#CWE-89
All CosmicBytez Labs articles tagged #CWE-89, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-108799: SQL Injection in XCMS Password Recovery Endpoint
High-severity SQLi (CVSS 7.3) in jackq XCMS's password recovery mail endpoint lets remote, unauthenticated attackers inject SQL via the email field.
- Security
CVE-2026-108571: Unauthenticated SQL Injection in Xinhu Rainrock RockOA
CVE-2026-108571 is an unauthenticated SQL injection in RockOA's Openkqj Action OpenAPI endpoint (CVSS 7.3, ≤ 2.7.6); no vendor patch is available.
- Security
CVE-2026-103695: Unauthenticated SQL Injection in Mobile Builder's vendor_id Parameter
Mobile builder ≤ 1.4.2 fails to sanitize the vendor_id parameter, letting unauthenticated attackers run SQL injection attacks.
- Security
CVE-2026-105182: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System via Title Parameter
SourceCodester Online Reviewer Management System 1.0 lets remote, unauthenticated attackers inject SQL via the Title parameter in btn_functions.php.
- Security
CVE-2026-102909: SQL Injection in SourceCodester Online Reviewer Management System via access_code
CVE-2026-102909: SourceCodester Online Reviewer Management System 1.0 allows remote SQL injection via the access_code parameter in btn_functions.php.
- Security
CVE-2026-13526: SQL Injection in SourceCodester Class and Exam Timetabling System
A remotely exploitable SQL injection flaw in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated attackers to manipulate...
- Security
CVE-2026-49772: The Events Calendar Blind SQL Injection (CVSS 9.3)
A critical blind SQL injection vulnerability in The Events Calendar WordPress plugin by StellarWP affects versions 6.15.12 through 6.16.2, allowing...
- Security
CVE-2026-52715: GEO my WordPress Unauthenticated SQL Injection (CVSS 9.3)
A critical unauthenticated SQL injection vulnerability in GEO my WordPress versions 4.5.5 and earlier allows attackers to extract database contents...
- Security
CVE-2026-10263: SQL Injection in SourceCodester Computer Repair Shop Management System
A CVSS 7.3 SQL injection vulnerability in SourceCodester's Computer Repair Shop Management System v1.0 allows remote attackers to extract sensitive data via…
- Security
CVE-2026-10184: SourceCodester Hospital Records SQL Injection via Delete
A SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0 allows remote attackers to extract database contents by…
- Security
CVE-2026-10185: SourceCodester Hospital Records SQL Injection via Save
A SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0 enables remote attackers to extract database contents by…
- Security
CVE-2026-49489: OpenCATS ATS SQL Injection via sortDirection Parameter
A SQL injection vulnerability in OpenCATS through 0.9.7.4 allows authenticated attackers to extract database contents by injecting malicious SQL via the…
- Security
CVE-2026-10178: SQL Injection in Online Music Site 1.0 Admin Panel
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Online Music Site 1.0, affecting the Administrator PHP AdminEditAlbum…
- Security
CVE-2026-39531: WP Directory Kit Blind SQL Injection (CVSS
A critical blind SQL injection vulnerability in the WP Directory Kit WordPress plugin allows unauthenticated attackers to exfiltrate the entire WordPress...
- Security
CVE-2026-8785: SQL Injection in Hospital Management System
A high-severity SQL injection vulnerability (CVE-2026-8785, CVSS 7.3) has been disclosed in projectworlds Hospital Management System in PHP 1.0, allowing...
- Security
Critical Blind SQL Injection in Akilli E-Commerce Website
A CVSS 9.8 blind SQL injection vulnerability in Akilli Commerce's e-commerce platform allows unauthenticated attackers to extract the entire database...
- Security
CVE-2026-6433: WordPress Plugin SQLi Enables
The Custom css-js-php WordPress plugin through version 2.0.7 fails to sanitize user input before using it in a SQL query, and passes the result to dynamic...
- Security
CVE-2026-7224: SQL Injection in Pizzafy Ecommerce System 1.0
A high-severity SQL injection vulnerability has been discovered in SourceCodester Pizzafy Ecommerce System 1.0, allowing remote attackers to manipulate...
- Security
CVE-2026-7077: SQL Injection in itsourcecode Courier
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Courier Management System 1.0, affecting the edit_parcel.php file...
- Security
CVE-2026-41478: Saltcorn SQL Injection Allows Full Database
A critical SQL injection vulnerability in Saltcorn's mobile-sync routes allows any authenticated low-privilege user with read access to a single table to...
- Security
CVE-2026-6595: SQL Injection in ProjectsAndPrograms School
A medium-severity SQL injection vulnerability has been disclosed in ProjectsAndPrograms School Management System, allowing remote attackers to manipulate...
- Security
CVE-2026-6004: SQL Injection in code-projects Simple IT
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Simple IT Discussion Forum 1.0, affecting the /delete-category.php...
- Security
CVE-2019-25662: ResourceSpace 8.6 Unauthenticated SQL
An unauthenticated SQL injection vulnerability in ResourceSpace 8.6 allows attackers to execute arbitrary database queries via the 'ref' parameter in...
- Security
CVE-2026-5554: SQL Injection in Concert Ticket Reservation
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Concert Ticket Reservation System 1.0, affecting the...
- Security
CVE-2026-5555: SQL Injection in Concert Ticket Reservation
An unauthenticated SQL injection vulnerability has been disclosed in code-projects Concert Ticket Reservation System 1.0, affecting the login.php file via...
- Security
CVE-2026-5575: SQL Injection in SourceCodester Record
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester/jkev Record Management System 1.0, affecting the Login page's...
- Security
CVE-2026-5551: SQL Injection in itsourcecode Free Hotel
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Free Hotel Reservation System 1.0, affecting the login page's email...
- Security
CVE-2026-5017: SQL Injection in code-projects Simple Food
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Simple Food Order System 1.0, affecting the /all-tickets.php file...
- Security
CVE-2026-5018: SQL Injection in code-projects Simple Food
A remotely exploitable SQL injection vulnerability exists in code-projects Simple Food Order System 1.0, where the Name parameter in register-router.php...
- Security
CVE-2026-5019: SQL Injection in code-projects Simple Food
A SQL injection vulnerability has been disclosed in code-projects Simple Food Order System 1.0, where the Status parameter in all-orders.php enables...
- Security
CVE-2026-5033: SQL Injection in code-projects Accounting
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Accounting System 1.0, where the cos_id parameter in...
- Security
CVE-2026-5034: SQL Injection in code-projects Accounting
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Accounting System 1.0, allowing unauthenticated attackers to...
- Security
CVE-2025-62319: Critical SQL Injection in HCL Unica (CVSS
A critical unauthenticated Boolean-based SQL injection vulnerability (CVSS 9.8) has been disclosed in HCL Unica versions 25.1.1 and below, allowing remote...
- Security
CVE-2026-3730: SQL Injection in itsourcecode Free Hotel
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Free Hotel Reservation System 1.0, affecting the amenities admin...
- Security
CVE-2026-3740: SQL Injection in itsourcecode University
A high-severity SQL injection vulnerability has been disclosed in itsourcecode University Management System 1.0, allowing remote attackers to execute...
- Security
CVE-2026-3746: SQL Injection in SourceCodester Simple
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester Simple Responsive Tourism Website 1.0, allowing attackers to...