Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,100 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-40835 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40836 |
high | 7.1 | 0.0022 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40837 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40838 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40839 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40840 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40841 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40842 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40843 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40844 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40845 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40846 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40847 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40848 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40849 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-56221 |
high | 7.1 | 0.0034 | 2026-06-22 | Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-c | |
CVE-2026-40522 |
high | 7.1 | 0.0023 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report ha | |
CVE-2026-11321 |
high | 7.1 | 0.0042 | 2026-07-10 | The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field value | |
CVE-2026-64880 |
high | 7.1 | 0.0032 | 2026-07-21 | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL que | |
CVE-2026-65494 |
high | 7.1 | 0.0029 | 2026-07-23 | Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. | |
CVE-2026-12895 |
high | 7.1 | 0.0037 | 2026-07-29 | SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application co | |
CVE-2026-15929 |
high | 7.1 | 0.0027 | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-18737 |
high | 7.1 | 0.0040 | 2026-08-03 | Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to | |
CVE-2026-71276 |
high | 7.1 | 0.0032 | 2026-08-05 | Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (reade | |
CVE-2026-72607 |
high | 7.1 | 0.0045 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allo | |
CVE-2026-72609 |
high | 7.1 | 0.0037 | 2026-08-11 | An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows aut | |
CVE-2026-73331 |
high | 7.1 | 0.0036 | 2026-08-12 | CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated at | |
CVE-2026-73345 |
high | 7.1 | 0.0029 | 2026-08-18 | Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions. | |
CVE-2026-114664 |
high | 7.1 | 0.0020 | 2026-10-22 | Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doct | |
CVE-2026-115191 |
high | 7.1 | 0.0035 | 2026-10-26 | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration | |
CVE-2026-115192 |
high | 7.1 | 0.0035 | 2026-10-26 | An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). | |
CVE-2026-116807 |
high | 7.0 | 0.0027 | 2026-10-27 | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to by | |
CVE-2026-57190 |
high | 7.0 | 0.0068 | 2026-10-27 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, | |
CVE-2026-40823 |
high | 7.0 | 0.0024 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40824 |
high | 7.0 | 0.0024 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40825 |
high | 7.0 | 0.0024 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40827 |
high | 7.0 | 0.0029 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40828 |
high | 7.0 | 0.0029 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40829 |
high | 7.0 | 0.0029 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40830 |
high | 7.0 | 0.0029 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-69704 |
high | 7.0 | 0.0033 | 2026-08-04 | Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database quer | |
CVE-2026-114243 |
medium | 6.9 | 0.0033 | 2026-10-21 | A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e | |
CVE-2026-114255 |
medium | 6.9 | 0.0027 | 2026-10-21 | A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df | |
CVE-2026-114256 |
medium | 6.9 | 0.0027 | 2026-10-21 | A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f | |
CVE-2026-114258 |
medium | 6.9 | 0.0034 | 2026-10-21 | A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f54 | |
CVE-2026-114440 |
medium | 6.9 | 0.0034 | 2026-10-21 | A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part o | |
CVE-2026-114577 |
medium | 6.9 | 0.0034 | 2026-10-22 | A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown | |
CVE-2026-116828 |
medium | 6.9 | 0.0025 | 2026-10-27 | YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter i | |
CVE-2026-117515 |
medium | 6.9 | 0.0041 | 2026-10-27 | A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae | |
CVE-2026-5147 |
medium | 6.9 | 0.0035 | 2026-03-30 | A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown par |