CWE-89: SQL injection

CVEs per yearBy the year they were published

1. 2015213
2. 201694
3. 2017504
4. 2018502
5. 2019547
6. 2020465
7. 2021736
8. 20221,738
9. 20232,028
10. 20242,681
11. 20254,000
12. 20264,145

Known exploitedNewest addition to KEV first

• CVE-2026-114625

  Security Advisory 0199

  Arista Networks · VeloCloud Orchestrator

  ExploitedCritical9.4
• CVE-2026-76461

  Cisco Secure Email Gateway SQL Injection Vulnerability

  Cisco · Cisco Secure Email

  ExploitedCritical9.8
• CVE-2026-9586

  Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

  Sangoma · Switchvox SMB Edition

  ExploitedCritical9.3
• CVE-2026-72898

  Metabase SQL injection via password reset endpoint

  Metabase · Metabase

  ExploitedCritical10.0
• CVE-2026-60137

  WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

  WordPress · WordPress

  ExploitedMedium5.9
• CVE-2026-9082

  Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

  Drupal · Drupal core

  ExploitedCritical9.8
• CVE-2026-42208

  LiteLLM: SQL injection in Proxy API key verification

  BerriAI · litellm

  ExploitedCritical9.3
• CVE-2026-21643

  An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an…

  Fortinet · FortiClientEMS

  ExploitedCritical9.1
• CVE-2024-43468

  Microsoft Configuration Manager Remote Code Execution Vulnerability

  Microsoft · Microsoft Configuration Manager

  ExploitedCritical9.8
• CVE-2025-57819

  FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

  FreePBX · endpoint

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-124331

  Jinher OA ProjectAfficheManage.aspx sql injection

  Jinher · OA

  Medium6.9
• CVE-2026-124469

  OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter

  openemr · openemr

  Critical9.4
• CVE-2026-124468

  OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API

  openemr · openemr

  High7.1
• CVE-2026-124444

  OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API

  openemr · openemr

  High7.1
• CVE-2026-123990

  DataEase Chart Data ExtWhere2Str.java ExtWhere2Str.extWhere2sqlOjb sql injection

  DataEase

  Medium6.9
• CVE-2026-103914

  Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3 - Authenticated (Subscriber+) SQL Injection via 'q' Parameter

  wpvibes · Dynific Addons for Elementor (formerly Anywhere Elementor)

  Medium6.5
• CVE-2026-116751

  Amelia Pro <= 9.9.1 - Unauthenticated SQL Injection via 'tag' Parameter Array Keys

  Amelia · Booking for Appointments and Events Calendar – Amelia Pro

  High7.5
• CVE-2026-121265

  SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update

  SQL-Abstract

  Not scored
• CVE-2026-95870

  wpForo Forum <= 3.2.1 - Unauthenticated SQL Injection via 'data' Parameter

  tomdever · wpForo Forum

  High7.5
• CVE-2026-119155

  wpForo Forum <= 3.2.2 - Unauthenticated SQL Injection via 'href[locale]' Parameter

  tomdever · wpForo Forum

  High7.5

Vendors it comes up for most

1. SourceCodester1,213
2. code-projects999
3. itsourcecode610
4. PHPGurukul559
5. Campcodes423
6. IBM117
7. CodeAstro104
8. Siemens99
9. projectworlds96
10. Cisco77