#cwe-89

共收录 2523 条相关情报。

漏洞预警2026-10-31 发布MEDIUM

The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to i...

CVE-2026-15272

The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' paramet

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-89 #severity:medium

漏洞预警2026-10-31 发布HIGH

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient esca...

CVE-2026-109197

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all vers

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-89 #severity:high

漏洞预警2026-10-31 发布MEDIUM

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping o...

CVE-2026-101325

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-89 #severity:medium

漏洞预警2026-10-31 发布MEDIUM

The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.5.6 due to insufficient escaping on...

CVE-2025-9462

The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-89 #severity:medium

漏洞预警2026-10-31 发布HIGH

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id'...

CVE-2026-119163

The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulne

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-89 #severity:high

漏洞预警2026-10-30 发布INFO

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV crosstab` SQL by concatenating an `asset name` and `attribu...

CVE-2026-63224

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the `datapoint export` API constructs `CSV cr

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布CRITICAL

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values s...

CVE-2026-62849

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengin

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布CRITICAL

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword...

CVE-2026-61620

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other a

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布CRITICAL

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

CVE-2026-39732

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli_query of the file admin/save_stu...

CVE-2026-119619

A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This aff

来源摘录 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-30 发布MEDIUM

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns (array keys)' parameter ...

CVE-2026-115820

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generi

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORD...

CVE-2026-119656

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPag

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY...

CVE-2026-119655

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布HIGH

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privil...

CVE-2026-111503

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /data...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supply

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin...

CVE-2026-119554

Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injectio

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布MEDIUM

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Atta...

CVE-2026-119427

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated use

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInp...

CVE-2025-68394

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization o

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisate...

CVE-2025-68393

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization o

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-30 发布INFO

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datata...

CVE-2026-65874

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) a

来源摘录 · NVD

#cve #cwe-89