By weakness (CWE)

CWE-89: related vulnerabilities

CVEs classified under CWE-89. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

440 published vulnerabilities · page 5 of 5

• CVE-2026-14797MEDIUM 6.3

  A SQL injection vulnerability exists in CodeAstro Apartment Visitor Management System version 1.0. An authenticated user can manipulate the 'editid' parameter in the /apartment-visitor/edit-apartment.php file to inject malicious SQL commands. The vulnerability allows remote exploitation and has been publicly disclosed, increasing the risk of active exploitation.

• CVE-2026-14798MEDIUM 6.3

  CVE-2026-14798 is a SQL injection vulnerability in CodeAstro Apartment Visitor Management System version 1.0. An authenticated attacker can inject malicious SQL code through the 'visname' parameter in the visitor entry form, potentially compromising the confidentiality, integrity, and availability of the underlying database. Public exploit code exists, elevating the practical risk despite the MEDIUM CVSS score.

• CVE-2026-14799MEDIUM 6.3

  CodeAstro Ecommerce Website version 1.0 contains a SQL injection vulnerability in its customer account management functionality. An authenticated attacker can manipulate the delete_wishlist parameter in the /customer/my_account.php?my_wishlist endpoint to execute arbitrary SQL commands against the application's database. The flaw requires valid login credentials but no elevated privileges, and can be exploited over the network. Public exploit code exists, increasing the risk of active attacks.

• CVE-2026-39178MEDIUM 6.3

  SOGo, a groupware and collaboration platform, contains a SQL injection flaw in its contact search functionality. An authenticated attacker can craft malicious input through the search parameter to execute arbitrary database queries, potentially extracting sensitive information or modifying data. The vulnerability affects versions before 5.12.7 and requires valid user credentials to exploit.

• CVE-2026-39179MEDIUM 6.3

  SOGo before version 5.12.7 contains a SQL injection vulnerability in its password change feature. An authenticated user can manipulate the password field during a password change request to inject malicious SQL commands directly into the database. This requires the attacker to have valid login credentials, which limits the initial attack surface, but once inside the system, an attacker could read sensitive data, modify records, or disrupt database operations.

• CVE-2026-13752MEDIUM 6.0

  Snowflake CLI versions before 3.19 contain a flaw that fails to properly validate user-supplied input, allowing attackers to inject and execute arbitrary SQL commands within a user's Snowflake database session. An attacker could trick users into running malicious commands, modify repository configurations with crafted values, or compromise automation scripts to exploit this vulnerability. The risk is confined by the privileges of the affected user account—a read-only user would face lower impact than an account with write or administrative permissions.

• CVE-2026-47375MEDIUM 6.0

  NocoDB, a spreadsheet-like database-building platform, contains a SQL injection vulnerability that allows authenticated users to run arbitrary database commands. An attacker with permission to add columns can exploit the ARRAYSORT function's direction parameter to inject malicious SQL code. Once injected, the code executes both when the column is created and every time records are read from that column. This only affects Postgres databases and has been patched in version 2026.04.1.

• CVE-2026-7253MEDIUM 6.0

  IBM Sterling B2B Integrator and IBM Sterling File Gateway contain a SQL injection vulnerability that requires an attacker to hold privileged user credentials. Once authenticated, a malicious insider or compromised privileged account can craft SQL statements to read, insert, modify, or delete data directly from the backend database. This is a classic database access control failure that elevates an authenticated user's power far beyond their intended scope.

• CVE-2026-0075MEDIUM 5.9

  CVE-2026-0075 is a SQL injection vulnerability in Google Android's contact database access functions that allows local attackers to escalate privileges without needing special permissions or user interaction. An attacker with local access to an Android device can exploit this flaw to read, modify, or delete contact information and potentially gain elevated system privileges.

• CVE-2026-15289MEDIUM 5.9

  The Booking calendar and Appointment Booking System plugin for WordPress contains a SQL injection flaw that allows unauthenticated attackers to inject malicious SQL commands. The vulnerability exists because the plugin fails to properly sanitize user input in the 'wpdevart_id' parameter. Exploitation requires the Pro version of the plugin to be installed with a specific setting ('Delete previous dates') enabled. If successfully exploited, an attacker can extract sensitive data from the WordPress database without authentication.

• CVE-2026-48613MEDIUM 5.9

  A SQL injection flaw exists in phpBB's profile field migration process. When forums upgrade from older versions, user-supplied profile field data is not properly validated before being used in database queries. An authenticated attacker with specific interaction conditions could craft malicious input to execute arbitrary SQL commands, potentially exposing or modifying forum data. The vulnerability affects only forums that upgraded from versions before 3.3.8 but have not yet reached version 3.3.11 or later.

• CVE-2026-35069MEDIUM 5.7

  Dell PowerFlex Manager versions before 5.1.0.1 contain a SQL injection flaw that allows a low-privileged attacker on the same network to inject malicious SQL commands. This could enable script injection attacks, potentially compromising data confidentiality or system integrity depending on the attacker's follow-up actions. The vulnerability requires adjacent network access and valid credentials to exploit, which limits its immediate exposure but remains a real risk in internal environments.

• CVE-2026-13529MEDIUM 5.6

  YzmCMS versions up to 7.5 contain a SQL injection vulnerability in the installation script that can be triggered by manipulating the siteurl parameter. While the flaw allows an attacker to read, modify, or delete database contents, exploiting it requires navigating non-trivial technical barriers and is not straightforward to execute. The vendor has not responded to early disclosure attempts, leaving users without an official patch timeline.

• CVE-2026-28576MEDIUM 5.5

  A SQL injection flaw in Android's Contacts Provider allows a local attacker with basic user permissions to read sensitive contact information from the device's contacts database without needing special privileges or user interaction. The vulnerability is limited to information disclosure—attackers cannot modify or delete data, but they can extract the entire contacts database contents.

• CVE-2025-53648MEDIUM 5.4

  A SQL misconfiguration in Apache Gravitino's web interface allows authenticated users to read or delete files on the server. This vulnerability exists in version 1.0.0 and earlier. While an attacker must have valid login credentials, the impact is significant—they can extract sensitive data or destroy critical files without elevated permissions.

• CVE-2026-57587MEDIUM 5.3

  A SQL injection flaw in Nessus allows an unauthenticated attacker to manipulate reverse DNS records for a host being scanned, then inject malicious SQL commands into Nessus's scan results database. This could let the attacker read sensitive data from scan results without needing valid credentials. The attack requires the attacker to control DNS infrastructure for a target host, which limits the scope but is feasible in some network configurations.

• CVE-2026-10039MEDIUM 4.9

  The Frontend Admin plugin for WordPress contains a SQL injection vulnerability that allows authenticated administrators to extract sensitive data from the website's database. The flaw exists in how the plugin processes the 'order' parameter—it fails to properly escape user input before inserting it into database queries. An attacker with administrator privileges can craft a malicious request containing both 'order' and 'orderby' parameters to inject additional SQL commands and retrieve unauthorized information. This vulnerability affects all versions up to and including 3.28.28.

• CVE-2026-10736MEDIUM 4.9

  The Tutor LMS plugin for WordPress, a popular learning management system, contains a SQL injection flaw in versions up to 3.9.11. An authenticated administrator can inject malicious SQL commands through the 'data' parameter to extract sensitive database information. This is not an unauthenticated attack—it requires admin-level access—which significantly limits real-world exposure in most WordPress installations.

• CVE-2026-11360MEDIUM 4.9

  A SQL injection vulnerability exists in the Advanced Order Export For WooCommerce plugin affecting all versions through 4.0.10. Authenticated users with shop manager privileges or higher can inject malicious SQL commands through the 'sort_direction' parameter to extract sensitive data from the WordPress database. The vulnerability requires valid authentication and specific WordPress capabilities, limiting the attack surface to trusted internal users or compromised administrator accounts.

• CVE-2026-11776MEDIUM 4.9

  The Form Maker by 10Web WordPress plugin is susceptible to SQL injection through the 'groupids' parameter. An authenticated administrator can craft malicious input to execute unauthorized database queries and extract sensitive information. The vulnerability affects all versions up to and including 1.15.43 and requires administrator-level credentials to exploit.

• CVE-2026-11777MEDIUM 4.9

  The Form Maker by 10Web WordPress plugin contains a SQL injection vulnerability in its 'name' parameter that allows authenticated administrators to execute arbitrary SQL queries. An attacker with admin access could extract sensitive database information by injecting malicious SQL code into form submissions. The vulnerability affects all versions up to and including 1.15.43.

• CVE-2026-12920MEDIUM 4.9

  The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent WordPress plugin contains a SQL injection vulnerability in versions 4.3.5 and earlier. An authenticated administrator can craft malicious input through the 's' parameter to inject arbitrary SQL commands and extract sensitive data from the WordPress database. While the vulnerability requires admin-level access to exploit, it poses a meaningful risk in multi-user WordPress environments or where admin credentials have been compromised.

• CVE-2026-12936MEDIUM 4.9

  The Recurio – Ultimate Subscription for WooCommerce plugin contains a SQL injection vulnerability in its 'data' parameter that allows authenticated shop managers and administrators to extract sensitive database information. The vulnerability exists because user input is not properly sanitized before being used in database queries. An attacker with legitimate shop manager credentials or higher can craft malicious requests to execute unintended SQL commands and access confidential data like customer records, payment information, or other sensitive details stored in the WordPress database.

• CVE-2026-13357MEDIUM 4.9

  The Houzez Property Feed plugin for WordPress contains a SQL injection vulnerability in versions up to 2.5.46. An attacker with administrator-level access can manipulate the 'orderby' parameter to execute arbitrary SQL queries and steal sensitive data from the website's database. The vulnerability exists because user input is only lightly sanitized before being inserted into an SQL statement, bypassing WordPress's built-in protection mechanisms.

• CVE-2026-14342MEDIUM 4.9

  The Mail Mint WordPress plugin, used for email marketing and WooCommerce integration, contains a SQL injection vulnerability affecting all versions up to 1.24.2. An authenticated administrator can manipulate the 'contact_ids' parameter to inject malicious SQL commands and extract sensitive data from the WordPress database. While access requires administrator-level privileges, the vulnerability allows unauthorized data exfiltration once those credentials are compromised or misused.

• CVE-2026-14475MEDIUM 4.9

  The WPLP Cookie Consent plugin for WordPress contains a SQL injection vulnerability affecting all versions up to 4.3.6. An attacker with WordPress administrator access can manipulate the 'scan_id' parameter to inject malicious SQL commands and extract sensitive data from the website's database. While this requires high-level credentials to exploit, the impact on data confidentiality is significant.

• CVE-2026-6448MEDIUM 4.9

  The Quiz and Survey Master plugin for WordPress contains a SQL injection flaw in how it processes the 'order' parameter. An admin-level attacker can craft malicious requests to extract sensitive data from the WordPress database. The vulnerability is time-based and blind, meaning attackers infer results through response delays rather than direct output. If the plugin's secret key becomes public, lower-privileged users could exploit it without admin credentials.

• CVE-2026-8978MEDIUM 4.9

  The OptinCraft WordPress plugin contains a SQL injection vulnerability in its 'order_by' parameter that allows authenticated administrators to extract sensitive database information. The flaw exists because user input is not properly escaped before being used in database queries. While this requires admin-level access to exploit, it represents a significant insider threat risk, especially in multi-user WordPress environments where administrative accounts may be compromised or operated by untrusted parties.

• CVE-2026-10155MEDIUM 4.7

  A SQL injection vulnerability exists in Bdtask Multi-Store Inventory Management System version 1.0 within the Accounts Report Handler. An authenticated attacker can manipulate the 'dtpToDate' parameter in the accounts report search function to inject malicious SQL commands. While the vulnerability requires high privileges to exploit, successful attacks could leak sensitive financial data, modify account records, or disrupt reporting functionality. Public exploit code is available, increasing real-world risk.

• CVE-2026-10171MEDIUM 4.7

  A SQL injection vulnerability exists in code-projects Online Music Site version 1.0 that allows authenticated administrators to manipulate the ID parameter in the album update functionality. An attacker with admin credentials can inject malicious SQL commands through the /Administrator/PHP/AdminUpdateAlbum.php endpoint, potentially compromising database integrity and confidentiality. The vulnerability has been publicly disclosed and exploit code is available, increasing the likelihood of active exploitation.

• CVE-2026-10237MEDIUM 4.7

  A SQL injection vulnerability was identified in SourceCodester Water Billing Management System version 1.0. An authenticated administrator can manipulate the ID parameter in the user management interface to inject malicious SQL commands, potentially reading or modifying sensitive database records. The vulnerability requires administrative privileges to exploit but poses a risk to data integrity and confidentiality within billing systems. Public proof-of-concept code exists, elevating the practical risk of exploitation.

• CVE-2026-12175MEDIUM 4.7

  CodeAstro Student Attendance Management System version 1.0 contains a SQL injection vulnerability in its student creation interface. An authenticated administrator can exploit this flaw by manipulating the admission number field to inject malicious SQL commands, potentially reading, modifying, or deleting sensitive student and attendance data. The vulnerability requires valid admin credentials to exploit, but the attack itself is straightforward and exploit code is publicly available.

• CVE-2026-12789MEDIUM 4.7

  ILIAS Learning Management System version 11.0 contains a SQL injection vulnerability in its Learning Progress Tracking component. An authenticated administrator can manipulate a parameter called troup_table_nav to inject malicious SQL commands, potentially allowing unauthorized data access or modification within the LMS database. The vulnerability requires administrative privileges to exploit and poses a medium-severity risk to institutions using this open-source learning platform.

• CVE-2026-13495MEDIUM 4.7

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 affecting the /adminprofile.php file. An attacker with administrative privileges can manipulate the loginid parameter to inject malicious SQL commands, potentially allowing unauthorized data access or modification. The vulnerability has been publicly disclosed and is remotely exploitable, though it requires high-level privileges to execute.

• CVE-2026-13569MEDIUM 4.7

  A SQL injection vulnerability exists in EyouCMS versions up to 1.7.1, affecting the API endpoint at /index.php. An authenticated attacker can inject malicious SQL commands through the 'click_like' parameter to manipulate database queries. The vulnerability requires administrative or high-privilege credentials to exploit, but once triggered, allows an attacker to read, modify, or delete sensitive database records. Public exploit code is already available.

• CVE-2026-3602MEDIUM 4.7

  IBM App Connect Enterprise and Integration Bus contain a SQL injection vulnerability that could allow a remote attacker to trick users into inadvertently creating files on their systems. While the attack requires user interaction and operates with local system access constraints, successful exploitation could result in unauthorized file creation or modification. The vulnerability affects multiple versions across IBM's integration middleware stack.

• CVE-2026-12050MEDIUM 4.3

  A SQL injection vulnerability exists in pgAdmin 4's restore point functionality. When an authenticated user interacts with the named restore point endpoint, user-supplied input is concatenated directly into an SQL query rather than being safely parameterized. This allows an attacker to inject additional SQL statements. However, the injected SQL runs under the same database role the attacker already has access to through pgAdmin's Query Tool, so the practical impact is limited to what that role can already do. The vulnerability primarily concerns the fact that SQL execution bypasses the documented interface, which could matter for deployments that restrict Query Tool access at the application layer.

• CVE-2026-13746LOW 3.6

  Snowflake CLI versions before 3.19 contain a flaw where specially crafted command-line arguments can cause unintended SQL statements to execute against a user's Snowflake database. The vulnerability is limited to direct command-line input—an attacker cannot exploit it through project files, configuration repositories, or other indirect channels. Impact is confined to whatever database permissions the affected user already possesses. A fix is available in version 3.19, which requires manual installation.

• CVE-2026-35068LOW 3.5

  Dell PowerFlex Manager versions before 5.1.0.1 contain a SQL injection vulnerability that allows a low-privileged attacker with network access to the same segment to query the database directly and extract sensitive information. While the attacker needs valid credentials and local network access, the flaw bypasses input validation on database commands, potentially exposing configuration data, credentials, or operational metrics stored in PowerFlex deployments.

• CVE-2026-57588LOW 3.3

  A SQL injection flaw exists in Nessus that can be triggered when a privileged user imports a specially crafted scan result file. An attacker could design such a file to inject malicious SQL commands into the scan results database, potentially allowing unauthorized access to sensitive scan data. The vulnerability requires local file access and user interaction, limiting its immediate threat scope, though it could be valuable in targeted attacks against security teams.