CWE-89 · SQL Injection (page 8)
Page 8 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34102 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\… |
CVE-2026-34101 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, d… |
CVE-2026-34100 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, durat… |
CVE-2026-34099 | Critical | 9.8 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info.php (line 16): SELECT * FROM jobs where id = '\".$_GET[… |
CVE-2026-57517 | Critical | 9.8 | 2026-07-01 | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries… |
CVE-2026-13454 | Medium | 6.5 | 2026-07-01 | The MotoPress Appointment Booking plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 2.4.5… |
CVE-2026-11823 | High | 7.5 | 2026-07-01 | The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the 'store_service_date' parameter of the bpa_assign_staffmemb… |
CVE-2026-12110 | Medium | 6.5 | 2026-07-01 | The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'task_search'… |
CVE-2026-12090 | Medium | 6.5 | 2026-07-01 | The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'wppm_proj_fi… |
CVE-2026-55721 | Critical | 9.3 | 2026-06-30 | Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incor… |
CVE-2026-3602 | Medium | 4.7 | 2026-06-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 is vulnerable… |
CVE-2026-58376 | High | 7.6 | 2026-06-30 | Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database c… |
CVE-2025-53648 | Medium | 5.4 | 2026-06-30 | SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files. Users are recommended to upgrade t… |
CVE-2026-8402 | Critical | 9.8 | 2026-06-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Eksagate Electronic Engineering and Computer Industry Tra… |
CVE-2026-53690 | | 2026-06-30 | An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in the POST "/admin/index.php" login endpoint. The application… | |
CVE-2026-13766 | Critical | 9.8 | 2026-06-30 | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bin… |
CVE-2026-9711 | Critical | 9.8 | 2026-06-30 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versio… |
CVE-2026-12076 | | 2026-06-30 | Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline. The vulnerability allows a remote, unauthenticated attacker to execute ar… | |
CVE-2026-57955 | High | 8.5 | 2026-06-29 | SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-enco… |
CVE-2026-13752 | Medium | 6.0 | 2026-06-29 | Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying cra… |
CVE-2026-13746 | Low | 3.6 | 2026-06-29 | Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by su… |
CVE-2026-13744 | High | 8.3 | 2026-06-29 | Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repositor… |
CVE-2026-13579 | Medium | 6.3 | 2026-06-29 | A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /patientchangep… |
CVE-2026-13578 | Medium | 6.3 | 2026-06-29 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /pat… |
CVE-2026-13572 | Medium | 6.3 | 2026-06-29 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /insertbillingrecord.php… |
CVE-2026-40524 | High | 8.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated dire… |
CVE-2026-40523 | High | 8.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC p… |
CVE-2026-40522 | High | 7.1 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitr… |
CVE-2026-13569 | Medium | 4.7 | 2026-06-29 | A security vulnerability has been detected in weng-xianhu EyouCMS up to 1.7.1. This issue affects some unknown processing of the file /index.php of the compone… |
CVE-2026-13566 | High | 7.3 | 2026-06-29 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /previ… |
CVE-2026-13565 | High | 7.3 | 2026-06-29 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-13559 | High | 7.3 | 2026-06-29 | A weakness has been identified in code-projects Real State Services 1.0. Impacted is an unknown function of the file /single-list_sale.php?action=add. Executin… |
CVE-2026-13555 | High | 7.3 | 2026-06-29 | A vulnerability was found in itsourcecode Online Hotel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/mod_users… |
CVE-2026-13552 | High | 7.3 | 2026-06-29 | A vulnerability was detected in itsourcecode Online Hotel Management System 1.0. This impacts an unknown function of the file /admin/mod_amenities/controller.p… |
CVE-2026-13551 | High | 7.3 | 2026-06-29 | A security vulnerability has been detected in itsourcecode Baptism Information Management System 1.0. This affects an unknown function of the file /editBaptism… |
CVE-2026-13550 | High | 7.3 | 2026-06-29 | A weakness has been identified in itsourcecode Baptism Information Management System 1.0. The impacted element is an unknown function of the file /delbaptism.p… |
CVE-2026-13548 | Medium | 6.3 | 2026-06-29 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /doctortimings.php. The manipulation… |
CVE-2026-13542 | Medium | 6.3 | 2026-06-29 | A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /doctorprofile.php. The… |
CVE-2026-13541 | Medium | 6.3 | 2026-06-29 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /doctorchangepassword.php. Executin… |
CVE-2026-13535 | Medium | 6.3 | 2026-06-29 | A flaw has been found in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function GetFileInfo of the file hrsystem/application/m… |
CVE-2026-13532 | Medium | 6.3 | 2026-06-29 | A weakness has been identified in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /departme… |
CVE-2026-13531 | Medium | 6.3 | 2026-06-29 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /department.php. The manipulati… |
CVE-2026-13530 | Medium | 6.3 | 2026-06-29 | A vulnerability was identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /appointmentdetail.php of the compo… |
CVE-2026-13529 | Medium | 5.6 | 2026-06-29 | A vulnerability was determined in YzmCMS up to 7.5. This affects an unknown function of the file /application/install/index.php. Executing a manipulation of th… |
CVE-2026-13527 | High | 7.3 | 2026-06-29 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /preview4.php… |
CVE-2026-13526 | High | 7.3 | 2026-06-29 | A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_class.php. This manipulation o… |
CVE-2026-13525 | Medium | 6.3 | 2026-06-29 | A vulnerability was detected in CodeAstro Human Resource Management System 1.0. This issue affects the function emselectByCode of the file application/models/E… |
CVE-2026-13521 | High | 7.3 | 2026-06-29 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affected by this vulnerability is an unknown functionality of the… |
CVE-2026-13520 | Medium | 6.3 | 2026-06-29 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /appointmentapproval.php of the comp… |
CVE-2026-49048 | Critical | 9.8 | 2026-06-28 | The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter in… |
CVE-2026-13498 | High | 7.3 | 2026-06-28 | A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unknown function of the file /forgotpassword.php of the compon… |
CVE-2026-13497 | Medium | 6.3 | 2026-06-28 | A vulnerability was determined in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /appointment.php. This m… |
CVE-2026-13496 | Medium | 6.3 | 2026-06-28 | A vulnerability was found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /ajaxmedicine.php. The manipu… |
CVE-2026-13495 | Medium | 4.7 | 2026-06-28 | A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminprofile.php. The manipulation… |
CVE-2026-13488 | High | 7.3 | 2026-06-28 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. Affected by this vulnerability is an unknown functionality o… |
CVE-2026-13487 | High | 7.3 | 2026-06-28 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive.php. The manipulat… |
CVE-2026-13486 | High | 7.3 | 2026-06-28 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This impacts an unknown function of the file /preview6.php. Execu… |
CVE-2026-13485 | High | 7.3 | 2026-06-28 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /preview.php. Performing a mani… |
CVE-2026-13333 | Medium | 6.5 | 2026-06-27 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via 'query[select]' Parameter in all ve… |
CVE-2026-13331 | Medium | 6.5 | 2026-06-27 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'search' parameter in all versi… |
CVE-2026-54350 | Critical | 10.0 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing M… |
CVE-2026-52785 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection in timestamps functionality. OpenProjec… |
CVE-2026-57667 | High | 8.5 | 2026-06-26 | Sales Representative SQL Injection in Groundhogg <= 4.5 versions. |
CVE-2026-57663 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions. |
CVE-2026-57662 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Contest Gallery <= 30.0.0 versions. |
CVE-2026-57653 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in WP Job Portal <= 2.5.2 versions. |
CVE-2026-57644 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions. |
CVE-2026-57643 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in WP Post Author <= 3.9.1 versions. |
CVE-2026-57642 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in Gallery <= 4.7.8 versions. |
CVE-2026-57636 | High | 8.5 | 2026-06-26 | Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. |
CVE-2026-57631 | High | 7.6 | 2026-06-26 | Administrator SQL Injection in Popup box <= 6.0.1 versions. |
CVE-2026-57628 | High | 7.6 | 2026-06-26 | Administrator SQL Injection in WP All Import <= 4.0.1 versions. |
CVE-2026-56070 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. |
CVE-2026-56068 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. |
CVE-2026-56067 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. |
CVE-2026-56064 | High | 8.5 | 2026-06-26 | Subscriber SQL Injection in Tourfic <= 2.22.5 versions. |
CVE-2026-56062 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. |
CVE-2026-56036 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. |
CVE-2026-56034 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. |
CVE-2026-54831 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. |
CVE-2026-54827 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. |
CVE-2026-54825 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. |
CVE-2026-54820 | Critical | 9.3 | 2026-06-26 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. |
CVE-2026-13226 | Medium | 6.5 | 2026-06-26 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' parameter in all versio… |
CVE-2026-40083 | High | 7.2 | 2026-06-25 | Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in man… |
CVE-2026-37149 | High | 7.7 | 2026-06-25 | GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerability in the scost parameter in /grocery/… |
CVE-2026-57588 | Low | 3.3 | 2026-06-25 | A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when imported by a privileged user, injects malicious SQ… |
CVE-2026-57587 | Medium | 5.3 | 2026-06-25 | A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL i… |
CVE-2026-54849 | Critical | 9.3 | 2026-06-25 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. |
CVE-2026-54843 | Critical | 9.3 | 2026-06-25 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. |
CVE-2026-54838 | High | 8.5 | 2026-06-25 | Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions. |
CVE-2026-54836 | Critical | 9.3 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC… |
CVE-2026-54829 | High | 7.5 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL I… |
CVE-2026-54822 | High | 8.5 | 2026-06-25 | Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions. |
CVE-2026-12937 | High | 7.5 | 2026-06-25 | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_… |
CVE-2026-2508 | Medium | 6.5 | 2026-06-25 | The Gravity Forms Booking plugin for WordPress is vulnerable to time-based SQL Injection via the ‘staff_id’ parameter in all versions up to, and including, 2.7… |
CVE-2026-12079 | Medium | 6.5 | 2026-06-25 | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and including, 5.0.4 due to ins… |
CVE-2026-12077 | High | 7.5 | 2026-06-25 | The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and inclu… |
CVE-2026-9786 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2026-9785 | High | 8.8 | 2026-06-25 | Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |