Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:89"
1,092 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-39326 |
high | 8.8 | 0.0024 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability | |
CVE-2026-39327 |
high | 8.8 | 0.0024 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability | |
CVE-2026-39329 |
high | 8.8 | 0.0024 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability | |
CVE-2026-39330 |
high | 8.8 | 0.0024 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability | |
CVE-2026-39334 |
high | 8.8 | 0.0025 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability | |
CVE-2026-39815 |
high | 8.8 | 0.0036 | 2026-04-14 | A improper neutralization of special elements used in an sql command ('sql injection') vulnerability | |
CVE-2026-40285 |
high | 8.8 | 0.0032 | 2026-04-17 | WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection | |
CVE-2026-40978 |
high | 8.8 | 0.0034 | 2026-04-28 | SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitra | |
CVE-2026-8111 |
high | 8.8 | 0.0631 | 2026-05-12 | SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote | |
CVE-2026-25088 |
high | 8.8 | 0.0026 | 2026-05-12 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerabilit | |
CVE-2026-42550 |
high | 8.8 | 0.0046 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::up | |
CVE-2026-9617 |
high | 8.8 | 0.0025 | 2026-05-27 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by cr | |
CVE-2026-44521 |
high | 8.8 | 0.0024 | 2026-05-27 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1 | |
CVE-2026-45418 |
high | 8.8 | 0.0037 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authentic | |
CVE-2026-8443 |
high | 8.8 | 0.0034 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 's | |
CVE-2026-8444 |
high | 8.8 | 0.0035 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' | |
CVE-2017-20252 |
high | 8.8 | 0.0048 | 2026-06-19 | Joomla NextGen Editor 2.1.0 contains an SQL injection vulnerability that allows unauthenticated atta | |
CVE-2026-44271 |
high | 8.8 | 0.0044 | 2026-06-22 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of | |
CVE-2026-44272 |
high | 8.8 | 0.0044 | 2026-06-22 | Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of | |
CVE-2026-7570 |
high | 8.8 | 0.0095 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerab | |
CVE-2026-9781 |
high | 8.8 | 0.0095 | 2026-06-25 | Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerab | |
CVE-2026-9782 |
high | 8.8 | 0.0095 | 2026-06-25 | Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulner | |
CVE-2026-9783 |
high | 8.8 | 0.0095 | 2026-06-25 | Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vul | |
CVE-2026-9784 |
high | 8.8 | 0.0095 | 2026-06-25 | Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulner | |
CVE-2026-9785 |
high | 8.8 | 0.0095 | 2026-06-25 | Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulner | |
CVE-2026-9786 |
high | 8.8 | 0.0095 | 2026-06-25 | Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerab | |
CVE-2026-13744 |
high | 8.8 | 0.0046 | 2026-06-29 | Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allow | |
CVE-2026-56841 |
high | 8.8 | 0.0049 | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit an authenticated SQL I | |
CVE-2026-15067 |
high | 8.8 | 0.0053 | 2026-07-08 | Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, incl | |
CVE-2026-35152 |
high | 8.8 | 0.0328 | 2026-07-15 | A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) | |
CVE-2026-55084 |
high | 8.8 | 0.0046 | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visua | |
CVE-2026-62516 |
high | 8.8 | 0.0047 | 2026-07-21 | Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Pr | |
CVE-2026-71288 |
high | 8.8 | 0.0055 | 2026-08-05 | Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value | |
CVE-2026-72558 |
high | 8.8 | 0.0043 | 2026-08-11 | An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the | |
CVE-2026-72562 |
high | 8.8 | 0.0043 | 2026-08-11 | An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authent | |
CVE-2026-72807 |
high | 8.8 | 0.0033 | 2026-08-12 | SiYuan versions before v3.7.4 contain a second-order SQL injection vulnerability in attribute-view t | |
CVE-2026-78314 |
high | 8.8 | 0.0066 | 2026-08-24 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | |
CVE-2026-19949 |
high | 8.8 | 0.0096 | 2026-08-25 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archi | |
CVE-2026-62895 |
high | 8.8 | 0.0080 | 2026-09-08 | Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker t | |
CVE-2026-67370 |
high | 8.8 | 0.0099 | 2026-09-08 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a | |
CVE-2025-57739 |
high | 8.8 | 0.0031 | 2026-10-13 | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerabilit | |
CVE-2015-20128 |
high | 8.8 | 0.0034 | 2026-10-20 | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated att | |
CVE-2026-76477 |
high | 8.8 | 0.0046 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams f | |
CVE-2019-25778 |
high | 8.8 | 0.0046 | 2026-10-22 | SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attack | |
CVE-2022-51021 |
high | 8.8 | 0.0046 | 2026-10-22 | NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vul | |
CVE-2026-114621 |
high | 8.8 | 0.0035 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, | |
CVE-2026-116207 |
high | 8.8 | 0.0031 | 2026-10-25 | YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL inje | |
CVE-2026-116211 |
high | 8.8 | 0.0029 | 2026-10-25 | YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the | |
CVE-2026-108087 |
high | 8.8 | 0.0025 | 2026-10-20 | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ( | |
CVE-2024-58309 |
high | 8.7 | 0.0058 | 2025-12-11 | xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers |