Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,087 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-4978 |
critical | 9.8 | 0.0047 | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-71207 |
critical | 9.8 | 0.0071 | 2026-08-05 | The Stock-Inventory-Management-System application's login.php assigns raw username/password values t | |
CVE-2026-71231 |
critical | 9.8 | 0.0066 | 2026-08-05 | IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM us | |
CVE-2026-5134 |
critical | 9.8 | 0.0048 | 2026-08-06 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-32227 |
critical | 9.8 | 0.0069 | 2026-08-10 | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recomme | |
CVE-2026-72565 |
critical | 9.8 | 0.0068 | 2026-08-10 | A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attacke | |
CVE-2026-72550 |
critical | 9.8 | 0.0061 | 2026-08-11 | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated re | |
CVE-2026-72599 |
critical | 9.8 | 0.0061 | 2026-08-11 | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbi | |
CVE-2026-73211 |
critical | 9.8 | 0.0073 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.upda | |
CVE-2026-17111 |
critical | 9.8 | 0.0045 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially c | |
CVE-2025-67066 |
critical | 9.8 | 0.0071 | 2026-09-04 | SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary | |
CVE-2025-55787 |
critical | 9.8 | 0.0047 | 2026-09-17 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. | |
CVE-2026-107081 |
critical | 9.8 | 0.0049 | 2026-10-19 | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJA | |
CVE-2026-79852 |
critical | 9.8 | 0.0064 | 2026-10-22 | A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote a | |
CVE-2026-79854 |
critical | 9.8 | 0.0064 | 2026-10-22 | A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker t | |
CVE-2026-103792 |
critical | 9.6 | — | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS20 | |
CVE-2026-42087 |
critical | 9.6 | 0.0032 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor | |
CVE-2026-34260 |
critical | 9.6 | 0.0047 | 2026-05-12 | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an a | |
CVE-2026-15062 |
critical | 9.6 | 0.0039 | 2026-07-08 | SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior | |
CVE-2026-23696 |
critical | 9.4 | 0.1358 | 2026-04-07 | Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the fo | |
CVE-2026-12045 |
critical | 9.4 | 0.0066 | 2026-06-19 | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence data | |
CVE-2026-17351 |
critical | 9.4 | 0.0048 | 2026-07-31 | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assist | |
CVE-2026-114625 |
critical | 9.4 | 0.0103 | 2026-10-22 | KEV | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote |
CVE-2024-58307 |
critical | 9.3 | 0.0051 | 2025-12-11 | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality | |
CVE-2026-100752 |
critical | 9.3 | 0.0032 | 2026-09-28 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7. | |
CVE-2026-101108 |
critical | 9.3 | 0.0032 | 2026-09-28 | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - | |
CVE-2026-39746 |
critical | 9.3 | 0.0037 | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-39795 |
critical | 9.3 | 0.0030 | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-102788 |
critical | 9.3 | 0.0039 | 2026-10-27 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store prod | |
CVE-2026-111411 |
critical | 9.3 | — | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-115607 |
critical | 9.3 | — | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-32557 |
critical | 9.3 | 0.0037 | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2025-58628 |
critical | 9.3 | 0.0031 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2025-48089 |
critical | 9.3 | 0.0036 | 2025-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-5963 |
critical | 9.3 | 0.0037 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remot | |
CVE-2026-5964 |
critical | 9.3 | 0.0037 | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remot | |
CVE-2026-6887 |
critical | 9.3 | 0.0036 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vul | |
CVE-2026-40797 |
critical | 9.3 | 0.0035 | 2026-05-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42208 |
critical | 9.3 | 0.8942 | 2026-05-08 | KEV | BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the |
CVE-2026-22599 |
critical | 9.3 | 0.0118 | 2026-05-14 | Strapi is an open source headless content management system. In versions on the 4.x branch prior to | |
CVE-2026-46364 |
critical | 9.3 | 0.0171 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::gar | |
CVE-2026-42727 |
critical | 9.3 | 0.0029 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42747 |
critical | 9.3 | 0.0024 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42755 |
critical | 9.3 | 0.0024 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42761 |
critical | 9.3 | 0.0023 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-39494 |
critical | 9.3 | 0.0039 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42647 |
critical | 9.3 | 0.0132 | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-39441 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. | |
CVE-2026-39492 |
critical | 9.3 | 0.0036 | 2026-06-15 | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. | |
CVE-2026-39493 |
critical | 9.3 | 0.0036 | 2026-06-15 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. |