated atta… |
CVE-2026-79947 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-67401 | Critical | 9.9 | 2026-09-09 | A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component |
CVE-2026-78482 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special E… |
CVE-2026-87807 | High | 7.5 | 2026-09-09 | siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers ca… |