CWE-89
CVEs classified under CWE-89, newest first.
2367 CVEsRSS
CVE-2026-93899Medium· 6.5The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficie…
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficie…
CVE-2026-13016Critical· 9.3ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform
ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the…
CVE-2026-97321Medium· 6.3PoCA vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08
A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/serv…
CVE-2026-56738High· 8.5phpMyFAQ is an open source FAQ web application
phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string withou…
CVE-2026-77874High· 8.6IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to vie…
CVE-2026-78311High· 8.8SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
CVE-2026-78309High· 8.8SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
CVE-2026-96803High· 7.3PoCA vulnerability was identified in java110 MicroCommunity up to 2.0
A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql …
CVE-2026-96777Medium· 6.3PoCA vulnerability was determined in Forma LMS up to 4.1.43
A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endp…
CVE-2026-96751High· 7.3PoCA vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2
A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings l…
CVE-2026-47132Medium· 5.4PoCphpMyFAQ is an open source FAQ web application
phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search …
CVE-2026-96604High· 7.3PoCA vulnerability was identified in SoftNews Media Group DataLife Engine 18.0
A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql i…
CVE-2026-96601High· 7.3PoCA vulnerability was detected in Abdurrab5 online-makeup-store
A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack…
CVE-2026-96602High· 7.3PoCA flaw has been found in Abdurrab5 online-makeup-store
A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. Th…
CVE-2026-96826High· 7.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.
CVE-2026-90902High· 8.6Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdat…
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdat…
CVE-2026-90901High· 8.6Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) …
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) …
CVE-2026-93527High· 8.5Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
CVE-2026-93773High· 8.5Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
CVE-2026-94124High· 8.5Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.
Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.
CVE-2026-94174High· 7.6Administrator SQL Injection in Email Log <= 2.63 versions.
Administrator SQL Injection in Email Log <= 2.63 versions.
CVE-2026-95522High· 7.6Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.
CVE-2026-95590High· 7.1Subscriber SQL Injection in Tainacan <= 1.2.0 versions.
Subscriber SQL Injection in Tainacan <= 1.2.0 versions.
CVE-2026-95593High· 7.6Editor SQL Injection in Ultimeter <= 3.0.8 versions.
Editor SQL Injection in Ultimeter <= 3.0.8 versions.
CVE-2026-95601Critical· 9.3Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.
CVE-2026-92692Medium· 6.9Sulu is an open-source PHP content management system based on the Symfony framework
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/Quer…
CVE-2026-96514High· 7.3PoCA weakness has been identified in Neethuharii CafeManagement
A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to…
CVE-2025-63564Critical· 9.8SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests
CVE-2026-96673High· 7.5PoCPhotoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment
Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in th…
CVE-2026-18180Medium· 6.5IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection.