CWE-89 · SQL Injection (page 73)
Page 73 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-13489 | High | 7.5 | 2025-02-19 | The LTL Freight Quotes – Old Dominion Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ve… |
CVE-2025-1135 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based bli… |
CVE-2025-1134 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blin… |
CVE-2025-1133 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection… |
CVE-2025-1132 | High | 8.8 | 2025-02-19 | A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is d… |
CVE-2024-13712 | Medium | 4.9 | 2025-02-19 | The Pollin plugin for WordPress is vulnerable to SQL Injection via the 'question' parameter in all versions up to, and including, 1.01.1 due to insufficient es… |
CVE-2024-13676 | Medium | 6.5 | 2025-02-19 | The Categorized Gallery Plugin plugin for WordPress is vulnerable to SQL Injection via the 'field' attribute of the 'image_gallery' shortcode in all versions u… |
CVE-2025-26617 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26614 | High | 8.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26612 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26611 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26610 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26609 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26608 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26607 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26606 | Critical | 9.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-26605 | High | 8.8 | 2025-02-18 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA appli… |
CVE-2025-22639 | High | 8.5 | 2025-02-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance Rate Shipping for WooCommerce distance… |
CVE-2024-55460 | Critical | 9.8 | 2025-02-18 | A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allows attackers to exec… |
CVE-2025-22207 | | 2025-02-18 | Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler. | |
CVE-2025-1023 | Critical | 9.8 | 2025-02-18 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vu… |
CVE-2024-13369 | Medium | 6.5 | 2025-02-18 | The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up t… |
CVE-2024-13595 | Medium | 6.5 | 2025-02-18 | The Simple Signup Form plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'ssf' shortcode in all versions up to, and including… |
CVE-2025-25222 | Critical | 9.8 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in retrieve.php. If this v… |
CVE-2025-25221 | Critical | 9.8 | 2025-02-18 | The LuxCal Web Calendar prior to 5.3.3M (MySQL version) and prior to 5.3.3L (SQLite version) contains an SQL injection vulnerability in pdf.php. If this vulner… |
CVE-2025-1381 | Medium | 6.3 | 2025-02-17 | A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. This affects an unknown part of the… |
CVE-2025-1380 | Medium | 6.3 | 2025-02-17 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /d… |
CVE-2025-1379 | Medium | 6.3 | 2025-02-17 | A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unk… |
CVE-2024-13726 | High | 8.6 | 2025-02-17 | The Coder WordPress plugin through 1.3.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to… |
CVE-2024-13608 | Medium | 4.7 | 2025-02-17 | The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injec… |
CVE-2025-1389 | High | 8.8 | 2025-02-17 | Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify… |
CVE-2025-1374 | Medium | 6.3 | 2025-02-17 | A vulnerability classified as critical has been found in code-projects Real Estate Property Management System 1.0. This affects an unknown part of the file /se… |
CVE-2025-26755 | High | 7.6 | 2025-02-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jgwhite33 WP Airbnb Review Slider wp-airbnb-review-slider… |
CVE-2025-22290 | Critical | 9.3 | 2025-02-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Editi… |
CVE-2025-1356 | Medium | 6.3 | 2025-02-16 | A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2024-13500 | Medium | 6.5 | 2025-02-15 | The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL… |
CVE-2024-13488 | High | 7.5 | 2025-02-15 | The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameters in all versions… |
CVE-2025-22209 | Medium | 4.7 | 2025-02-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-22208 | Medium | 4.7 | 2025-02-15 | A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.3 for Joomla allows authenticated attackers (administrator) to execute arbitrary SQL com… |
CVE-2025-26157 | Medium | 5.9 | 2025-02-14 | A SQL Injection vulnerability was found in /bpms/index.php in Source Code and Project Beauty Parlour Management System V1.1, which allows remote attackers to e… |
CVE-2025-26156 | High | 8.8 | 2025-02-14 | A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbit… |
CVE-2025-25994 | High | 7.5 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id. |
CVE-2025-25993 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid." |
CVE-2025-25992 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in FeMiner wms 1.0 allows a remote attacker to obtain sensitive information via the inquire_inout_item.php component. |
CVE-2025-25991 | Medium | 5.1 | 2025-02-14 | SQL Injection vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component. |
CVE-2025-25206 | High | 8.3 | 2025-02-14 | eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user t… |
CVE-2024-13152 | Critical | 10.0 | 2025-02-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BSS Software Mobuy Online Machinery Monitoring Panel allo… |
CVE-2025-0821 | Medium | 6.5 | 2025-02-14 | Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficien… |
CVE-2025-25389 | Critical | 9.8 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/forgot-password.php in Phpgurukul Land Record System v1.0, which allows remote attackers to execute arbitrary… |
CVE-2025-25388 | Critical | 9.8 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/edit-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitra… |
CVE-2025-25387 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/manage-propertytype.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbit… |
CVE-2025-25357 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code… |
CVE-2025-25356 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute a… |
CVE-2025-25355 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute a… |
CVE-2025-25354 | High | 7.2 | 2025-02-13 | A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the co… |
CVE-2025-25352 | High | 7.2 | 2025-02-13 | A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code vi… |
CVE-2025-1227 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in ywoa up to 2024.07.03. It has been rated as critical. This issue affects the function selectList of the file com/cloudweb/oa/mappe… |
CVE-2025-1224 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in ywoa up to 2024.07.03. This vulnerability affects the function listNameBySql of the file com/cloudweb/oa/ma… |
CVE-2025-1216 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as critical, has been found in ywoa up to 2024.07.03. This issue affects the function selectNoticeList of the file com/cl… |
CVE-2025-1210 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Affected by this vulnerability is an unknown functionality of the file /co… |
CVE-2025-25351 | Critical | 9.8 | 2025-02-12 | PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the dateexpense parameter. |
CVE-2025-25349 | Critical | 9.8 | 2025-02-12 | PHPGurukul Daily Expense Tracker System v1.1 is vulnerable to SQL Injection in /dets/add-expense.php via the costitem parameter. |
CVE-2025-1206 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. This affects an unknown part of the file /dashboard/admin/… |
CVE-2025-1202 | Medium | 6.3 | 2025-02-12 | A vulnerability classified as critical has been found in SourceCodester Best Church Management Software 1.1. Affected is an unknown function of the file /admin… |
CVE-2025-26348 | Medium | 5.5 | 2025-02-12 | A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserMenu endpoint) in Q-Free… |
CVE-2025-26346 | Medium | 5.5 | 2025-02-12 | A CWE-89 "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" in maxprofile/menu/model.lua (editUserGroupMenu endpoint) in Q-… |
CVE-2025-1201 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-1200 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-1199 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in SourceCodester Best Church Management Software 1.1. It has been classified as critical. This affects an unknown part of the file /… |
CVE-2025-1197 | Medium | 6.3 | 2025-02-12 | A vulnerability has been found in code-projects Real Estate Property Management System 1.0 and classified as critical. Affected by this vulnerability is an unk… |
CVE-2024-13532 | High | 7.5 | 2025-02-12 | The Small Package Quotes – Purolator Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all ver… |
CVE-2024-13480 | High | 7.5 | 2025-02-12 | The LTL Freight Quotes – For Customers of FedEx Freight plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters… |
CVE-2024-13477 | High | 7.5 | 2025-02-12 | The LTL Freight Quotes – Unishippers Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and includi… |
CVE-2025-1192 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in SourceCodester Multi Restaurant Table Reservation System 1.0. It has been classified as critical. Affected is an unknown function… |
CVE-2025-1191 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in SourceCodester Multi Restaurant Table Reservation System 1.0 and classified as critical. This issue affects some unknown processin… |
CVE-2025-1189 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as critical, was found in 1000 Projects Attendance Tracking Management System 1.0. This affects an unknown part of the fi… |
CVE-2024-32838 | High | 8.8 | 2025-02-12 | SQL Injection vulnerability in various API endpoints - offices, dashboards, etc. Apache Fineract versions 1.9 and before have a vulnerability that allows an au… |
CVE-2024-13531 | High | 7.5 | 2025-02-12 | The ShipEngine Shipping Quotes plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 1.0.7 due… |
CVE-2024-13490 | High | 7.5 | 2025-02-12 | The LTL Freight Quotes – XPO Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' and 'dropship_edit_id' parameters in all versions up… |
CVE-2024-13475 | High | 7.5 | 2025-02-12 | The Small Package Quotes – UPS Edition plugin for WordPress is vulnerable to SQL Injection via the 'edit_id' parameter in all versions up to, and including, 4… |
CVE-2024-13473 | High | 7.5 | 2025-02-12 | The LTL Freight Quotes – Worldwide Express Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropship_edit_id' and 'edit_id' parameter in al… |
CVE-2024-13435 | High | 7.5 | 2025-02-12 | The Ebook Downloader plugin for WordPress is vulnerable to SQL Injection via the 'download' parameter in all versions up to, and including, 1.0 due to insuffic… |
CVE-2025-1188 | Medium | 6.3 | 2025-02-12 | A vulnerability, which was classified as critical, has been found in Codezips Gym Management System 1.0. Affected by this issue is some unknown functionality o… |
CVE-2025-1185 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModal_Sensor… |
CVE-2025-26520 | High | 7.6 | 2025-02-12 | Cacti through 1.2.29 allows SQL injection in the template function in host_templates.php via the graph_template parameter. NOTE: this issue exists because of a… |
CVE-2025-1184 | Medium | 6.3 | 2025-02-12 | A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax… |
CVE-2025-1183 | Medium | 6.3 | 2025-02-12 | A vulnerability has been found in CodeZips Gym Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-55212 | Medium | 6.5 | 2025-02-11 | DNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspx. |
CVE-2025-1173 | Medium | 4.7 | 2025-02-11 | A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file process… |
CVE-2025-1172 | Medium | 6.3 | 2025-02-11 | A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affected by this issue is some unknown func… |
CVE-2025-1168 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. This vulnerability affects unknown code o… |
CVE-2025-1167 | Medium | 6.3 | 2025-02-11 | A vulnerability was found in Mayuri K Employee Management System up to 192.168.70.3 and classified as critical. Affected by this issue is some unknown function… |
CVE-2025-1162 | Medium | 6.3 | 2025-02-10 | A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_parse/load\_user-profil… |
CVE-2025-1158 | Medium | 6.3 | 2025-02-10 | A vulnerability was found in ESAFENET CDG 5.6.3.154.205_20250114. It has been classified as critical. Affected is an unknown function of the file addPolicyToSa… |
CVE-2025-1157 | Medium | 6.3 | 2025-02-10 | A vulnerability was found in Allims lab.online up to 20250201 and classified as critical. This issue affects some unknown processing of the file /model/model_r… |
CVE-2025-1156 | High | 7.3 | 2025-02-10 | A vulnerability has been found in Pix Software Vivaz 6.0.10 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login… |
CVE-2025-1154 | Medium | 6.3 | 2025-02-10 | A vulnerability, which was classified as critical, has been found in xxyopen Novel up to 3.4.1. Affected by this issue is some unknown functionality of the fil… |
CVE-2024-57178 | Medium | 5.9 | 2025-02-10 | An SQL injection vulnerability exists in Stock-Forecaster <=01-04-2020. By sending a specially crafted 'stock-symbol' parameter to the portofolio() endpoint, i… |
CVE-2024-13440 | High | 8.2 | 2025-02-09 | The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and including, 7.0 due t… |
CVE-2025-1117 | High | 7.3 | 2025-02-08 | A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the arg… |