CWE-89 · SQL Injection (page 9)

Page 9 of 100 — CVEs classified under CWE-89, newest first, with CVSS severity and publication dates.

All CVEs classified under CWE-89 — newest first (page 9 of 100)
CVESeverityScorePublishedSummary
CVE-2026-762402026-08-19stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is…
CVE-2026-76205High8.12026-08-19phpMyFAQ before 4.1.7 contains a SQL injection vulnerability in the glossary create and update endpoints caused by truncating an escaped string before embeddin…
CVE-2026-748042026-08-19Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated in…
CVE-2026-70422High8.12026-08-19Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi…
CVE-2026-56088High7.12026-08-19Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi…
CVE-2026-51366Critical9.92026-08-19SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and…
CVE-2026-16019Critical9.82026-08-19Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Faydam Innovation Inc. FAYDAM Datalogger allows SQL Injec…
CVE-2026-73391Critical9.32026-08-19Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
CVE-2026-73388Critical9.32026-08-19Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.
CVE-2026-73185Critical9.32026-08-19Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
CVE-2026-73183Critical9.32026-08-19Unauthenticated SQL Injection in Maps Marker Pro <= 4.32 versions.
CVE-2026-66668High8.52026-08-19Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.
CVE-2026-32552High8.52026-08-19Subscriber SQL Injection in YITH WooCommerce Membership Premium <= 2.33.0 versions.
CVE-2026-16950High8.62026-08-19The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthentic…
CVE-2026-12983High8.62026-08-19The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated users to perform SQL…
CVE-2026-76050High7.32026-08-19A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete_…
CVE-2026-76049High7.32026-08-19A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=sa…
CVE-2026-76048High7.32026-08-19A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=…
CVE-2026-75986High7.32026-08-19A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the compo…
CVE-2026-54348High7.22026-08-18Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept…
CVE-2026-75876Medium6.32026-08-18A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file Mo…
CVE-2026-47720Medium5.32026-08-18FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in serve…
CVE-2026-74015Critical9.32026-08-18Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
CVE-2026-73365Critical9.32026-08-18Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
CVE-2026-73355Critical9.32026-08-18Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.
CVE-2026-73345High7.12026-08-18Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.
CVE-2026-73339Critical9.32026-08-18Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.
CVE-2026-73187Critical9.32026-08-18Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.
CVE-2026-66622High7.52026-08-18Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.
CVE-2026-32466High8.52026-08-18Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.
CVE-2026-75778High7.32026-08-18A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /in…
CVE-2026-75089High7.32026-08-18A weakness has been identified in PHPGurukul Complaint Management System 1.0. Affected by this issue is some unknown functionality of the file user/check_avail…
CVE-2026-75088Medium6.32026-08-18A vulnerability was determined in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewbilling.php. Executing a manip…
CVE-2026-75087Medium6.32026-08-18A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /viewdepartment.php. Performing a manipu…
CVE-2026-75086Medium6.32026-08-18A vulnerability has been found in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewroom.php. Such mani…
CVE-2026-75080High7.32026-08-18A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edi…
CVE-2026-75079High7.32026-08-18A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_subject2.php…
CVE-2026-67854Critical9.82026-08-17SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code
CVE-2026-67917Critical9.82026-08-17zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command execute…
CVE-2026-65822High7.62026-08-17ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactive_customers/inactive_customer…
CVE-2026-64657High8.42026-08-17Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolate…
CVE-2026-75014High7.32026-08-17A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/get_barcode_data.php…
CVE-2026-742542026-08-17Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related…
CVE-2026-51346Critical9.12026-08-17SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive inform…
CVE-2026-50769Critical9.82026-08-17The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection (time-based) vulnerability. The check conflict endpo…
CVE-2026-20000Medium6.32026-08-17A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.ph…
CVE-2026-156232026-08-17A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform…
CVE-2026-19973Medium6.32026-08-17A vulnerability was found in itsourcecode Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewpaymentre…
CVE-2026-19972Medium6.32026-08-17A vulnerability has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewpatient.php. Such manipulation…
CVE-2026-742512026-08-16Joomla Extension - phoca.cz - Unauthenticated SQL injection via attribute filter in Phoca Cart 5.0.0-6.1.6 - The a[] (attribute) and s[] (specification) GET a…
CVE-2026-2497High7.22026-08-16The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, a…
CVE-2026-9767Medium6.52026-08-16The The School Management – Education & Learning ERP plugin for WordPress is vulnerable to generic SQL Injection via 'order[0][dir]' Parameter in all versions…
CVE-2026-2283Medium4.92026-08-16The User Login History plugin for WordPress is vulnerable to SQL Injection via the 'blog_id' parameter in all versions up to, and including, 2.1.7. This is due…
CVE-2026-19934Medium6.32026-08-16A vulnerability has been found in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /vieworder.php. The manipulation of…
CVE-2026-18653High7.22026-08-16The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perf…
CVE-2026-17582Medium4.92026-08-16The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() fu…
CVE-2026-15351Medium4.92026-08-16The WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors plugin for WordPress is vulnerable to generic SQL Injection via the 'status'…
CVE-2026-16079Medium6.52026-08-16The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including…
CVE-2026-15963Medium6.52026-08-16The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in…
CVE-2026-15602Medium4.92026-08-16The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all ve…
CVE-2026-19926High7.32026-08-16A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 o…
CVE-2026-19925Medium4.72026-08-16A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete…
CVE-2026-19923Medium6.32026-08-16A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkout_process.php. Executing a manipul…
CVE-2026-19921Medium6.32026-08-16A vulnerability was identified in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /homeaction…
CVE-2026-19920Medium6.32026-08-16A vulnerability was determined in code-projects Online Shopping System 1.0. Affected is an unknown function of the file /action.php. This manipulation of the a…
CVE-2026-19919High7.32026-08-16A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The mani…
CVE-2026-19917Medium6.32026-08-15A flaw has been found in code-projects Online Food Order System 1.0. The impacted element is an unknown function of the file delete_food_items1.php. Executing…
CVE-2026-19905High7.32026-08-15A weakness has been identified in Jinher OA 1.0. Impacted is an unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx. This man…
CVE-2026-19899High7.32026-08-15A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /edit_teacher.p…
CVE-2026-19894Medium6.32026-08-15A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewmedicine.php. Performing a…
CVE-2026-12248Medium6.52026-08-15The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to in…
CVE-2026-160072026-08-15AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrat…
CVE-2026-18387Medium6.52026-08-15The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'tag_query' parameter in all ve…
CVE-2026-16586Medium6.52026-08-15The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Second-Order SQL Injection via MultipleFiles…
CVE-2026-16146Medium4.92026-08-15The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Value…
CVE-2026-16094Medium4.92026-08-15The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via the 'key' parameter in…
CVE-2026-15993Medium5.32026-08-15The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via '{username}' Placehold…
CVE-2026-15453Medium6.52026-08-15The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versi…
CVE-2026-16080Medium6.52026-08-15The Image Uploader for Welcart plugin for WordPress is vulnerable to generic SQL Injection via the 'post_title' parameter in all versions up to, and including…
CVE-2026-15162High7.52026-08-15The Object Sync for Salesforce plugin is vulnerable to unauthenticated SQL Injection via the wordpress_object_type parameter of its /wp-json/object-sync-for-sa…
CVE-2026-715712026-08-14Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to…
CVE-2026-673652026-08-14Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda)…
CVE-2026-17227Medium5.42026-08-14IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special el…
CVE-2026-184032026-08-14LimeSurvey Community Edition 7.0.5 contains an authenticated SQL injection vulnerability in the Central Participant Database (CPDB) workflow that copies survey…
CVE-2026-738502026-08-14Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php.
CVE-2026-48528Critical9.82026-08-14Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated…
CVE-2026-19680High7.12026-08-14A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.
CVE-2026-19631Medium4.92026-08-14A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting…
CVE-2026-19825High7.32026-08-14A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /clas…
CVE-2026-72811Critical10.02026-08-14SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored bloc…
CVE-2026-16810Medium6.52026-08-14The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to generic SQL Injection via…
CVE-2026-15205High8.62026-08-14The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its publ…
CVE-2026-12743Medium4.92026-08-14The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' param…
CVE-2026-19787Medium4.72026-08-14A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_…
CVE-2026-19785Medium6.32026-08-14A vulnerability has been found in francoisjacquet RosarioSIS up to 12.7.4. This vulnerability affects unknown code of the file modules/Students/includes/Medica…
CVE-2026-19767Medium6.32026-08-14A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Ex…
CVE-2026-19764High7.32026-08-14A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/us…
CVE-2026-736632026-08-13FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From h…
CVE-2026-73408High7.62026-08-13Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped…
CVE-2026-72853High7.62026-08-13Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in id…