CWE-89
CVEs classified under CWE-89, newest first.
2367 CVEsRSS
CVE-2026-82307Critical· 9.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.
CVE-2026-103117Medium· 4.7PoCA security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3
A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values lead…
CVE-2026-103115Medium· 6.3PoCA security flaw has been discovered in OS4ED openSIS-Classic up to 9.3
A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql inje…
CVE-2026-93621High· 8.2Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
CVE-2026-62085High· 7.6Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
CVE-2026-94115High· 8.5Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
CVE-2026-94082High· 7.6Author SQL Injection in Quiz Cat <= 3.1.1 versions.
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
CVE-2026-94177High· 8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.
CVE-2026-96346High· 7.6Author SQL Injection in WP ERP <= 1.17.9 versions.
Author SQL Injection in WP ERP <= 1.17.9 versions.
CVE-2026-96345High· 7.6Administrator SQL Injection in Estatik <= 4.3.5 versions.
Administrator SQL Injection in Estatik <= 4.3.5 versions.
CVE-2026-96822Critical· 9.3Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.
CVE-2026-96827High· 7.6Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.
CVE-2026-96828High· 7.6Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.
CVE-2026-97287High· 8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
CVE-2026-97293High· 8.5Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
CVE-2026-103116Medium· 6.3PoCA weakness has been identified in OS4ED openSIS-Classic up to 9.3
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes …
CVE-2026-103114Medium· 6.3PoCA vulnerability was identified in OS4ED openSIS-Classic up to 9.3
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of th…
CVE-2026-103113Medium· 4.7PoCA vulnerability was determined in OS4ED openSIS-Classic up to 9.3
A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argume…
CVE-2026-102456Medium· 6.5EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability
EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.
CVE-2026-102578Medium· 5.5PoCA flaw was found in Moodle
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This …
CVE-2026-16596Medium· 6.5The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of suf…
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of suf…
CVE-2026-6806High· 7.5The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping …
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping …
CVE-2026-102913High· 7.3PoCA security flaw has been discovered in SourceCodester Car Driving School Management System 1.0
A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enrollment. The manipulation results in sql injection. The attack can …
CVE-2026-102912Medium· 4.7PoCA vulnerability was identified in SourceCodester Online Leave Management System 1.0
A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date_start/date_end leads to sql injection…
CVE-2026-102910High· 7.3PoCA security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0
A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argum…
CVE-2026-102909High· 7.3PoCA vulnerability was identified in SourceCodester Online Reviewer Management System 1.0
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code…
CVE-2026-102908High· 7.3PoCA vulnerability was determined in SourceCodester Online Reviewer Management System 1.0
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the …
CVE-2026-51936Low· 2.1Zetetic SQLCipher before 4.15.0 allows SQL injection
Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted data…
CVE-2026-72510Critical· 9.0The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.
The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.
CVE-2026-63713Critical· 9.0The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.