CWE-89 · SQL Injection (page 72)
Page 72 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1872 | Critical | 9.8 | 2025-03-03 | SQL injection vulnerability have been found in 101news affecting version 1.0 through the "sadminusername" parameter in admin/add-subadmins.php. |
CVE-2025-1871 | Critical | 9.8 | 2025-03-03 | SQL injection vulnerability have been found in 101news affecting version 1.0 through the "category" and "subcategory" parameters in admin/add-subcategory.php. |
CVE-2025-1870 | Critical | 9.8 | 2025-03-03 | SQL injection vulnerability have been found in 101news affecting version 1.0 through the "pagedescription" parameter in admin/aboutus.php. |
CVE-2025-1869 | Critical | 9.8 | 2025-03-03 | SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/check_avalability.php. |
CVE-2025-1859 | High | 7.3 | 2025-03-03 | A vulnerability, which was classified as critical, has been found in PHPGurukul News Portal 4.1. This issue affects some unknown processing of the file /login… |
CVE-2025-1858 | High | 7.3 | 2025-03-03 | A vulnerability classified as critical was found in Codezips Online Shopping Website 1.0. This vulnerability affects unknown code of the file /success.php. The… |
CVE-2025-1857 | High | 7.3 | 2025-03-03 | A vulnerability classified as critical has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file /check_… |
CVE-2025-1856 | High | 7.3 | 2025-03-03 | A vulnerability was found in Codezips Gym Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-1855 | Medium | 6.3 | 2025-03-03 | A vulnerability was found in PHPGurukul Online Shopping Portal 2.1. It has been declared as critical. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-1854 | Medium | 6.3 | 2025-03-03 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/adm… |
CVE-2025-1850 | High | 7.3 | 2025-03-03 | A vulnerability, which was classified as critical, has been found in Codezips College Management System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-1844 | Medium | 6.3 | 2025-03-03 | A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. Affected is an unknown function of the file /CDGServer3/lo… |
CVE-2025-1843 | Medium | 6.3 | 2025-03-03 | A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20250211. This issue affects the function select of the file com/xq/tmall… |
CVE-2025-1841 | High | 7.3 | 2025-03-03 | A vulnerability classified as critical has been found in ESAFENET CDG 5.6.3.154.205. This affects an unknown part of the file /CDGServer3/logManagement/ClientS… |
CVE-2025-1840 | High | 7.3 | 2025-03-03 | A vulnerability was found in ESAFENET CDG 5.6.3.154.205. It has been rated as critical. Affected by this issue is some unknown functionality of the file /CDGSe… |
CVE-2025-1832 | Medium | 6.3 | 2025-03-02 | A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is the function getUserList of the file src/main/jav… |
CVE-2025-1831 | Medium | 6.3 | 2025-03-02 | A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is the function GetDBUser of the file src/main/java/com/futvan/z/syst… |
CVE-2025-1821 | Medium | 6.3 | 2025-03-02 | A vulnerability was found in zj1983 zz up to 2024-8 and classified as critical. Affected by this issue is the function getUserOrgForUserId of the file src/main… |
CVE-2025-1820 | Medium | 6.3 | 2025-03-02 | A vulnerability has been found in zj1983 zz up to 2024-8 and classified as critical. Affected by this vulnerability is the function getOaWid of the file src/ma… |
CVE-2025-1812 | Medium | 6.3 | 2025-03-02 | A vulnerability classified as critical has been found in zj1983 zz up to 2024-08. Affected is the function GetUserOrg of the file com/futvan/z/framework/core/S… |
CVE-2025-1811 | High | 7.3 | 2025-03-02 | A vulnerability was found in AT Software Solutions ATSVD up to 3.4.1. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-1809 | High | 7.3 | 2025-03-02 | A vulnerability was found in Pixsoft Sol up to 7.6.6c and classified as critical. This issue affects some unknown processing of the file /pix_projetos/servlet?… |
CVE-2025-1808 | High | 7.3 | 2025-03-02 | A vulnerability has been found in Pixsoft E-Saphira 1.7.24 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login&t… |
CVE-2025-1797 | Medium | 6.3 | 2025-03-01 | A vulnerability, which was classified as critical, has been found in Hunan Zhonghe Baiyi Information Technology Baiyiyun Asset Management and Operations System… |
CVE-2024-13750 | Medium | 6.5 | 2025-03-01 | The Multilevel Referral Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to… |
CVE-2025-26047 | Medium | 5.1 | 2025-02-28 | Loggrove v1.0 is vulnerable to SQL Injection in the read.py file. |
CVE-2025-1572 | Medium | 6.5 | 2025-02-28 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and… |
CVE-2024-55160 | Critical | 9.8 | 2025-02-27 | GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list. |
CVE-2024-13148 | Critical | 9.8 | 2025-02-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yukseloglu Filter B2B Login Platform allows SQL Injection… |
CVE-2025-1751 | Critical | 9.8 | 2025-02-27 | A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones. This vulnerability allows an attacker to retrieve, create, update and delete d… |
CVE-2025-1726 | Medium | 4.3 | 2025-02-26 | There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low… |
CVE-2025-25462 | Medium | 5.5 | 2025-02-26 | A SQL Injection vulnerability was found in /admin/add-propertytype.php in PHPGurukul Land Record System Project in PHP v1.0 allows remote attackers to execute… |
CVE-2025-25521 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php. |
CVE-2025-25520 | Critical | 9.8 | 2025-02-25 | Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php. |
CVE-2025-25519 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php. |
CVE-2025-25517 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php. |
CVE-2025-25516 | Critical | 9.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php. |
CVE-2025-25515 | High | 8.8 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database. |
CVE-2025-25514 | Medium | 6.5 | 2025-02-25 | Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php. |
CVE-2025-22211 | Low | 3.4 | 2025-02-25 | A SQL injection vulnerability in the JoomShopping component versions 1.0.0-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary… |
CVE-2025-27135 | Critical | 9.8 | 2025-02-25 | RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. Versions 0.15.1 and prior are vulnerable to SQL injection. The ExeSQL component extracts… |
CVE-2025-26974 | Critical | 9.3 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator… |
CVE-2025-26971 | High | 7.6 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Poll Maker poll-maker allows Blind SQL Injection… |
CVE-2025-26946 | High | 7.6 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Yelp Review Slider wp-yelp-review-slider all… |
CVE-2025-26943 | Critical | 9.3 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jürgen Müller Easy Quotes easy-quotes allows Blind SQL In… |
CVE-2025-26915 | High | 8.5 | 2025-02-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PickPlugins Wishlist wishlist allows SQL Injection.This i… |
CVE-2024-51539 | Low | 2.3 | 2025-02-25 | The Dell Secure Connect Gateway (SCG) Application and Appliance, versions prior to 5.28, contains a SQL injection vulnerability due to improper neutralization… |
CVE-2025-1648 | High | 7.5 | 2025-02-25 | The Yawave plugin for WordPress is vulnerable to SQL Injection via the 'lbid' parameter in all versions up to, and including, 2.9.1 due to insufficient escapin… |
CVE-2025-22210 | High | 7.2 | 2025-02-25 | A SQL injection vulnerability in the Hikashop component versions 3.3.0-5.1.4 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL… |
CVE-2025-1641 | High | 7.3 | 2025-02-25 | A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been classified as critical. This affects an unknown part of the file /AGE0000700/GetHorario… |
CVE-2025-1640 | High | 7.3 | 2025-02-25 | A vulnerability was found in Benner ModernaNet up to 1.1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /Home/J… |
CVE-2025-22974 | Critical | 9.8 | 2025-02-24 | SQL Injection vulnerability in SeaCMS v.13.2 and before allows a remote attacker to execute arbitrary code via the DoTranExecSql parameter in the phome.php com… |
CVE-2024-53544 | Critical | 9.8 | 2025-02-24 | NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the getCookieNames method in the s… |
CVE-2024-53543 | Medium | 5.4 | 2025-02-24 | NovaCHRON Zeitsysteme GmbH & Co. KG Smart Time Plus v8.x to v8.6 was discovered to contain a SQL injection vulnerability via the addProject method in the smart… |
CVE-2025-25513 | Critical | 9.8 | 2025-02-24 | Seacms <=13.3 is vulnerable to SQL Injection in admin_members.php. |
CVE-2025-26533 | High | 8.1 | 2025-02-24 | An SQL injection risk was identified in the module list filter within course search. |
CVE-2025-27133 | High | 8.8 | 2025-02-24 | WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adici… |
CVE-2024-54820 | Critical | 9.8 | 2025-02-24 | XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. This vulnerability allows attacke… |
CVE-2025-26200 | High | 7.2 | 2025-02-24 | SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component. |
CVE-2025-27312 | High | 8.5 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jenst WP Sitemap wp-sitemap allows SQL Injection.This iss… |
CVE-2025-27297 | High | 7.6 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in guelben Bravo Search & Replace bravo-search-and-replace a… |
CVE-2024-12918 | High | 8.8 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Health4All allows SQL Injection. This iss… |
CVE-2024-12916 | High | 8.8 | 2025-02-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agito Computer Life4All allows SQL Injection. This issue… |
CVE-2025-24490 | Critical | 9.6 | 2025-02-24 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to use prepared statements in the SQL query of boards reorderin… |
CVE-2025-1596 | High | 7.3 | 2025-02-23 | A vulnerability was found in SourceCodester Best Church Management Software 1.0 and classified as critical. This issue affects some unknown processing of the f… |
CVE-2025-1583 | Medium | 6.3 | 2025-02-23 | A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/search-repo… |
CVE-2025-1582 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-1581 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-1580 | Medium | 6.3 | 2025-02-23 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the f… |
CVE-2025-1578 | Medium | 6.3 | 2025-02-23 | A vulnerability, which was classified as critical, was found in PHPGurukul/Campcodes Online Shopping Portal 2.1. This affects an unknown part of the file /sear… |
CVE-2025-1576 | Medium | 6.3 | 2025-02-23 | A vulnerability classified as critical was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerability is an unknown func… |
CVE-2024-13474 | High | 7.5 | 2025-02-22 | The LTL Freight Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versi… |
CVE-2020-19248 | Medium | 5.1 | 2025-02-21 | SQL Injection vulnerability in PbootCMS 1.4.1 in parsing if statements in templates, resulting in a malicious user's ability to contaminate template content by… |
CVE-2025-25878 | Low | 3.8 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /del.php. The attack can use SQL inject… |
CVE-2025-25877 | Low | 3.8 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /admin.php. The attack can use SQL inje… |
CVE-2025-25876 | High | 7.2 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL inj… |
CVE-2025-25875 | Medium | 6.4 | 2025-02-21 | A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /message.php. The attack can use SQL in… |
CVE-2024-55159 | Medium | 4.2 | 2025-02-21 | GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list. |
CVE-2025-1544 | Medium | 6.3 | 2025-02-21 | A vulnerability, which was classified as critical, was found in dingfanzu CMS up to 20250210. Affected is an unknown function of the file /ajax/loadShopInfo.ph… |
CVE-2025-1537 | Medium | 6.3 | 2025-02-21 | A vulnerability was found in Harpia DiagSystem 12. It has been rated as critical. This issue affects some unknown processing of the file /diagsystem/PACS/atual… |
CVE-2025-26794 | High | 7.5 | 2025-02-21 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1… |
CVE-2025-1535 | High | 7.3 | 2025-02-21 | A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161. It has been classified as critical. This affects an unknown part of the file /w… |
CVE-2024-13846 | Medium | 4.9 | 2025-02-21 | The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘post_id’ parameter in all versions up to, and includin… |
CVE-2024-13713 | Medium | 6.5 | 2025-02-21 | The WPExperts Square For GiveWP plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versions up to, and including, 1.3.1 due to… |
CVE-2024-12276 | Medium | 5.3 | 2025-02-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to second… |
CVE-2024-11260 | High | 7.5 | 2025-02-21 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the active_status parameter in a… |
CVE-2024-13235 | Medium | 6.5 | 2025-02-21 | The Pinpoint Booking System – #1 WordPress Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'language' parameter in all versions up t… |
CVE-2025-27096 | Critical | 9.8 | 2025-02-20 | WeGIA is a Web Manager for Institutions with a focus on Portuguese language. A SQL Injection vulnerability was discovered in the WeGIA application, personaliza… |
CVE-2024-54960 | Medium | 6.5 | 2025-02-20 | A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component. |
CVE-2025-0866 | Medium | 6.5 | 2025-02-20 | The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to, and including, 1… |
CVE-2024-13476 | High | 7.5 | 2025-02-20 | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_dropship' AJAX endpoint in all versions… |
CVE-2025-1464 | High | 7.3 | 2025-02-19 | A vulnerability, which was classified as critical, has been found in Baiyi Cloud Asset Management System up to 20250204. This issue affects some unknown proces… |
CVE-2024-13534 | High | 7.5 | 2025-02-19 | The Small Package Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in… |
CVE-2024-13533 | High | 7.5 | 2025-02-19 | The Small Package Quotes – USPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 1… |
CVE-2024-13491 | High | 7.5 | 2025-02-19 | The Small Package Quotes – For Customers of FedEx plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in al… |
CVE-2024-13485 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – ABF Freight Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ver… |
CVE-2024-13483 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – SAIA Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions u… |
CVE-2024-13481 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – R+L Carriers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ve… |
CVE-2024-13479 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – SEFL Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions u… |
CVE-2024-13478 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – TForce Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions… |