CWE-89 · SQL Injection (page 7)
Page 7 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85205 | Medium | 6.3 | 2026-09-03 | A vulnerability was determined in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function addwishlist of the file /customer/controlle… |
CVE-2026-82526 | Critical | 9.8 | 2026-09-03 | R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the… |
CVE-2026-85187 | High | 7.3 | 2026-09-03 | A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function Order::pupdate of the fi… |
CVE-2026-84813 | Critical | 9.3 | 2026-09-03 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. |
CVE-2026-84768 | Critical | 9.3 | 2026-09-03 | Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions. |
CVE-2026-85138 | High | 7.3 | 2026-09-03 | A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipul… |
CVE-2026-85155 | High | 7.5 | 2026-09-03 | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated… |
CVE-2026-78080 | | 2026-09-03 | Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing… | |
CVE-2026-76176 | | 2026-09-03 | SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in th… | |
CVE-2026-76175 | | 2026-09-03 | SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with oper… | |
CVE-2026-79991 | | 2026-09-02 | Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments()… | |
CVE-2026-81286 | Critical | 9.3 | 2026-09-02 | Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. |
CVE-2026-14828 | High | 8.8 | 2026-09-02 | Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to a… |
CVE-2026-82182 | Medium | 4.1 | 2026-09-02 | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query… |
CVE-2026-19704 | Medium | 5.3 | 2026-09-02 | The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read co… |
CVE-2026-19754 | | 2026-09-02 | Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fiel… | |
CVE-2026-84208 | High | 7.5 | 2026-09-01 | AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoint… |
CVE-2026-73721 | High | 7.2 | 2026-09-01 | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Netw… |
CVE-2026-84153 | Medium | 6.3 | 2026-09-01 | A vulnerability was determined in Xinhu Rainrock RockOA up to 2.3.2. The impacted element is the function toaddval of the file /index.php?m=index&a=publicsavev… |
CVE-2026-84111 | High | 7.3 | 2026-09-01 | A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxf_dump_table.php. This manipulation of the argume… |
CVE-2026-18630 | High | 8.8 | 2026-09-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industr… |
CVE-2026-84109 | Medium | 6.3 | 2026-09-01 | A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Exe… |
CVE-2026-18210 | Critical | 9.8 | 2026-09-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware I… |
CVE-2026-84061 | Medium | 6.3 | 2026-09-01 | A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file opench… |
CVE-2026-18765 | Critical | 9.8 | 2026-09-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Inje… |
CVE-2026-77189 | Medium | 6.5 | 2026-09-01 | The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQ… |
CVE-2026-77823 | Medium | 4.9 | 2026-09-01 | The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and inclu… |
CVE-2026-76006 | Medium | 4.9 | 2026-09-01 | The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, an… |
CVE-2026-18752 | Medium | 6.5 | 2026-09-01 | The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and including, 3.1.0 due to… |
CVE-2026-17589 | Medium | 4.9 | 2026-09-01 | The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all versions up to, and in… |
CVE-2026-82922 | High | 7.3 | 2026-08-31 | A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=up… |
CVE-2026-82914 | High | 7.3 | 2026-08-31 | A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipula… |
CVE-2026-81763 | Critical | 9.3 | 2026-08-31 | Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions. |
CVE-2026-81756 | Critical | 9.3 | 2026-08-31 | Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions. |
CVE-2026-81293 | Critical | 9.3 | 2026-08-31 | Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions. |
CVE-2026-81287 | High | 8.5 | 2026-08-31 | Subscriber SQL Injection in Charitable <= 1.8.12.1 versions. |
CVE-2026-75132 | Medium | 6.5 | 2026-08-31 | WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote au… |
CVE-2026-82701 | High | 7.3 | 2026-08-31 | A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the… |
CVE-2026-82696 | Medium | 6.3 | 2026-08-31 | A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_searchfrm.php… |
CVE-2026-5956 | High | 8.8 | 2026-08-31 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Site Management Panel allows SQL Injection… |
CVE-2026-82620 | Medium | 6.3 | 2026-08-31 | A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseD… |
CVE-2026-82615 | High | 7.3 | 2026-08-31 | A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find_phone of the file /passwordr… |
CVE-2026-82614 | High | 7.3 | 2026-08-31 | A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=prod… |
CVE-2026-82613 | High | 7.3 | 2026-08-31 | A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of… |
CVE-2026-82612 | High | 7.3 | 2026-08-31 | A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the fi… |
CVE-2026-82611 | High | 7.3 | 2026-08-31 | A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication… |
CVE-2026-82610 | High | 7.3 | 2026-08-31 | A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file… |
CVE-2026-82609 | Medium | 6.3 | 2026-08-31 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit.php. The manipulati… |
CVE-2026-82600 | High | 7.3 | 2026-08-31 | A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing… |
CVE-2026-82655 | High | 7.5 | 2026-08-30 | Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php that allows unauthenticated attackers… |
CVE-2026-82545 | Medium | 6.3 | 2026-08-30 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/sup_searchfrm.php. The manipu… |
CVE-2026-82541 | Medium | 6.3 | 2026-08-30 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pag… |
CVE-2026-82540 | Medium | 6.3 | 2026-08-30 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_searchfrm.php. The manip… |
CVE-2026-82485 | Medium | 6.3 | 2026-08-30 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pr… |
CVE-2026-82484 | Medium | 6.3 | 2026-08-30 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/emp_searchfrm.php. This manipulation o… |
CVE-2026-82424 | Medium | 6.3 | 2026-08-29 | A weakness has been identified in PHPGurukul Student Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /student_ed… |
CVE-2026-82422 | Medium | 6.3 | 2026-08-29 | A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/emp_del.php. The manipul… |
CVE-2026-82421 | Medium | 6.3 | 2026-08-29 | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The… |
CVE-2026-80488 | Medium | 4.1 | 2026-08-29 | The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, whi… |
CVE-2026-16061 | High | 8.6 | 2026-08-29 | The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a… |
CVE-2026-55855 | Medium | 6.5 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-3627 | Critical | 9.1 | 2026-08-28 | IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker t… |
CVE-2026-77586 | High | 8.0 | 2026-08-28 | In MongoDB Connector for BI, MongoDB object names such as collection, field, and index names are placed into the quoted identifiers of the DDL text returned by… |
CVE-2026-77184 | Medium | 5.2 | 2026-08-28 | In MongoDB Connector for BI, the description text of a collection's JSON schema validator is incorporated into the comment text of the DDL returned by SHOW CRE… |
CVE-2026-55634 | Critical | 9.9 | 2026-08-28 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoint /pimcore-studio/… |
CVE-2026-55509 | | 2026-08-28 | WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py conca… | |
CVE-2026-82227 | High | 8.5 | 2026-08-28 | Contributor SQL Injection in WPBulky <= 1.2.2 versions. |
CVE-2026-78072 | | 2026-08-28 | Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1 | |
CVE-2026-78070 | | 2026-08-28 | Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL… | |
CVE-2026-40018 | High | 7.4 | 2026-08-28 | None None None No publicly available exploits are known. |
CVE-2026-5097 | High | 7.5 | 2026-08-28 | The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to i… |
CVE-2026-78614 | | 2026-08-28 | WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administr… | |
CVE-2026-78613 | | 2026-08-28 | WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administrat… | |
CVE-2026-78612 | | 2026-08-28 | WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report admin… | |
CVE-2026-75417 | High | 7.2 | 2026-08-28 | A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php… |
CVE-2026-81728 | High | 8.1 | 2026-08-27 | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdo… |
CVE-2026-74820 | | 2026-08-27 | ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticate… | |
CVE-2026-37009 | Medium | 6.5 | 2026-08-27 | A SQL injection vulnerability in NL2SQLTool in crewai-tools v1.10.2rc1 allows a remote attacker to execute arbitrary SQL commands via an unsanitized sql_query… |
CVE-2026-81677 | | 2026-08-27 | The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter `id_ambito`. An attacker can inject SQL sy… | |
CVE-2026-81676 | | 2026-08-27 | A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the `limit_videos` parameter is directly concatenated into a MariaDB SQL query without pro… | |
CVE-2026-81675 | | 2026-08-27 | The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is directly embedded in… | |
CVE-2026-81674 | | 2026-08-27 | The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incorporated into a Mar… | |
CVE-2026-81673 | | 2026-08-27 | The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does not validate or sani… | |
CVE-2026-81672 | | 2026-08-27 | SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The application does not sanit… | |
CVE-2026-81277 | High | 8.5 | 2026-08-27 | Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions. |
CVE-2026-78288 | Critical | 9.3 | 2026-08-27 | Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions. |
CVE-2026-78285 | High | 8.5 | 2026-08-27 | Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions. |
CVE-2026-78260 | Critical | 9.3 | 2026-08-27 | Unauthenticated SQL Injection in Epayco <= 8.4.6 versions. |
CVE-2026-32564 | High | 8.5 | 2026-08-27 | Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. |
CVE-2026-32550 | High | 8.5 | 2026-08-27 | Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions. |
CVE-2026-32479 | Critical | 9.3 | 2026-08-27 | Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions. |
CVE-2026-81203 | High | 7.3 | 2026-08-26 | A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=lo… |
CVE-2026-75336 | Critical | 9.8 | 2026-08-26 | Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json. |
CVE-2026-75330 | Critical | 9.8 | 2026-08-26 | The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection. The module paramet… |
CVE-2026-75334 | Critical | 9.8 | 2026-08-26 | The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the t_report_sql_res… |
CVE-2026-68000 | Critical | 9.8 | 2026-08-26 | The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of… |
CVE-2026-54245 | | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is v… | |
CVE-2026-49809 | Medium | 6.5 | 2026-08-26 | Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vuln… |
CVE-2026-46371 | Medium | 6.5 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint (GET /api/… |
CVE-2026-46370 | Medium | 6.5 | 2026-08-26 | Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/flee… |