Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,091 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-76602 |
critical | 9.3 | 0.0039 | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The | |
CVE-2026-77994 |
critical | 9.3 | 0.0039 | 2026-08-24 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla | |
CVE-2026-112327 |
critical | 9.3 | 0.0033 | 2026-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-112860 |
critical | 9.3 | 0.0032 | 2026-10-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-111402 |
critical | 9.3 | 0.0035 | 2026-10-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-112866 |
critical | 9.3 | 0.0036 | 2026-10-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-115964 |
critical | 9.3 | — | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-56292 |
critical | 9.2 | 0.0138 | 2026-07-09 | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnera | |
CVE-2026-58492 |
critical | 9.2 | 0.0053 | 2026-07-10 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists metho | |
CVE-2026-15183 |
critical | 9.2 | 0.0031 | 2026-07-14 | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) version | |
CVE-2026-65766 |
critical | 9.2 | 0.0040 | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Impr | |
CVE-2026-65876 |
critical | 9.2 | 0.0039 | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Impr | |
CVE-2026-65890 |
critical | 9.2 | 0.0050 | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi v | |
CVE-2026-73332 |
critical | 9.2 | 0.0042 | 2026-08-12 | CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin tha | |
CVE-2026-115324 |
critical | 9.2 | 0.0032 | 2026-10-22 | mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.p | |
CVE-2026-104354 |
critical | 9.1 | 0.0050 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-105779 |
critical | 9.1 | 0.0029 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-14571 |
critical | 9.1 | 0.0025 | 2026-10-28 | A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of a | |
CVE-2026-34374 |
critical | 9.1 | 0.0036 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedu | |
CVE-2026-33615 |
critical | 9.1 | 0.0042 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40887 |
critical | 9.1 | 0.0176 | 2026-04-21 | Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to version | |
CVE-2026-41167 |
critical | 9.1 | 0.0064 | 2026-04-22 | Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple A | |
CVE-2026-27851 |
critical | 9.1 | 0.0041 | 2026-05-12 | When safe filter is used with variable expansion, all following pipelines on the same string are inc | |
CVE-2026-63229 |
critical | 9.1 | 0.0052 | 2026-07-29 | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated att | |
CVE-2026-63230 |
critical | 9.1 | 0.0052 | 2026-07-29 | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticat | |
CVE-2026-34191 |
critical | 9.1 | 0.0059 | 2026-08-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-73069 |
critical | 9.1 | 0.0066 | 2026-08-11 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty al | |
CVE-2026-51346 |
critical | 9.1 | 0.0070 | 2026-08-17 | SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote att | |
CVE-2026-106076 |
critical | 9.0 | 0.0037 | 2026-10-27 | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configur | |
CVE-2026-50736 |
critical | 9.0 | 0.0041 | 2026-07-28 | The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a pub | |
CVE-2026-48381 |
critical | 9.0 | 0.0078 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-44792 |
high | 8.9 | 0.0039 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attack | |
CVE-2023-49440 |
high | 8.8 | 0.0032 | 2025-10-27 | AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." | |
CVE-2022-51023 |
high | 8.8 | 0.0026 | 2026-10-22 | PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated att | |
CVE-2024-58393 |
high | 8.8 | 0.0027 | 2026-10-22 | i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerab | |
CVE-2025-71434 |
high | 8.8 | 0.0032 | 2026-10-22 | Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerab | |
CVE-2026-116818 |
high | 8.8 | 0.0043 | 2026-10-27 | OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allow | |
CVE-2026-47295 |
high | 8.8 | 0.0099 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a | |
CVE-2026-88075 |
high | 8.8 | 0.0083 | 2026-10-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Co | |
CVE-2026-70266 |
high | 8.8 | 0.0108 | 2026-10-13 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Of | |
CVE-2023-22794 |
high | 8.8 | 0.0215 | 2023-02-09 | A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comme | |
CVE-2023-27463 |
high | 8.8 | 0.0080 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The audit log form | |
CVE-2023-28663 |
high | 8.8 | 0.0093 | 2023-03-22 | The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injecti | |
CVE-2026-33755 |
high | 8.8 | 0.0039 | 2026-03-27 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions | |
CVE-2026-33991 |
high | 8.8 | 0.0040 | 2026-03-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sis | |
CVE-2026-28805 |
high | 8.8 | 0.0046 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior t | |
CVE-2026-35168 |
high | 8.8 | 0.0067 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior t | |
CVE-2026-29047 |
high | 8.8 | 0.0039 | 2026-04-06 | GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, a | |
CVE-2026-39318 |
high | 8.8 | 0.0034 | 2026-04-07 | ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection | |
CVE-2026-39319 |
high | 8.8 | 0.0024 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection v |