CWE-89 · SQL Injection (page 8)
Page 8 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32593 | Medium | 5.9 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable t… |
CVE-2020-15878 | High | 8.8 | 2026-08-26 | An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via… |
CVE-2020-15876 | High | 8.8 | 2026-08-26 | An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via… |
CVE-2026-80236 | High | 8.2 | 2026-08-26 | Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and r… |
CVE-2026-9668 | Medium | 6.3 | 2026-08-26 | With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database querie… |
CVE-2026-18884 | High | 7.5 | 2026-08-26 | The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and incl… |
CVE-2026-77790 | Medium | 5.5 | 2026-08-26 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high priv… |
CVE-2026-19094 | Medium | 5.3 | 2026-08-26 | The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may l… |
CVE-2026-79845 | High | 7.3 | 2026-08-25 | A vulnerability was identified in code-projects Simple Inventory System 1.0. This vulnerability affects unknown code of the file /InventoryManagement/edit.php… |
CVE-2026-79804 | High | 7.3 | 2026-08-25 | A vulnerability was found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. Affected by this issue is some unknown funct… |
CVE-2026-38468 | Medium | 4.3 | 2026-08-25 | A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remot… |
CVE-2026-38467 | Medium | 5.4 | 2026-08-25 | A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated… |
CVE-2026-75498 | High | 7.2 | 2026-08-25 | Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a craft… |
CVE-2026-75497 | High | 7.2 | 2026-08-25 | Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a craft… |
CVE-2026-78864 | Medium | 6.3 | 2026-08-25 | A vulnerability was determined in liketrek TREK up to 3.0.22. The affected element is the function journeyService.updateEntry of the file server/src/nest/journ… |
CVE-2026-77824 | Medium | 4.9 | 2026-08-25 | The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and inc… |
CVE-2026-19949 | High | 8.8 | 2026-08-25 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and includi… |
CVE-2026-77137 | | 2026-08-25 | The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL th… | |
CVE-2026-78656 | Medium | 6.3 | 2026-08-25 | A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of… |
CVE-2026-78470 | Medium | 6.5 | 2026-08-25 | The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the… |
CVE-2026-15023 | Medium | 6.5 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to generic SQL Injection via Stored 'meta_key' via Event/Locatio… |
CVE-2026-32555 | Critical | 9.3 | 2026-08-24 | Unauthenticated SQL Injection in Boost <= 2.0.4 versions. |
CVE-2026-32554 | Critical | 9.3 | 2026-08-24 | Unauthenticated SQL Injection in WooBeWoo Product Filter Pro <= 3.1.8 versions. |
CVE-2026-77635 | | 2026-08-24 | CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue()… | |
CVE-2026-78248 | High | 7.3 | 2026-08-24 | A vulnerability was determined in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/ajax.php?action… |
CVE-2026-78247 | High | 7.3 | 2026-08-24 | A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?… |
CVE-2026-78270 | High | 7.6 | 2026-08-24 | Author SQL Injection in FluentCRM Pro <= 3.1.12 versions. |
CVE-2026-78246 | High | 7.3 | 2026-08-24 | A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of th… |
CVE-2026-32551 | Critical | 9.3 | 2026-08-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue… |
CVE-2026-32478 | High | 8.5 | 2026-08-24 | Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions. |
CVE-2026-32471 | High | 8.5 | 2026-08-24 | Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions. |
CVE-2026-78244 | High | 7.3 | 2026-08-24 | A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Pe… |
CVE-2026-78317 | High | 8.8 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. |
CVE-2026-78316 | High | 8.8 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. |
CVE-2026-78315 | High | 8.8 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. |
CVE-2026-78314 | High | 8.8 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. |
CVE-2026-77994 | | 2026-08-24 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection… | |
CVE-2026-78201 | High | 7.3 | 2026-08-24 | A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of… |
CVE-2026-78200 | Medium | 6.3 | 2026-08-24 | A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipul… |
CVE-2026-78199 | High | 7.3 | 2026-08-24 | A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view_prod.php. Performi… |
CVE-2026-78198 | High | 7.3 | 2026-08-24 | A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fo… |
CVE-2026-78197 | High | 7.3 | 2026-08-24 | A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /fos/admin/ajax.ph… |
CVE-2026-78185 | Medium | 6.3 | 2026-08-24 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The… |
CVE-2026-78182 | High | 7.3 | 2026-08-24 | A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected elem… |
CVE-2026-78171 | High | 7.3 | 2026-08-24 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/pr… |
CVE-2026-78143 | High | 7.3 | 2026-08-23 | A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of… |
CVE-2026-78112 | Medium | 6.3 | 2026-08-23 | A flaw has been found in itsourcecode Hospital Management System Project in PHP 1.0. This impacts an unknown function of the file /viewservicetype.php. This ma… |
CVE-2026-78057 | Medium | 6.3 | 2026-08-23 | A flaw has been found in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This affects an unknown part of the component Mana… |
CVE-2026-78056 | Medium | 6.3 | 2026-08-23 | A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is some unknown func… |
CVE-2026-76602 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without v… | |
CVE-2026-76571 | | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2 - The condition parameter passed to a list… | |
CVE-2026-76904 | Critical | 9.8 | 2026-08-21 | GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL In… |
CVE-2026-53572 | Medium | 5.9 | 2026-08-21 | KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constructs libpq-style connection strings from… |
CVE-2026-76613 | | 2026-08-21 | Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to… | |
CVE-2026-16959 | Medium | 6.8 | 2026-08-21 | The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it into a SQL query in one of its media-libr… |
CVE-2026-14601 | Medium | 6.8 | 2026-08-21 | The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in a SQL query, allowing authenticated us… |
CVE-2026-77392 | Medium | 6.3 | 2026-08-21 | A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /pu… |
CVE-2026-68789 | Critical | 9.9 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges… |
CVE-2026-68782 | Critical | 9.9 | 2026-08-20 | Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges… |
CVE-2026-46682 | High | 8.5 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and user… |
CVE-2026-77025 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentpending.php. This manip… |
CVE-2026-77020 | High | 7.3 | 2026-08-20 | A vulnerability was identified in CodeAstro Apartment Visitor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file pas… |
CVE-2026-77019 | High | 7.3 | 2026-08-20 | A vulnerability was determined in CodeAstro Apartment Visitor Management System 1.0. Affected is an unknown function of the file /apartment-visitor/forgotpw.ph… |
CVE-2026-76998 | High | 7.3 | 2026-08-20 | A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /a… |
CVE-2026-76997 | Medium | 6.3 | 2026-08-20 | A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.ph… |
CVE-2026-63039 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the stri… |
CVE-2026-63038 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrar… |
CVE-2026-63037 | Critical | 9.8 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the… |
CVE-2026-76996 | High | 7.3 | 2026-08-20 | A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order… |
CVE-2026-76991 | Medium | 6.3 | 2026-08-20 | A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a m… |
CVE-2026-76990 | High | 7.3 | 2026-08-20 | A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such… |
CVE-2026-76635 | High | 7.2 | 2026-08-20 | baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled ta… |
CVE-2026-74011 | High | 7.6 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. Th… |
CVE-2026-77071 | Critical | 9.8 | 2026-08-20 | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and Update operations… |
CVE-2026-74013 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. |
CVE-2026-73998 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. |
CVE-2026-68566 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. |
CVE-2026-66680 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. |
CVE-2026-66649 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. |
CVE-2026-66609 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. |
CVE-2026-66594 | High | 8.5 | 2026-08-20 | Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions. |
CVE-2026-66593 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Security & Malware scan by CleanTalk <= 2.184 versions. |
CVE-2026-66592 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 versions. |
CVE-2025-15688 | Critical | 9.3 | 2026-08-20 | Unauthenticated SQL Injection in Capella <= 2.5.5 versions. |
CVE-2026-76785 | Medium | 6.3 | 2026-08-20 | A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file appli… |
CVE-2026-76783 | High | 7.3 | 2026-08-20 | A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulatio… |
CVE-2026-76764 | High | 7.3 | 2026-08-20 | A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the com… |
CVE-2026-76762 | High | 7.3 | 2026-08-20 | A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation… |
CVE-2026-76364 | Medium | 6.5 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds the "Automation Engineer" Splunk SOAR role could run arbitrary Structured Query Language (SQL) statements… |
CVE-2026-76343 | Medium | 6.5 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could execute attacker-cho… |
CVE-2026-76309 | Medium | 4.3 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the "admin" or "power" Splunk roles could inje… |
CVE-2026-76574 | High | 7.3 | 2026-08-19 | A flaw has been found in code-projects Hospital Information System 1.0. The impacted element is the function User::login of the file includes/users/UsersContro… |
CVE-2026-71867 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property… | |
CVE-2026-71866 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a… | |
CVE-2026-61518 | High | 8.8 | 2026-08-19 | ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concaten… |
CVE-2026-49392 | Medium | 5.3 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile() and DB::se… |
CVE-2026-20327 | Medium | 6.5 | 2026-08-19 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL… |
CVE-2026-20030 | Critical | 10.0 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-75954 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2… | |
CVE-2026-71176 | High | 8.8 | 2026-08-19 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi… |