Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,090 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-56068 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. | |
CVE-2026-56070 |
critical | 9.3 | 0.0144 | 2026-06-26 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. | |
CVE-2026-53690 |
critical | 9.3 | 0.0051 | 2026-06-30 | An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in t | |
CVE-2026-57517 |
critical | 9.3 | 0.0096 | 2026-07-01 | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthe | |
CVE-2026-34099 |
critical | 9.3 | 0.0063 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_i | |
CVE-2026-57679 |
critical | 9.3 | 0.0040 | 2026-07-02 | Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions. | |
CVE-2026-57683 |
critical | 9.3 | 0.0040 | 2026-07-02 | Unauthenticated SQL Injection in WP Fast Total Search <= 1.80.280 versions. | |
CVE-2026-57702 |
critical | 9.3 | 0.0045 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-57707 |
critical | 9.3 | 0.0040 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-57726 |
critical | 9.3 | 0.0040 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-57739 |
critical | 9.3 | 0.0040 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-59515 |
critical | 9.3 | 0.0040 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-9586 |
critical | 9.3 | 0.1898 | 2026-07-17 | KEV | Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote atta |
CVE-2026-57309 |
critical | 9.3 | 0.0053 | 2026-07-20 | A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attac | |
CVE-2026-59514 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. | |
CVE-2026-59525 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | |
CVE-2026-59526 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
CVE-2026-61948 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | |
CVE-2026-61950 |
critical | 9.3 | 0.0040 | 2026-07-23 | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | |
CVE-2026-65761 |
critical | 9.3 | 0.0104 | 2026-07-23 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0. | |
CVE-2026-63359 |
critical | 9.3 | 0.0075 | 2026-07-23 | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an | |
CVE-2026-59527 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
CVE-2026-59533 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. | |
CVE-2026-59538 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. | |
CVE-2026-59549 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. | |
CVE-2026-59550 |
critical | 9.3 | 0.0040 | 2026-07-27 | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. | |
CVE-2026-16462 |
critical | 9.3 | 0.0075 | 2026-07-28 | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unaut | |
CVE-2026-65321 |
critical | 9.3 | 0.0077 | 2026-08-02 | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attacker | |
CVE-2026-65508 |
critical | 9.3 | 0.0040 | 2026-08-06 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. | |
CVE-2026-65520 |
critical | 9.3 | 0.0040 | 2026-08-06 | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | |
CVE-2026-65546 |
critical | 9.3 | 0.0040 | 2026-08-06 | Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | |
CVE-2026-66447 |
critical | 9.3 | 0.0040 | 2026-08-06 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. | |
CVE-2026-63106 |
critical | 9.3 | 0.0050 | 2026-08-10 | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product l | |
CVE-2026-19425 |
critical | 9.3 | 0.0064 | 2026-08-11 | Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability | |
CVE-2026-66659 |
critical | 9.3 | 0.0040 | 2026-08-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-28001 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | |
CVE-2026-28142 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | |
CVE-2026-61966 |
critical | 9.3 | 0.0040 | 2026-08-13 | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. | |
CVE-2026-61969 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. | |
CVE-2026-66436 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. | |
CVE-2026-66472 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | |
CVE-2026-66478 |
critical | 9.3 | 0.0040 | 2026-08-13 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | |
CVE-2026-74254 |
critical | 9.3 | 0.0039 | 2026-08-17 | Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Pag | |
CVE-2026-73187 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. | |
CVE-2026-73339 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | |
CVE-2026-73355 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions. | |
CVE-2026-73365 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. | |
CVE-2026-74015 |
critical | 9.3 | 0.0040 | 2026-08-18 | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | |
CVE-2026-66592 |
critical | 9.3 | 0.0040 | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-76571 |
critical | 9.3 | 0.0042 | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter i |