CWE-89
CVEs classified under CWE-89, newest first.
2342 CVEsRSS
CVE-2026-105845Critical· 9.8Payload is a free and open source headless content management system
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins …
CVE-2026-105921Medium· 6.3PoCA vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search_class.php. Such manipulation of the argument school_year leads …
CVE-2026-105920High· 7.3PoCA vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2
A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file student_signup.php of the component Student Registration En…
CVE-2026-105919High· 7.3PoCA vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoi…
CVE-2026-105918High· 7.3PoCA vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2
A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the…
CVE-2026-4889High· 7.8SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'
SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injecti…
CVE-2026-32557Critical· 9.3Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
CVE-2026-25434High· 8.5Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
CVE-2026-32580High· 7.5Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
CVE-2026-32581High· 7.1Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
CVE-2026-39747High· 8.5Subscriber SQL Injection in Woffice <= 5.4.35 versions.
Subscriber SQL Injection in Woffice <= 5.4.35 versions.
CVE-2026-39746Critical· 9.3Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions.
CVE-2026-39764Critical· 9.3Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
CVE-2026-39771High· 8.5Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions.
CVE-2026-39785Critical· 9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.2…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.2…
CVE-2026-39795Critical· 9.3Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.
Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.
CVE-2026-42415Critical· 9.3Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.
CVE-2026-41555Critical· 9.3Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.
CVE-2026-42416High· 8.5Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.
CVE-2026-42414High· 8.5Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
Subscriber SQL Injection in ListingPro <= 2.9.12 versions.
CVE-2026-42417Critical· 9.3Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.
CVE-2026-105317High· 8.5Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
CVE-2026-105807High· 7.3A vulnerability was found in SourceCodester Simple Student Information System 1.0
A vulnerability was found in SourceCodester Simple Student Information System 1.0. This affects an unknown part of the file searchquery.php. Performing a manipulation results in sql injection. The attack can be initiated remotely.
CVE-2026-105776High· 7.3PoCA flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4
A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php.…
CVE-2026-105472Medium· 6.3PoCA weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5
A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manip…
CVE-2026-105471High· 7.3PoCA security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5
A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipu…
CVE-2026-105470High· 7.3PoCA vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqli_query of the file locateus.php of the component Doctor Search Endpoint…
CVE-2026-105469High· 7.3PoCA vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5
A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file get_town.php of the component AJAX Endpoint. Executing a …
CVE-2026-105468High· 7.3PoCA vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5
A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file Admin/mlogin.php of the component Login Handler. Performing a m…
CVE-2026-103066High· 8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booki…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booki…