CWE-89 · SQL Injection (page 6)
Page 6 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15907 | High | 7.3 | 2026-07-16 | A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a m… |
CVE-2026-62361 | Medium | 5.5 | 2026-07-15 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-co… |
CVE-2026-52887 | Critical | 10.0 | 2026-07-15 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-not… |
CVE-2026-50030 | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL preview exposes DatasetDataApi.previewSql/previewSqlCheck throu… | |
CVE-2026-45535 | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase SQL-type datasets store attacker-controlled SQL variable defaultVal… | |
CVE-2026-45417 | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSc… | |
CVE-2026-45320 | | 2026-07-15 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase dashboard SQL variables such as ${deptId} are processed by Sqlparse… | |
CVE-2026-57821 | High | 8.1 | 2026-07-15 | A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request p… |
CVE-2026-56287 | High | 8.1 | 2026-07-15 | A boolean-based SQL Injection vulnerability exists in Apache Fineract's Client Search API (GET /api/v1/clients) in versions up to and including 1.14.0. The ord… |
CVE-2026-35152 | High | 8.8 | 2026-07-15 | A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to and including 1.14.0. Report parameter v… |
CVE-2026-57832 | | 2026-07-15 | Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated S… | |
CVE-2026-57831 | | 2026-07-15 | Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2 - The Joomla extension DP Calendar is vulnerable to a… | |
CVE-2026-15804 | High | 8.8 | 2026-07-15 | The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands via specific parameters, thereby compro… |
CVE-2026-12512 | High | 8.6 | 2026-07-15 | The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthe… |
CVE-2026-11851 | | 2026-07-15 | Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") in the web management interface of certain ASUS router models allows a rem… | |
CVE-2026-48324 | Critical | 9.1 | 2026-07-14 | ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary… |
CVE-2026-47992 | High | 7.2 | 2026-07-14 | Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitr… |
CVE-2026-45073 | High | 7.3 | 2026-07-14 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doCl… |
CVE-2026-47295 | High | 8.8 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2026-47296 | High | 7.5 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2026-15703 | High | 7.3 | 2026-07-14 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproduct… |
CVE-2026-15736 | High | 8.3 | 2026-07-14 | Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in mer… |
CVE-2026-62390 | Critical | 9.8 | 2026-07-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may… |
CVE-2026-15183 | | 2026-07-14 | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth cl… | |
CVE-2026-15676 | High | 7.3 | 2026-07-14 | A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php… |
CVE-2026-15675 | High | 7.3 | 2026-07-14 | A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipu… |
CVE-2026-15672 | Medium | 6.3 | 2026-07-14 | A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the file /intrams/admin/add_judges.php. This m… |
CVE-2026-44769 | Medium | 5.5 | 2026-07-14 | SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database… |
CVE-2026-51821 | Critical | 9.8 | 2026-07-13 | SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endp… |
CVE-2026-15597 | High | 7.3 | 2026-07-13 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /edit_exam2.php… |
CVE-2026-15559 | Medium | 6.3 | 2026-07-13 | A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the file /SimpleOnlineLeave/admin/accept.p… |
CVE-2026-15558 | Medium | 6.3 | 2026-07-13 | A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the… |
CVE-2026-61955 | High | 7.6 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blin… |
CVE-2026-59515 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sergey AIWU ai-copilot-content-generator allows Blind SQL… |
CVE-2026-57810 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare al… |
CVE-2026-57787 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Inj… |
CVE-2026-57773 | High | 7.6 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zorem Advanced Shipment Tracking for WooCommerce woo-adva… |
CVE-2026-57772 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager al… |
CVE-2026-57771 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows B… |
CVE-2026-57739 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acy… |
CVE-2026-57726 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue… |
CVE-2026-57714 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection… |
CVE-2026-57707 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Business Directory Pro simple-busines… |
CVE-2026-57702 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Melograno Venture Studio Amelia ameliabooking allows Blin… |
CVE-2026-57385 | High | 8.5 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.Th… |
CVE-2026-15537 | High | 7.3 | 2026-07-13 | A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The ma… |
CVE-2026-15536 | Medium | 6.3 | 2026-07-13 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulat… |
CVE-2026-15523 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /Simple… |
CVE-2026-15517 | High | 7.3 | 2026-07-13 | A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulatio… |
CVE-2026-15514 | High | 7.3 | 2026-07-13 | A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/x… |
CVE-2026-15502 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Hand… |
CVE-2026-56281 | Low | 3.8 | 2026-07-12 | Capgo before 12.128.2 contains a sql injection vulnerability in the POST /private/admin_stats endpoint where the limit parameter is destructured from unvalidat… |
CVE-2026-15498 | High | 7.3 | 2026-07-12 | A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users… |
CVE-2026-15494 | Medium | 4.7 | 2026-07-12 | A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a… |
CVE-2026-15490 | High | 7.3 | 2026-07-12 | A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown function… |
CVE-2026-15489 | High | 7.3 | 2026-07-12 | A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functio… |
CVE-2026-15482 | High | 7.3 | 2026-07-12 | A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consulta… |
CVE-2026-15478 | Medium | 6.3 | 2026-07-12 | A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the co… |
CVE-2026-15477 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the… |
CVE-2026-60090 | Critical | 9.8 | 2026-07-11 | PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends… |
CVE-2026-4661 | High | 7.5 | 2026-07-11 | The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' paramete… |
CVE-2025-5017 | Medium | 4.9 | 2026-07-11 | The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and i… |
CVE-2026-15335 | High | 7.5 | 2026-07-11 | The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter (form<N>) in all versions up to, and including, 1.7… |
CVE-2026-15073 | Medium | 6.5 | 2026-07-11 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions… |
CVE-2026-15072 | Medium | 6.5 | 2026-07-11 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions… |
CVE-2026-13262 | Medium | 6.5 | 2026-07-11 | The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter… |
CVE-2026-47199 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.18.3 and 15.108.0, check_safe_sql_query permitted SELECT INTO OUTFILE queries, which could potent… | |
CVE-2026-15081 | High | 7.4 | 2026-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue… |
CVE-2026-13242 | Medium | 6.5 | 2026-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue… |
CVE-2026-57230 | Medium | 5.4 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built… |
CVE-2026-55405 | High | 7.6 | 2026-07-10 | LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the Mari… |
CVE-2026-11321 | Medium | 6.4 | 2026-07-10 | The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries during CSV import, without para… |
CVE-2026-61461 | High | 8.8 | 2026-07-10 | Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying u… |
CVE-2026-5801 | Critical | 9.8 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software Consulting Trade Ltd. Co. SEM… |
CVE-2026-53448 | High | 7.2 | 2026-07-10 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into S… |
CVE-2026-2397 | Critical | 9.8 | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injec… |
CVE-2026-58492 | | 2026-07-10 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL q… | |
CVE-2026-56690 | High | 8.5 | 2026-07-10 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabil… |
CVE-2026-56689 | High | 7.7 | 2026-07-10 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabil… |
CVE-2026-58225 | | 2026-07-10 | SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconnect replay query, c… | |
CVE-2026-13010 | Medium | 6.5 | 2026-07-10 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via 'event' Shortcode Attribu… |
CVE-2026-12918 | Medium | 4.9 | 2026-07-10 | The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to generic SQL Injection via the 'recipie… |
CVE-2026-15104 | Medium | 6.5 | 2026-07-10 | The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to generic SQL Injection via the 'lang' par… |
CVE-2026-14475 | Medium | 4.9 | 2026-07-10 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to generic SQL Injection via the 'scan_id' parameter in all versions… |
CVE-2026-15300 | Critical | 9.1 | 2026-07-10 | The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in versions up to, and including, 4.5.4. The… |
CVE-2026-15290 | High | 7.5 | 2026-07-10 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind… |
CVE-2026-15289 | Medium | 5.9 | 2026-07-10 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpdevart_id’ parameter in all versions… |
CVE-2026-15287 | Medium | 6.5 | 2026-07-10 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based SQL Injection via the order_by parameter in all versions up… |
CVE-2026-54760 | | 2026-07-10 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the `SQLChatAgent` SQL-injection mitigation, with defa… | |
CVE-2026-50180 | | 2026-07-10 | Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, `SQLChatAgent` in `langroid` ships a `_validate_query`… | |
CVE-2026-59834 | High | 7.5 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates atta… |
CVE-2026-55208 | High | 7.7 | 2026-07-09 | Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password ha… |
CVE-2026-15190 | High | 7.3 | 2026-07-09 | A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of the file /login.php. Performing a mani… |
CVE-2026-56292 | High | 7.5 | 2026-07-09 | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was dis… |
CVE-2026-50644 | | 2026-07-09 | SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audi… | |
CVE-2026-5955 | Critical | 9.8 | 2026-07-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows S… |
CVE-2026-14342 | Medium | 4.9 | 2026-07-09 | The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'cont… |
CVE-2026-13011 | Medium | 6.5 | 2026-07-09 | The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the '… |
CVE-2026-15137 | High | 7.3 | 2026-07-09 | A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. Thi… |
CVE-2026-15135 | High | 7.3 | 2026-07-09 | A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulat… |