# SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SQL injection in EnterpriseDB pglogical](https://agentprime.io/advisories/CVE-2026-50736.md)
  `CVE-2026-50736` · CVE record: EnterpriseDB pglogical · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter](https://agentprime.io/advisories/CVE-2026-15444.md)
  `CVE-2026-15444` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-14785.md)
  `CVE-2026-14785` · CVE record: mihail-chepovskiy Web Directory Free · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-10207.md)
  `CVE-2026-10207` · CVE record: pickplugins PickPlugins Question Answer · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [SQL injection via unauthenticated GetGridData endpoint](https://agentprime.io/advisories/CVE-2026-16462.md)
  `CVE-2026-16462` · CVE record: Weidmueller Interface PROCON-WEB SCADA · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [Premium Packages <= 6.2.0 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-12800.md)
  `CVE-2026-12800` · CVE record: codename065 Premium Packages – Sell Digital Products Securely · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [TrueBooker <= 1.2.2 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-13161.md)
  `CVE-2026-13161` · CVE record: themetechmount TrueBooker – Appointment Booking and Scheduler System · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection](https://agentprime.io/advisories/CVE-2026-15267.md)
  `CVE-2026-15267` · CVE record: taskbuilder Taskbuilder – Project Management & Task Management Tool With Kanban Board · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-14516.md)
  `CVE-2026-14516` · CVE record: ladela Online Scheduling and Appointment Booking System – Bookly · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection](https://agentprime.io/advisories/CVE-2026-12741.md)
  `CVE-2026-12741` · CVE record: epsiloncool WP Fast Total Search – The Power of Indexed Search · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings](https://agentprime.io/advisories/CVE-2026-15673.md)
  `CVE-2026-15673` · CVE record: cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery · CVSS 4.4 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-15670.md)
  `CVE-2026-15670` · CVE record: cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery · CVSS 4.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-15671.md)
  `CVE-2026-15671` · CVE record: cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery · CVSS 4.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-16811.md)
  `CVE-2026-16811` · CVE record: devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin · CVSS 4.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter](https://agentprime.io/advisories/CVE-2026-6251.md)
  `CVE-2026-6251` · CVE record: Chaty Chaty Pro · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [VeloCloud Orchestrator Flow Metrics API SQL Injection](https://agentprime.io/advisories/CVE-2026-17191.md)
  `CVE-2026-17191` · CVE record: Arista Networks VeloCloud Orchestrator On-Prem · CVSS 8.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66427.md)
  `CVE-2026-66427` · CVE record: jgwhite33 WP Google Review Slider · CVSS 7.6 High · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59551.md)
  `CVE-2026-59551` · CVE record: rtCamp rtMedia for WordPress, BuddyPress and bbPress · CVSS 8.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59550.md)
  `CVE-2026-59550` · CVE record: Strategy11 Team AWP Classifieds · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59549.md)
  `CVE-2026-59549` · CVE record: rtCamp rtMedia for WordPress, BuddyPress and bbPress · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59538.md)
  `CVE-2026-59538` · CVE record: Ruben Garcia GamiPress · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59537.md)
  `CVE-2026-59537` · CVE record: Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce · CVSS 7.6 High · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59533.md)
  `CVE-2026-59533` · CVE record: Christoph Vielgrader Relevanssi Light · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59527.md)
  `CVE-2026-59527` · CVE record: RomanCode MapSVG · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0](https://agentprime.io/advisories/CVE-2026-65876.md)
  `CVE-2026-65876` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1](https://agentprime.io/advisories/CVE-2026-65877.md)
  `CVE-2026-65877` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 8.2 High · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1](https://agentprime.io/advisories/CVE-2026-65766.md)
  `CVE-2026-65766` · CVE record: joomshaper.com SP Page Builder extension for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields](https://agentprime.io/advisories/CVE-2026-14189.md)
  `CVE-2026-14189` · CVE record: Unknown WPBot · CVSS 3.8 Low · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component](https://agentprime.io/advisories/CVE-2026-51077.md)
  `CVE-2026-51077` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1.](https://agentprime.io/advisories/CVE-2025-50455.md)
  `CVE-2025-50455` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: SQL injection
- [Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete](https://agentprime.io/advisories/GHSA-pmpg-2mxq-6xwr.md)
  `GHSA-pmpg-2mxq-6xwr`, `CVE-2026-73617` · npm `@budibase/server`: affected `<=3.38.1`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 24 Jul 2026 · Tags: SQL injection, Other injection
- [Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector](https://agentprime.io/advisories/GHSA-2xgg-r2wc-c5r2.md)
  `GHSA-2xgg-r2wc-c5r2`, `CVE-2026-73408` · npm `@budibase/server`: affected `<=3.38.1`, no fixed version yet · CVSS 7.6 High · Not analysed yet · Published 24 Jul 2026 · Tags: SQL injection
- [Budibase: SQL Injection via \`multipleStatements: true\`](https://agentprime.io/advisories/GHSA-q6x4-v3qx-85qw.md)
  `GHSA-q6x4-v3qx-85qw`, `CVE-2026-73300` · npm `@budibase/server`: affected `<=3.38.1`, no fixed version yet · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: SQL injection
- [Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint](https://agentprime.io/advisories/CVE-2026-65707.md)
  `CVE-2026-65707` · CVE record: likeadmin-likeshop likeshop · CVSS 8.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: SQL injection
- [Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key](https://agentprime.io/advisories/CVE-2026-15663.md)
  `CVE-2026-15663` · CVE record: kstover Ninja Forms – The Contact Form Builder That Grows With You · CVSS 4.9 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: SQL injection
- [CodeAstro Online Classroom loginlinkadmin.php sql injection](https://agentprime.io/advisories/CVE-2026-16765.md)
  `CVE-2026-16765` · CVE record: CodeAstro Online Classroom · CVSS 6.9 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Other injection, SQL injection
- [Appriss Insights VINE SQLI](https://agentprime.io/advisories/CVE-2026-63359.md)
  `CVE-2026-63359` · CVE record: Appriss Insights Victim Information Notification Exchange (VINE) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1](https://agentprime.io/advisories/CVE-2026-65761.md)
  `CVE-2026-65761` · CVE record: joomshaper.com Easy Store extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65532.md)
  `CVE-2026-65532` · CVE record: PersianScript Persian Woocommerce SMS · CVSS 7.6 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65526.md)
  `CVE-2026-65526` · CVE record: Themeisle Visualizer · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65494.md)
  `CVE-2026-65494` · CVE record: Dokan Dokan Pro · CVSS 7.1 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65462.md)
  `CVE-2026-65462` · CVE record: Uncanny Owl Uncanny Automator · CVSS 7.6 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65454.md)
  `CVE-2026-65454` · CVE record: ExpressTech Systems Quiz And Survey Master · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65451.md)
  `CVE-2026-65451` · CVE record: RomanCode MapSVG · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-65450.md)
  `CVE-2026-65450` · CVE record: RomanCode MapSVG · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61950.md)
  `CVE-2026-61950` · CVE record: themetechmount TrueBooker · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61949.md)
  `CVE-2026-61949` · CVE record: Bookly Bookly · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-61948.md)
  `CVE-2026-61948` · CVE record: Shahjada WPDM – Premium Packages · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59526.md)
  `CVE-2026-59526` · CVE record: RomanCode MapSVG · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59525.md)
  `CVE-2026-59525` · CVE record: Roland Barker Participants Database · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-59514.md)
  `CVE-2026-59514` · CVE record: MightyNetworks vs BuddyBoss Buddyboss Platform · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-25405.md)
  `CVE-2026-25405` · CVE record: DigitalME eRoom · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-24552.md)
  `CVE-2026-24552` · CVE record: John-Michael L'Allier Create · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter](https://agentprime.io/advisories/CVE-2026-15448.md)
  `CVE-2026-15448` · CVE record: tickera Tickera – Sell Tickets & Manage Events · CVSS 6.5 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter](https://agentprime.io/advisories/CVE-2026-13119.md)
  `CVE-2026-13119` · CVE record: roundupwp Registrations for the Events Calendar – Event Registration Plugin · CVSS 6.5 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order\[0\]\[dir\]' Parameter](https://agentprime.io/advisories/CVE-2026-13009.md)
  `CVE-2026-13009` · CVE record: wupsales AI Copilot – Content Generator · CVSS 6.5 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-15906.md)
  `CVE-2026-15906` · CVE record: codename065 Premium Packages – Sell Digital Products Securely · CVSS 6.5 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter](https://agentprime.io/advisories/CVE-2026-15761.md)
  `CVE-2026-15761` · CVE record: tickera Tickera – Sell Tickets & Manage Events · CVSS 6.5 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload](https://agentprime.io/advisories/CVE-2026-9713.md)
  `CVE-2026-9713` · CVE record: King-Theme Product Designer for WooCommerce WordPress | Lumise · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: SQL injection
- [n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation](https://agentprime.io/advisories/GHSA-652q-gvq3-74qv.md)
  `GHSA-652q-gvq3-74qv`, `CVE-2026-72750` · npm `n8n`: affected `<1.123.67 || >=2.0.0-rc.0, <2.31.5 || >=2.32.0, <2.32.1`, fixed in `1.123.67`, `2.31.5`, `2.32.1` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/tag/sql-injection.md>
Older: <https://agentprime.io/advisories/tag/sql-injection.md?cursor=WyIyMDI2LTA3LTIyVDIzOjIwOjI0LjAwMDAwMFoiLCJHSFNBLTY1MnEtZ3ZxMy03NHF2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=sql-injection&cursor=WyIyMDI2LTA3LTI4VDE3OjU4OjQ2LjAxMjAwMFoiLCJDVkUtMjAyNi03NzY5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/sql-injection/?cursor=WyIyMDI2LTA3LTI4VDE3OjU4OjQ2LjAxMjAwMFoiLCJDVkUtMjAyNi03NzY5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.