CWE-89
CVEs classified under CWE-89, newest first.
2329 CVEsRSS
CVE-2026-76005Medium· 6.5WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack…
CVE-2026-118378High· 7.8PoCTabularis before 0.28.0 SQL Injection via MCP describe_table table_name
Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steer…
CVE-2026-57190High· 7.0Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `ce…
CVE-2026-117516High· 7.3PoCoretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/…
CVE-2026-87085Medium· 6.5Tanium addressed a SQL injection vulnerability in Provision.
Tanium addressed a SQL injection vulnerability in Provision.
CVE-2026-108308Medium· 6.5Tanium addressed a SQL injection vulnerability in Patch.
Tanium addressed a SQL injection vulnerability in Patch.
CVE-2026-117513High· 7.3PoCoretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection
A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_na…
CVE-2026-117514High· 7.3PoCoretnom23 php-travel-agency-system Admin Record Pages customer_detail.php sql injection
A vulnerability was identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/customer_detail.php of the component Admin Record Pages. The manipulation of the argument costomer_id/tick…
CVE-2026-105779Critical· 9.1Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage th…
CVE-2026-104354Critical· 9.1Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attack…
CVE-2026-105781Critical· 10.0Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attack…
CVE-2026-105489Critical· 9.9Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-pri…
CVE-2026-117515High· 7.3PoCoretnom23 php-travel-agency-system traceapplication.php sql injection
A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql …
CVE-2026-106076Critical· 9.0A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remo…
A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remo…
CVE-2026-65151High· 8.4NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue
NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure.
CVE-2026-102788Critical· 9.3Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPo…
CVE-2026-33944High· 8.8Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
CVE-2026-116515Medium· 6.3PoCitsourcecode Online Book Store book.php sql injection
A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to …
CVE-2026-116813Medium· 6.5OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can bre…
CVE-2026-116818High· 8.2OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and proj…
CVE-2026-116828Medium· 4.9PoCYesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform…
CVE-2026-116821Medium· 6.5PoCYesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %…
CVE-2026-116812Medium· 6.5PoCOpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter
OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.pr…
CVE-2026-116807Medium· 6.5PoCOpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a t…
CVE-2026-116808High· 7.2PoCOpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own…
CVE-2026-10757Critical· 9.8BUG-000187511 - ArcGIS Server has a security vulnerability.
There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may allow a remote attacker with privileges to access the service (which could, depending on the service being configured in…
CVE-2026-115418High· 7.3SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha
SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct pro…
CVE-2026-110733Medium· 5.4Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store
Vulnerability in the SQL storage module of Apache SIS. When sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafter sort clause could inject SQL in the query. This issue …
CVE-2026-115191High· 7.1A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax)
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a dat…
CVE-2026-115192High· 7.1An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type})
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboa…