Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1100)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (848)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (532)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2019-25765 |
high | 8.7 | 0.0074 | 2026-08-13 | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthent | |
CVE-2026-61518 |
high | 8.7 | 0.0046 | 2026-08-19 | ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id pa | |
CVE-2019-25776 |
high | 8.7 | 0.0060 | 2026-09-18 | Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers | |
CVE-2026-63154 |
high | 8.7 | 0.0043 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows | |
CVE-2026-113405 |
high | 8.7 | 0.0052 | 2026-10-20 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attacke | |
CVE-2026-113406 |
high | 8.7 | 0.0052 | 2026-10-20 | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attacke | |
CVE-2026-115328 |
high | 8.7 | 0.0029 | 2026-10-22 | JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realt | |
CVE-2026-115330 |
high | 8.7 | 0.0030 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization | |
CVE-2026-115332 |
high | 8.7 | 0.0030 | 2026-10-22 | Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization | |
CVE-2026-49142 |
high | 8.7 | — | 2026-10-29 | OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveill | |
CVE-2024-58276 |
high | 8.7 | 0.0041 | 2025-12-04 | Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_ | |
CVE-2026-116808 |
high | 8.6 | 0.0039 | 2026-10-27 | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to re | |
CVE-2026-7435 |
high | 8.6 | 0.0053 | 2026-04-30 | SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString | |
CVE-2026-54222 |
high | 8.6 | 0.0031 | 2026-06-18 | UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access to the Members in C | |
CVE-2026-14471 |
high | 8.6 | 0.0058 | 2026-07-06 | Improper Neutralization of Special Elements in the metrics-service retention policy management compo | |
CVE-2026-15829 |
high | 8.6 | 0.0020 | 2026-07-21 | A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt | |
CVE-2026-48448 |
high | 8.6 | 0.0056 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a | |
CVE-2026-22620 |
high | 8.6 | 0.0066 | 2026-07-30 | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware | |
CVE-2026-46593 |
high | 8.6 | 0.0038 | 2026-07-31 | A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neu | |
CVE-2026-64631 |
high | 8.6 | 0.0040 | 2026-08-04 | A vulnerability allowing a low-privileged user to inject SQL and extract database contents. | |
CVE-2026-73670 |
high | 8.6 | 0.0053 | 2026-08-13 | A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authentica | |
CVE-2026-12983 |
high | 8.6 | 0.0044 | 2026-08-19 | The Dinatur WordPress plugin through 1.18 does not sanitize and escape user input before using it in | |
CVE-2026-19754 |
high | 8.6 | 0.0039 | 2026-09-02 | Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula f | |
CVE-2026-63152 |
high | 8.6 | 0.0031 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allo | |
CVE-2026-63165 |
high | 8.6 | 0.0031 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functi | |
CVE-2026-89216 |
high | 8.6 | 0.0019 | 2026-10-29 | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before us | |
CVE-2026-118378 |
high | 8.5 | 0.0015 | 2026-10-28 | Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP | |
CVE-2026-111850 |
high | 8.5 | 0.0021 | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-115603 |
high | 8.5 | 0.0021 | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-34885 |
high | 8.5 | 0.0167 | 2026-04-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42741 |
high | 8.5 | 0.0022 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42742 |
high | 8.5 | 0.0022 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-45211 |
high | 8.5 | 0.0022 | 2026-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-42730 |
high | 8.5 | 0.0026 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-49046 |
high | 8.5 | 0.0030 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-24637 |
high | 8.5 | 0.0025 | 2026-06-15 | Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions. | |
CVE-2026-40766 |
high | 8.5 | 0.0033 | 2026-06-15 | Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions. | |
CVE-2026-48874 |
high | 8.5 | 0.0033 | 2026-06-15 | Subscriber SQL Injection in GamiPress <= 7.8.7 versions. | |
CVE-2026-48882 |
high | 8.5 | 0.0033 | 2026-06-15 | Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions. | |
CVE-2026-52700 |
high | 8.5 | 0.0037 | 2026-06-15 | Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions. | |
CVE-2026-39581 |
high | 8.5 | 0.0028 | 2026-06-16 | Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions. | |
CVE-2026-22335 |
high | 8.5 | 0.0035 | 2026-06-17 | Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate < 6.7.7 versions. | |
CVE-2026-48967 |
high | 8.5 | 0.0033 | 2026-06-17 | Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. | |
CVE-2026-49073 |
high | 8.5 | 0.0021 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54185 |
high | 8.5 | 0.0033 | 2026-06-17 | Subscriber SQL Injection in Cornerstone < 7.8.8 versions. | |
CVE-2026-54813 |
high | 8.5 | 0.0021 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54818 |
high | 8.5 | 0.0028 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-56012 |
high | 8.5 | 0.0036 | 2026-06-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54822 |
high | 8.5 | 0.0036 | 2026-06-25 | Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions. | |
CVE-2026-54838 |
high | 8.5 | 0.0036 | 2026-06-25 | Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions. |