CWE-89 · SQL Injection (page 65)
Page 65 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25513 | Critical | 9.8 | 2025-02-24 | Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php. |
CVE-2025-26533 | High | 8.1 | 2025-02-24 | An SQL injection risk was identified in the module list filter within course search. |
CVE-2025-27133 | High | 8.8 | 2025-02-24 | WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adici… |
CVE-2024-54820 | Critical | 9.8 | 2025-02-24 | XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attacke… |
CVE-2025-26200 | High | 7.2 | 2025-02-24 | SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component. |
CVE-2025-27312 | High | 8.5 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jenst WP Sitemap wp-sitemap allows SQL Injection.This iss… |
CVE-2025-27297 | High | 7.6 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in guelben Bravo Search & Replace bravo-search-and-replace a… |
CVE-2024-12918 | High | 8.8 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Health4All allows SQL Injection. This iss… |
CVE-2024-12916 | High | 8.8 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Life4All allows SQL Injection. This issue… |
CVE-2025-24490 | Critical | 9.6 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reorderin… |
CVE-2025-1596 | High | 7.3 | 2025-02-23 | A vulnerability was found in SourceCodester Best Church Management Software 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-1583 | Medium | 6.3 | 2025-02-23 | A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/search-repo… |
CVE-2025-1582 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-1581 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-1580 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2025-1578 | Medium | 6.3 | 2025-02-23 | A vulnerability, which was classified as critical, was found in PHPGurukul/Campcodes Online Shopping Portal 2.1. This affects an unknown part of the file /sear… |
CVE-2025-1576 | Medium | 6.3 | 2025-02-23 | A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown func… |
CVE-2024-13474 | High | 7.5 | 2025-02-22 | The LTL Freight Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versi… |
CVE-2020-19248 | Medium | 5.1 | 2025-02-21 | SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate template content by… |
CVE-2025-25878 | Low | 3.8 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL inject… |
CVE-2025-25877 | Low | 3.8 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL inje… |
CVE-2025-25876 | High | 7.2 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL inj… |
CVE-2025-25875 | Medium | 6.4 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL in… |
CVE-2024-55159 | Medium | 4.2 | 2025-02-21 | GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list. |
CVE-2025-1544 | Medium | 6.3 | 2025-02-21 | A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.ph… |
CVE-2025-1537 | Medium | 6.3 | 2025-02-21 | A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /diagsystem/PACS/atual… |
CVE-2025-26794 | High | 7.5 | 2025-02-21 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1… |
CVE-2025-1535 | High | 7.3 | 2025-02-21 | A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161. It has been classified as critical. This affects an unknown part of the file /w… |
CVE-2024-13846 | Medium | 4.9 | 2025-02-21 | The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and includin… |
CVE-2024-13713 | Medium | 6.5 | 2025-02-21 | The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to… |
CVE-2024-12276 | Medium | 5.3 | 2025-02-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second… |
CVE-2024-11260 | High | 7.5 | 2025-02-21 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in a… |
CVE-2024-13235 | Medium | 6.5 | 2025-02-21 | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up t… |
CVE-2025-27096 | Critical | 9.8 | 2025-02-20 | WeGIA is a Web Manager for Institutions with a focus on Portuguese language. A SQL Injection vulnerability was discovered in the WeGIA application, personaliza… |
CVE-2024-54960 | Medium | 6.5 | 2025-02-20 | A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component. |
CVE-2025-0866 | Medium | 6.5 | 2025-02-20 | The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to, and including, 1… |
CVE-2024-13476 | High | 7.5 | 2025-02-20 | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpoint in all versions… |
CVE-2025-1464 | High | 7.3 | 2025-02-19 | A vulnerability, which was classified as critical, has been found in Baiyi Cloud Asset Management System up to 20250204. This issue affects some unknown proces… |
CVE-2024-13534 | High | 7.5 | 2025-02-19 | The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in… |
CVE-2024-13533 | High | 7.5 | 2025-02-19 | The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 1… |
CVE-2024-13491 | High | 7.5 | 2025-02-19 | The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in al… |
CVE-2024-13485 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ver… |
CVE-2024-13483 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions u… |
CVE-2024-13481 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ve… |
CVE-2024-13479 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions u… |
CVE-2024-13478 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions… |
CVE-2024-13489 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ve… |
CVE-2025-1135 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based bli… |
CVE-2025-1134 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blin… |
CVE-2025-1133 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection… |
CVE-2025-1132 | High | 8.8 | 2025-02-19 | A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is d… |
CVE-2024-13712 | Medium | 4.9 | 2025-02-19 | The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient es… |
CVE-2024-13676 | Medium | 6.5 | 2025-02-19 | The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' attribute of the 'image_gallery' shortcode in all versions u… |
CVE-2025-26617 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26614 | High | 8.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26612 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26611 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26610 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26609 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26608 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26607 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26606 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26605 | High | 8.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-22639 | High | 8.5 | 2025-02-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance Rate Shipping for WooCommerce distance… |
CVE-2024-55460 | Critical | 9.8 | 2025-02-18 | A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to exec… |
CVE-2025-22207 | | 2025-02-18 | Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler. | |
CVE-2025-1023 | Critical | 9.8 | 2025-02-18 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vu… |
CVE-2024-13369 | Medium | 6.5 | 2025-02-18 | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up t… |
CVE-2024-13595 | Medium | 6.5 | 2025-02-18 | The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including… |
CVE-2025-25222 | Critical | 9.8 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this v… |
CVE-2025-25221 | Critical | 9.8 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulner… |
CVE-2025-1381 | Medium | 6.3 | 2025-02-17 | A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2025-1380 | Medium | 6.3 | 2025-02-17 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /d… |
CVE-2025-1379 | Medium | 6.3 | 2025-02-17 | A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unk… |
CVE-2024-13726 | High | 8.6 | 2025-02-17 | The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to… |
CVE-2024-13608 | Medium | 4.7 | 2025-02-17 | The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injec… |
CVE-2025-1389 | High | 8.8 | 2025-02-17 | Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify… |
CVE-2025-1374 | Medium | 6.3 | 2025-02-17 | A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /se… |
CVE-2025-26755 | High | 7.6 | 2025-02-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider wp-airbnb-review-slider… |
CVE-2025-22290 | Critical | 9.3 | 2025-02-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Editi… |
CVE-2025-1356 | Medium | 6.3 | 2025-02-16 | A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-13500 | Medium | 6.5 | 2025-02-15 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL… |
CVE-2024-13488 | High | 7.5 | 2025-02-15 | The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions… |
CVE-2025-22209 | Medium | 4.7 | 2025-02-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-22208 | Medium | 4.7 | 2025-02-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-26157 | Medium | 5.9 | 2025-02-14 | A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to e… |
CVE-2025-26156 | High | 8.8 | 2025-02-14 | A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbit… |
CVE-2025-25994 | High | 7.5 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id. |
CVE-2025-25993 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid." |
CVE-2025-25992 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component. |
CVE-2025-25991 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component. |
CVE-2025-25206 | High | 8.3 | 2025-02-14 | eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user t… |
CVE-2024-13152 | Critical | 10.0 | 2025-02-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allo… |
CVE-2025-0821 | Medium | 6.5 | 2025-02-14 | Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficien… |
CVE-2025-25389 | Critical | 9.8 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers to execute arbitrary… |
CVE-2025-25388 | Critical | 9.8 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitra… |
CVE-2025-25387 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbit… |
CVE-2025-25357 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code… |
CVE-2025-25356 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute a… |
CVE-2025-25355 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute a… |