CWE-89 · SQL Injection (page 5)
Page 5 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-51077 | High | 7.5 | 2026-07-27 | SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php… |
CVE-2026-17191 | Critical | 9.1 | 2026-07-27 | An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, wh… |
CVE-2025-50455 | Critical | 9.1 | 2026-07-27 | SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability… |
CVE-2026-66427 | High | 7.6 | 2026-07-27 | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. |
CVE-2026-59551 | High | 8.5 | 2026-07-27 | Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59550 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. |
CVE-2026-59549 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. |
CVE-2026-59538 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. |
CVE-2026-59537 | High | 7.6 | 2026-07-27 | Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions. |
CVE-2026-59533 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. |
CVE-2026-59527 | Critical | 9.3 | 2026-07-27 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-65877 | | 2026-07-27 | Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager se… | |
CVE-2026-65876 | | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles… | |
CVE-2026-65766 | | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content… | |
CVE-2026-14189 | Low | 3.8 | 2026-07-27 | The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with adm… |
CVE-2026-65707 | Medium | 6.5 | 2026-07-24 | Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting… |
CVE-2026-15663 | Medium | 4.9 | 2026-07-24 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in al… |
CVE-2026-16765 | High | 7.3 | 2026-07-23 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkad… |
CVE-2026-63359 | Critical | 9.8 | 2026-07-23 | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted reque… |
CVE-2026-65761 | | 2026-07-23 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unau… | |
CVE-2026-65532 | High | 7.6 | 2026-07-23 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. |
CVE-2026-65526 | High | 8.5 | 2026-07-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This is… |
CVE-2026-65494 | High | 7.1 | 2026-07-23 | Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. |
CVE-2026-65462 | High | 7.6 | 2026-07-23 | Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. |
CVE-2026-65454 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions. |
CVE-2026-65451 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-65450 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-61950 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. |
CVE-2026-61949 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in Bookly <= 27.7 versions. |
CVE-2026-61948 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. |
CVE-2026-59526 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. |
CVE-2026-59525 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. |
CVE-2026-59514 | Critical | 9.3 | 2026-07-23 | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. |
CVE-2026-25405 | High | 8.5 | 2026-07-23 | Contributor SQL Injection in eRoom <= 1.7.1 versions. |
CVE-2026-24552 | High | 8.5 | 2026-07-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. … |
CVE-2026-15906 | Medium | 6.5 | 2026-07-23 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions u… |
CVE-2026-15761 | Medium | 6.5 | 2026-07-23 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up t… |
CVE-2026-15448 | Medium | 6.5 | 2026-07-23 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versio… |
CVE-2026-13119 | Medium | 6.5 | 2026-07-23 | The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_rec… |
CVE-2026-13009 | Medium | 6.5 | 2026-07-23 | The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions up to, and includi… |
CVE-2026-9713 | High | 7.5 | 2026-07-23 | The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON f… |
CVE-2026-2395 | Critical | 9.8 | 2026-07-22 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platfor… |
CVE-2026-12987 | High | 7.5 | 2026-07-22 | The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-suppli… |
CVE-2026-16490 | Medium | 6.3 | 2026-07-22 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipula… |
CVE-2026-62528 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12.2… |
CVE-2026-62527 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Import And Export). Supported versions that are affected are 12… |
CVE-2026-62516 | High | 8.8 | 2026-07-21 | Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Supported versions that are affected are… |
CVE-2026-61294 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Calendar Synchronizations). Supported versions that ar… |
CVE-2026-61266 | Medium | 6.3 | 2026-07-21 | Vulnerability in the Oracle Supply Chain Globalization product of Oracle E-Business Suite (component: Copy Inventory Organization). Supported versions that ar… |
CVE-2026-60582 | High | 8.3 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). The supported version that is affected… |
CVE-2026-16484 | High | 7.3 | 2026-07-21 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /edit_sub… |
CVE-2026-63080 | Medium | 6.5 | 2026-07-21 | Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data a… |
CVE-2026-52476 | High | 7.5 | 2026-07-21 | SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java… |
CVE-2026-52472 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file |
CVE-2026-52470 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file |
CVE-2026-52469 | Critical | 9.8 | 2026-07-21 | SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file |
CVE-2026-64880 | High | 7.1 | 2026-07-21 | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enab… |
CVE-2026-55084 | High | 8.8 | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in t… |
CVE-2026-55082 | | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticat… | |
CVE-2016-20096 | Critical | 9.8 | 2026-07-21 | Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQ… |
CVE-2026-15829 | | 2026-07-21 | A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt BigQuery forecasting tool (bigquery-forecast) of googleapi… | |
CVE-2026-16449 | Medium | 6.3 | 2026-07-21 | A vulnerability was determined in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. The impacted element is the function OrderItem.asc/Order… |
CVE-2026-1617 | Critical | 9.8 | 2026-07-21 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Log… |
CVE-2026-8082 | High | 7.5 | 2026-07-21 | The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submis… |
CVE-2026-16334 | Medium | 6.3 | 2026-07-21 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such… |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-57308 | Critical | 9.8 | 2026-07-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitleme… |
CVE-2026-16252 | High | 7.3 | 2026-07-20 | A security flaw has been discovered in Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System 8.2.2. Impacted is an unknown function… |
CVE-2026-57309 | | 2026-07-20 | A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP head… | |
CVE-2026-16244 | Medium | 6.3 | 2026-07-20 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2026-11349 | High | 8.6 | 2026-07-20 | The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request p… |
CVE-2026-16228 | High | 7.3 | 2026-07-19 | A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_schoolyr.php. Performin… |
CVE-2026-16227 | High | 7.3 | 2026-07-19 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /edit_subject… |
CVE-2026-16154 | High | 7.3 | 2026-07-18 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-16152 | High | 7.3 | 2026-07-18 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a ma… |
CVE-2026-16131 | Medium | 6.3 | 2026-07-18 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manip… |
CVE-2026-52348 | Critical | 9.8 | 2026-07-17 | cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java. |
CVE-2026-60137 | Medium | 5.9 | 2026-07-17 | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow… |
CVE-2026-44739 | High | 8.7 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBun… |
CVE-2026-12283 | Medium | 6.8 | 2026-07-17 | Amazon Athena is a serverless, interactive query service that lets you analyze data directly in Amazon S3 using standard SQL. Athena Query Federation is a feat… |
CVE-2026-9586 | | 2026-07-17 | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <Pol… | |
CVE-2026-8297 | Critical | 9.8 | 2026-07-17 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and… |
CVE-2026-16014 | High | 7.3 | 2026-07-17 | A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulat… |
CVE-2026-16009 | Medium | 6.3 | 2026-07-17 | A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The mani… |
CVE-2026-62238 | High | 8.8 | 2026-07-17 | OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by c… |
CVE-2026-14782 | Medium | 4.9 | 2026-07-16 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection via the Customer Import in all versions up to, an… |
CVE-2026-38158 | Critical | 9.8 | 2026-07-16 | A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via… |
CVE-2025-45868 | High | 8.8 | 2026-07-16 | LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate S… |
CVE-2026-58078 | | 2026-07-16 | Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable t… | |
CVE-2026-15727 | Medium | 4.9 | 2026-07-16 | The WP Bulk Delete plugin for WordPress is vulnerable to generic SQL Injection via the 'delete_user_roles' parameter in all versions up to, and including, 1.4… |
CVE-2026-15651 | Medium | 4.9 | 2026-07-16 | The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all versions up to, and includ… |
CVE-2026-15022 | Medium | 6.5 | 2026-07-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions u… |
CVE-2026-13767 | Medium | 6.5 | 2026-07-16 | The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to ins… |
CVE-2026-13754 | Medium | 6.5 | 2026-07-16 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and includi… |
CVE-2026-12395 | Medium | 6.5 | 2026-07-16 | The WP Job Portal WordPress plugin before 2.5.5 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated users… |
CVE-2026-15458 | Medium | 4.9 | 2026-07-16 | The SEO Booster plugin for WordPress is vulnerable to generic SQL Injection via the 'sort_field' parameter in all versions up to, and including, 7.3.1 due to i… |
CVE-2026-15445 | Medium | 4.9 | 2026-07-16 | The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.3.1 due to i… |
CVE-2026-12941 | Medium | 6.5 | 2026-07-16 | The MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' para… |
CVE-2026-12753 | High | 7.5 | 2026-07-16 | The Advance Product Search- Voice & Ajax Search for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 's' and 'match' parameter i… |
CVE-2026-15907 | High | 7.3 | 2026-07-16 | A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a m… |