CWE-89
High likelihoodImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
19,515 vulnerabilities with CWE-89
CVE-2025-52025
CRITICAL
Aptsys gemscms_backend < 2025-05-28 - SQL Injection via GetServiceByRestaurantID Endpoint
CVSS 9.4
CVE-2025-69180
HIGH
themepassion Ultra Portfolio <=6.7 - SQL Injection
CVSS 8.5
CVE-2025-69045
HIGH
FooEvents for WooCommerce <= 1.20.4 - SQL Injection
CVSS 8.5
CVE-2025-68999
HIGH
HappyMonster Happy Addons <3.20.4 - SQL Injection
CVSS 8.5
CVE-2025-68881
HIGH
Saad Iqbal AppExperts <1.4.5 - SQL Injection
CVSS 8.5
CVE-2025-68857
CRITICAL
ichurakov Paid Downloads <= 3.15 - SQL Injection
CVSS 9.3
CVE-2025-68034
CRITICAL
CleverReach WP <=1.5.22 - SQL Injection
CVSS 9.3
CVE-2025-68017
HIGH
Antideo Email Validator <1.0.10 - SQL Injection
CVSS 7.5
CVE-2025-67945
CRITICAL
MailerLite - WooCommerce <3.1.2 - SQL Injection
CVSS 9.3
CVE-2025-49055
CRITICAL
kamleshyadav WP Lead Capturing Pages <= 2.5 - SQL Injection
CVSS 9.3
CVE-2025-49050
HIGH
kamleshyadav WP Lead Capturing Pages <= 2.5 - SQL Injection
CVSS 8.5
CVE-2025-49049
HIGH
ZoomIt DZS Video Gallery <12.37 - SQL Injection
CVSS 8.5
CVE-2025-36588
HIGH
Dell Unisphere for PowerMax < 9.2.4.19 - Authenticated SQL Injection
CVSS 8.8
CVE-2025-4764
HIGH
Aida Computer Information Technology Inc. Hotel Guest Hotspot <2201...
CVSS 8.0
CVE-2025-27378
HIGH
Altium On-Prem Enterprise Server 7.0.3-7.0.5 - SQL Injection via Inactive Configuration
CVSS 8.6
CVE-2025-67261
MEDIUM
Abacre Retail Point of Sale 14.0.0.396 - Blind SQL Injection via Orders Search Function
CVSS 6.5
CVE-2025-12984
MEDIUM
Advanced Ads - Ad Manager & AdSense <2.0.15 - SQL Injection
CVSS 4.9
CVE-2025-61943
HIGH
AVEVA Process Optimization < 2025 - Authenticated SQL Injection in Captive Historian
CVSS 8.4
CVE-2025-70893
HIGH
PHPGurukul Cyber Cafe Management System 1.0 - Authenticated Time-Based Blind SQL Injection via adminname Parameter
CVSS 8.8
CVE-2025-70892
CRITICAL
Phpgurukul Cyber Cafe Management System 1.0 - SQL Injection via Username Parameter
CVSS 9.8
CVE-2025-66417
HIGH
GLPI 11.0.0-11.0.2 - Unauthenticated SQL Injection via Inventory Endpoint
CVSS 7.5
CVE-2025-67082
MEDIUM
InvoicePlane < 1.6.4 - Authenticated SQL Injection via Report Parameters
CVSS 6.5
CVE-2025-67081
MEDIUM
itflow < 25.06 - Authenticated SQL Injection via Role ID Parameter
CVSS 4.9
CVE-2025-12166
HIGH
Simply Schedule Appointments Booking Plugin <1.6.9.9 - SQL Injection
CVSS 7.5
CVE-2025-37183
HIGH
EdgeConnect SD-WAN Orchestrator - Authenticated SQL Injection
CVSS 7.2
Details
Vulnerabilities
19,515
Exploit Likelihood
High