Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,100 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-33616 |
high | 7.5 | 0.0034 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability | |
CVE-2026-44446 |
high | 7.5 | 0.0027 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, | |
CVE-2026-44447 |
high | 7.5 | 0.0031 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints | |
CVE-2026-44635 |
high | 7.5 | 0.0036 | 2026-05-27 | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.vis | |
CVE-2026-11945 |
high | 7.5 | 0.0025 | 2026-06-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by cr | |
CVE-2026-40762 |
high | 7.5 | 0.0025 | 2026-06-15 | Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions. | |
CVE-2026-54829 |
high | 7.5 | 0.0032 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-11823 |
high | 7.5 | 0.0046 | 2026-07-01 | The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the | |
CVE-2026-8441 |
high | 7.5 | 0.0046 | 2026-07-02 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' p | |
CVE-2026-59834 |
high | 7.5 | 0.0048 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endp | |
CVE-2026-67579 |
high | 7.5 | 0.0061 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacke | |
CVE-2026-27538 |
high | 7.5 | 0.0032 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | |
CVE-2026-66622 |
high | 7.5 | 0.0032 | 2026-08-18 | Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions. | |
CVE-2026-110184 |
high | 7.5 | — | 2026-10-29 | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in a | |
CVE-2026-15081 |
high | 7.4 | 0.0034 | 2026-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2024-33288 |
high | 7.3 | 0.0092 | 2026-05-08 | Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via | |
CVE-2026-115418 |
high | 7.3 | 0.0017 | 2026-10-26 | SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud | |
CVE-2023-29154 |
high | 7.2 | 0.4144 | 2023-06-01 | SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user | |
CVE-2023-29095 |
high | 7.2 | 0.0090 | 2023-07-10 | Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plugin < 10.5.5 version | |
CVE-2026-39325 |
high | 7.2 | 0.0025 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability | |
CVE-2026-4112 |
high | 7.2 | 0.0061 | 2026-04-09 | Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SM | |
CVE-2026-40315 |
high | 7.2 | 0.0030 | 2026-04-14 | PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vuln | |
CVE-2026-40871 |
high | 7.2 | 0.0857 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026- | |
CVE-2026-44860 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-44861 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-44862 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-44863 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-44864 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-6888 |
high | 7.2 | 0.0037 | 2026-05-13 | Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attack | |
CVE-2026-40524 |
high | 7.2 | 0.0034 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() fu | |
CVE-2026-62238 |
high | 7.2 | 0.0050 | 2026-07-17 | OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint cross | |
CVE-2026-71292 |
high | 7.2 | 0.0057 | 2026-08-05 | Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admi | |
CVE-2026-23705 |
high | 7.2 | 0.0031 | 2026-10-13 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilit | |
CVE-2026-116218 |
high | 7.2 | 0.0027 | 2026-10-26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authentica | |
CVE-2026-11587 |
high | 7.2 | — | 2026-10-29 | SQL injection allowing an authenticated user with access to ACL management to read and modify the Ce | |
CVE-2026-116812 |
high | 7.1 | 0.0023 | 2026-10-27 | OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.servi | |
CVE-2026-116813 |
high | 7.1 | 0.0023 | 2026-10-27 | OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion th | |
CVE-2026-116821 |
high | 7.1 | 0.0028 | 2026-10-27 | YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpola | |
CVE-2026-33767 |
high | 7.1 | 0.0052 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, in `objects/like | |
CVE-2026-33770 |
high | 7.1 | 0.0050 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTit | |
CVE-2026-40482 |
high | 7.1 | 0.0031 | 2026-04-18 | ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in | |
CVE-2026-6833 |
high | 7.1 | 0.0028 | 2026-04-22 | The a+HRD developed by aEnrich has a SQL Injection vulnerability, allowing authenticated remote atta | |
CVE-2026-46445 |
high | 7.1 | 0.0024 | 2026-05-14 | SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. | |
CVE-2026-46446 |
high | 7.1 | 0.0024 | 2026-05-14 | SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows S | |
CVE-2026-42847 |
high | 7.1 | 0.0025 | 2026-05-14 | ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #122, there is a critical S | |
CVE-2026-48236 |
high | 7.1 | 0.0021 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the mu | |
CVE-2026-40831 |
high | 7.1 | 0.0032 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40832 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40833 |
high | 7.1 | 0.0022 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40834 |
high | 7.1 | 0.0022 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the |