Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,100 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-21630 |
medium | 6.9 | 0.0035 | 2026-04-01 | Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endp | |
CVE-2026-41457 |
medium | 6.9 | 0.0027 | 2026-04-22 | OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and fi | |
CVE-2026-7002 |
medium | 6.9 | 0.0025 | 2026-04-25 | A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects un | |
CVE-2026-7727 |
medium | 6.9 | 0.0026 | 2026-05-04 | A vulnerability was determined in Shandong Hoteam Software PDM Product Data Management System up to | |
CVE-2026-40821 |
medium | 6.9 | 0.0028 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40822 |
medium | 6.9 | 0.0028 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40826 |
medium | 6.9 | 0.0028 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-44172 |
medium | 6.9 | 0.0104 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an appli | |
CVE-2026-58521 |
medium | 6.9 | 0.0055 | 2026-07-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-14363 |
medium | 6.9 | 0.0052 | 2026-07-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-14649 |
medium | 6.9 | 0.0032 | 2026-07-04 | A vulnerability was detected in code-projects Online Voting System 1.0. Impacted is the function tes | |
CVE-2026-14747 |
medium | 6.9 | 0.0032 | 2026-07-05 | A vulnerability was detected in code-projects Real State Services 1.0. Affected by this vulnerabilit | |
CVE-2026-15498 |
medium | 6.9 | 0.0041 | 2026-07-12 | A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa | |
CVE-2026-115999 |
medium | 6.9 | 0.0026 | 2026-10-25 | A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. A | |
CVE-2026-116049 |
medium | 6.9 | 0.0025 | 2026-10-25 | A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae35 | |
CVE-2026-116170 |
medium | 6.9 | 0.0036 | 2026-10-25 | SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read | |
CVE-2026-116060 |
medium | 6.9 | 0.0027 | 2026-10-25 | A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an u | |
CVE-2026-104694 |
medium | 6.8 | 0.0030 | 2026-10-28 | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter' | |
CVE-2026-111027 |
medium | 6.8 | 0.0030 | 2026-10-28 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly sanitise and escape a parame | |
CVE-2026-115281 |
medium | 6.8 | 0.0030 | 2026-10-28 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and sho | |
CVE-2026-39809 |
medium | 6.7 | 0.0013 | 2026-04-14 | A improper neutralization of special elements used in an sql command ('sql injection') vulnerability | |
CVE-2025-60542 |
medium | 6.5 | 0.0027 | 2025-10-29 | SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repos | |
CVE-2024-44632 |
medium | 6.5 | 0.0026 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid paramete | |
CVE-2024-44636 |
medium | 6.5 | 0.0021 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid | |
CVE-2024-44639 |
medium | 6.5 | 0.0026 | 2025-11-14 | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, | |
CVE-2024-55016 |
medium | 6.5 | 0.0026 | 2025-11-14 | PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and passw | |
CVE-2024-44648 |
medium | 6.5 | 0.0026 | 2025-11-17 | PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark parameters in quote-d | |
CVE-2024-44652 |
medium | 6.5 | 0.0026 | 2025-11-17 | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email, username, user_fi | |
CVE-2024-44653 |
medium | 6.5 | 0.0026 | 2025-11-17 | Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_email parameter in user_ | |
CVE-2024-44662 |
medium | 6.5 | 0.0026 | 2025-11-17 | PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the username parameter in t | |
CVE-2024-39037 |
medium | 6.5 | 0.0024 | 2025-12-24 | MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injection vulnerability via | |
CVE-2026-108308 |
medium | 6.5 | 0.0035 | 2026-10-27 | Tanium addressed a SQL injection vulnerability in Patch. | |
CVE-2026-116609 |
medium | 6.5 | 0.0034 | 2026-10-28 | The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection vi | |
CVE-2026-116750 |
medium | 6.5 | 0.0026 | 2026-10-28 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to blind SQL Injectio | |
CVE-2026-76005 |
medium | 6.5 | 0.0028 | 2026-10-28 | The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_or | |
CVE-2026-20061 |
medium | 6.5 | 0.0023 | 2026-04-15 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authe | |
CVE-2026-41320 |
medium | 6.5 | 0.0022 | 2026-04-21 | Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 an | |
CVE-2026-54310 |
medium | 6.5 | 0.0054 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated use | |
CVE-2026-54313 |
medium | 6.5 | 0.0034 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with work | |
CVE-2026-13242 |
medium | 6.5 | 0.0028 | 2026-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-49004 |
medium | 6.5 | 0.0120 | 2026-08-05 | The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command | |
CVE-2026-72908 |
medium | 6.5 | 0.0051 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, | |
CVE-2026-72608 |
medium | 6.5 | 0.0038 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allo | |
CVE-2026-17419 |
medium | 6.5 | 0.0042 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to | |
CVE-2026-118192 |
medium | 6.5 | 0.0044 | 2026-10-29 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerabl | |
CVE-2026-23706 |
medium | 6.5 | 0.0034 | 2026-10-13 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilit | |
CVE-2026-87936 |
medium | 6.5 | 0.0027 | 2026-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-118698 |
medium | 6.5 | — | 2026-10-30 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerabl | |
CVE-2026-5372 |
medium | 6.4 | 0.0020 | 2026-04-07 | An issue that allowed a SQL injection attack vector related to saved queries (introduced in version | |
CVE-2026-3346 |
medium | 6.4 | 0.0016 | 2026-04-30 | IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This |