Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,087 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-39502 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. | |
CVE-2026-39511 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. | |
CVE-2026-39512 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. | |
CVE-2026-39519 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. | |
CVE-2026-39530 |
critical | 9.3 | 0.0030 | 2026-06-15 | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. | |
CVE-2026-40771 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. | |
CVE-2026-40798 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. | |
CVE-2026-42381 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. | |
CVE-2026-42386 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. | |
CVE-2026-42639 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. | |
CVE-2026-42665 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. | |
CVE-2026-45439 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | |
CVE-2026-48886 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. | |
CVE-2026-49067 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. | |
CVE-2026-49776 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatica | |
CVE-2026-52693 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. | |
CVE-2026-114358 |
critical | 9.3 | — | 2026-10-29 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user su | |
CVE-2026-39574 |
critical | 9.3 | 0.0023 | 2026-06-16 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
CVE-2026-49772 |
critical | 9.3 | 0.0194 | 2026-06-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-52715 |
critical | 9.3 | 0.0119 | 2026-06-16 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
CVE-2026-22332 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. | |
CVE-2026-22340 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. | |
CVE-2026-39438 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. | |
CVE-2026-39596 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | |
CVE-2026-48875 |
critical | 9.3 | 0.0042 | 2026-06-17 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. | |
CVE-2026-49076 |
critical | 9.3 | 0.0037 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-49079 |
critical | 9.3 | 0.0035 | 2026-06-17 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. | |
CVE-2026-49080 |
critical | 9.3 | 0.0031 | 2026-06-17 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | |
CVE-2026-49084 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. | |
CVE-2026-54186 |
critical | 9.3 | 0.0029 | 2026-06-17 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. | |
CVE-2026-54187 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. | |
CVE-2026-54811 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. | |
CVE-2026-54808 |
critical | 9.3 | 0.0031 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54809 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54815 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54819 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54812 |
critical | 9.3 | 0.0028 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-55740 |
critical | 9.3 | 0.0028 | 2026-06-18 | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) | |
CVE-2026-54419 |
critical | 9.3 | 0.0044 | 2026-06-18 | claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commi | |
CVE-2026-54836 |
critical | 9.3 | 0.0134 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54843 |
critical | 9.3 | 0.0040 | 2026-06-25 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. | |
CVE-2026-54849 |
critical | 9.3 | 0.0040 | 2026-06-25 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. | |
CVE-2026-54820 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | |
CVE-2026-54827 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. | |
CVE-2026-54831 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. | |
CVE-2026-56034 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. | |
CVE-2026-56036 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. | |
CVE-2026-56062 |
critical | 9.3 | 0.0144 | 2026-06-26 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. | |
CVE-2026-56067 |
critical | 9.3 | 0.0045 | 2026-06-26 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. | |
CVE-2026-56068 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. |