Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1099)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-108087 |
high | 8.8 | 0.0025 | 2026-10-20 | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ( | |
CVE-2017-20243 |
high | 8.8 | 0.0026 | 2026-06-09 | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerab | |
CVE-2024-58309 |
high | 8.7 | 0.0058 | 2025-12-11 | xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers | |
CVE-2026-115331 |
high | 8.7 | 0.0042 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization | |
CVE-2022-4984 |
high | 8.7 | 0.0048 | 2025-11-13 | ZenTao Biz < 6.5, ZenTao Max < 3.0, ZenTao Open Source Edition < 16.5, and ZenTao Open Source Editio | |
CVE-2025-34179 |
high | 8.7 | 0.0040 | 2025-12-15 | NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Conne | |
CVE-2026-34455 |
high | 8.7 | 0.0036 | 2026-04-01 | Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 | |
CVE-2026-34185 |
high | 8.7 | 0.0029 | 2026-04-09 | AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no pr | |
CVE-2026-32272 |
high | 8.7 | 0.0030 | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 5.0.0 through 5.5.4, an SQL injec | |
CVE-2026-7489 |
high | 8.7 | 0.0033 | 2026-05-02 | CTMS developed by Sunnet has a SQL Injection vulnerability, allowing authenticated remote attackers | |
CVE-2026-35228 |
high | 8.7 | 0.0022 | 2026-05-05 | Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects (component | |
CVE-2026-7815 |
high | 8.7 | 0.0046 | 2026-05-11 | SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_u | |
CVE-2026-44418 |
high | 8.7 | 0.0029 | 2026-05-13 | EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() functio | |
CVE-2026-45800 |
high | 8.7 | 0.0031 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-40810 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40811 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40812 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40813 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40814 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40815 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40816 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40817 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40818 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40819 |
high | 8.7 | 0.0032 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40850 |
high | 8.7 | 0.0040 | 2026-05-27 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-44886 |
high | 8.7 | 0.0033 | 2026-05-27 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 20 | |
CVE-2026-49498 |
high | 8.7 | 0.0026 | 2026-06-10 | Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of Pos | |
CVE-2026-52758 |
high | 8.7 | 0.0031 | 2026-06-10 | Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user | |
CVE-2026-12044 |
high | 8.7 | 0.0071 | 2026-06-19 | SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<descripti | |
CVE-2026-49048 |
high | 8.7 | 0.0056 | 2026-06-28 | The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by | |
CVE-2026-34100 |
high | 8.7 | 0.0046 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media | |
CVE-2026-34101 |
high | 8.7 | 0.0046 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_ | |
CVE-2026-34102 |
high | 8.7 | 0.0046 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_i | |
CVE-2026-34103 |
high | 8.7 | 0.0046 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subti | |
CVE-2026-34104 |
high | 8.7 | 0.0046 | 2026-07-01 | Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in des | |
CVE-2026-34105 |
high | 8.7 | 0.0046 | 2026-07-01 | Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in trans | |
CVE-2026-9272 |
high | 8.7 | 0.0043 | 2026-07-02 | In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adver | |
CVE-2026-14809 |
high | 8.7 | 0.0056 | 2026-07-06 | Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthentic | |
CVE-2026-61461 |
high | 8.7 | 0.0050 | 2026-07-10 | Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend th | |
CVE-2026-15804 |
high | 8.7 | 0.0054 | 2026-07-15 | The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can | |
CVE-2026-57831 |
high | 8.7 | 0.0040 | 2026-07-15 | Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10 | |
CVE-2026-57832 |
high | 8.7 | 0.0040 | 2026-07-15 | Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joo | |
CVE-2026-58078 |
high | 8.7 | 0.0040 | 2026-07-16 | Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1 - | |
CVE-2026-55082 |
high | 8.7 | 0.0058 | 2026-07-21 | DHIS2 is a flexible information system for data capture, management, validation, analytics and visua | |
CVE-2026-8339 |
high | 8.7 | 0.0034 | 2026-07-29 | A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 | |
CVE-2026-54368 |
high | 8.7 | 0.0071 | 2026-07-30 | CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchE | |
CVE-2026-17346 |
high | 8.7 | 0.0062 | 2026-07-31 | The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pg | |
CVE-2026-41453 |
high | 8.7 | 0.0050 | 2026-08-03 | Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allo | |
CVE-2016-20097 |
high | 8.7 | 0.0063 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet | |
CVE-2026-59109 |
high | 8.7 | 0.0039 | 2026-08-13 | SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in re |