Advisories · Weakness

SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-5620 CVE record

CVSS 5.3 Medium

itsourcecode Construction Management System Parameter borrowed_equip_report.php sql injection
- itsourcecode Construction Management System
- Other injection
- SQL injection
Not analysed yet 6 Apr 2026
CVE-2026-5606 CVE record

CVSS 5.3 Medium

PHPGurukul Online Shopping Portal Project Parameter order-details.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
Not analysed yet 6 Apr 2026
CVE-2019-25675 CVE record

CVSS 8.8 High

eDirectory All Versions SQL Injection Authentication Bypass
- eDirectory
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25704 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via filter_user_mail
- Kados R10 GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25702 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via id_project Parameter
- Kados R10 GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25700 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via sort_direction Parameter
- Kados R10 GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25698 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via id_to_delete Parameter
- Kados R10 GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25696 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via language_tag Parameter
- Kados R10 GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25694 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via user2reset
- Kados R10 GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25692 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via id_to_modify Parameter
- Kados R10 GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25690 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via mng_profile_id
- Kados R10 GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25688 CVE record

CVSS 8.8 High

Kados R10 GreenBee SQL Injection via menu_lev1 Parameter
- Kados GreenBee
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25684 CVE record

CVSS 8.8 High

OpenDocMan 1.3.4 SQL Injection via where Parameter
- OpenDocMan
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25680 CVE record

CVSS 8.8 High

Advance Gift Shop Pro Script 2.0.3 SQL Injection via search
- Phpscriptsmall Advance Gift Shop Pro Script
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25674 CVE record

CVSS 8.8 High

CMSsite 1.0 SQL Injection via post Parameter
- VictorAlagwu CMSsite
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25672 CVE record

CVSS 8.8 High

PilusCart 1.4.1 SQL Injection via send Parameter
- PilusCart
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25669 CVE record

CVSS 8.8 High

qdPM 9.1 SQL Injection via search_by_extrafields Parameter
- qdPM
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25668 CVE record

CVSS 8.8 High

News Website Script 2.0.5 SQL Injection via index.php
- Phpscriptsmall News Website Script
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25664 CVE record

CVSS 7.1 High

SuiteCRM 7.10.7 SQL Injection via record Parameter
- SuiteCRM
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25663 CVE record

CVSS 7.1 High

SuiteCRM 7.10.7 SQL Injection via parentTab Parameter
- SuiteCRM
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2019-25662 CVE record

CVSS 8.8 High

ResourceSpace 8.6 SQL Injection via watched_searches.php
- Montala ResourceSpace
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5596 CVE record

CVSS 5.3 Medium

griptape-ai griptape SqlTool tool.py sql injection
- griptape
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5587 CVE record

CVSS 5.3 Medium

wbbeyourself MAC-SQL Refiner Agent agents.py _execute_sql sql injection
- wbbeyourself MAC-SQL
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5586 CVE record

CVSS 5.3 Medium

zhongyu09 openchatbi Multi-stage Text2SQL Workflow sql injection
- zhongyu09 openchatbi
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5583 CVE record

CVSS 5.3 Medium

PHPGurukul Online Shopping Portal Project Parameter my-profile.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5580 CVE record

CVSS 5.3 Medium

CodeAstro Online Classroom Parameter addvideos.php sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5579 CVE record

CVSS 5.3 Medium

CodeAstro Online Classroom Parameter updatedetailsfromfaculty.php sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5578 CVE record

CVSS 5.3 Medium

CodeAstro Online Classroom Parameter addassessment.php sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5577 CVE record

CVSS 6.9 Medium

Song-Li cross_browser details Endpoint uniquemachine_app.py sql injection
- Song-Li cross_browser
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5575 CVE record

CVSS 6.9 Medium

SourceCodester/jkev Record Management System Login index.php sql injection
- SourceCodester Record Management System
- jkev Record Management System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5565 CVE record

CVSS 6.9 Medium

code-projects Simple Laundry System Parameter delmemberinfo.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5564 CVE record

CVSS 6.9 Medium

code-projects Simple Laundry System Parameter searchguest.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5563 CVE record

CVSS 5.3 Medium

AutohomeCorp frostmourne Alarm Preview previewData httpTest sql injection
- AutohomeCorp frostmourne
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5560 CVE record

CVSS 5.3 Medium

PHPGurukul Online Shopping Portal Project Parameter payment-method.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5558 CVE record

CVSS 5.3 Medium

PHPGurukul PHPGurukul Online Shopping Portal Project Parameter pending-orders.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5555 CVE record

CVSS 6.9 Medium

code-projects Concert Ticket Reservation System Parameter login.php sql injection
- code-projects Concert Ticket Reservation System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5554 CVE record

CVSS 6.9 Medium

code-projects Concert Ticket Reservation System Parameter process_search.php sql injection
- code-projects Concert Ticket Reservation System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5553 CVE record

CVSS 5.3 Medium

itsourcecode Online Cellphone System Parameter available.php sql injection
- itsourcecode Online Cellphone System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5552 CVE record

CVSS 5.3 Medium

PHPGurukul Online Shopping Portal Project Parameter sub-category.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5551 CVE record

CVSS 6.9 Medium

itsourcecode Free Hotel Reservation System Parameter login.php sql injection
- itsourcecode Free Hotel Reservation System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5543 CVE record

CVSS 5.3 Medium

PHPGurukul User Registration & Login and User Management System yesterday-reg-users.php sql injection
- PHPGurukul User Registration & Login and User Management System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5540 CVE record

CVSS 6.9 Medium

code-projects Simple Laundry System Parameter modifymember.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5537 CVE record

CVSS 5.3 Medium

halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection
- halex CourseSEL
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-5534 CVE record

CVSS 6.9 Medium

itsourcecode Online Enrollment System Parameter index.php sql injection
- itsourcecode Online Enrollment System
- Other injection
- SQL injection
Not analysed yet 5 Apr 2026
CVE-2026-34612 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Kestra: Remote Code Execution via SQL Injection
- kestra
- SQL injection
Not analysed yet 3 Apr 2026
CVE-2026-34788 CVE record

CVSS 6.5 Medium

Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters
- emlog
- SQL injection
Not analysed yet 3 Apr 2026
devcode-it/openstamanager Packagist

CVSS 8.8 High

OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals
- SQL injection
<2.10.2 · fixed in 2.10.2

GHSA-mmm5-3g4x-qw39 · CVE-2026-35470 Not analysed yet 3 Apr 2026
CVE-2026-27885 CVE record

CVSS 7.2 High

Piwigo: SQL Injection in Activity.getList
- Piwigo
- SQL injection
Not analysed yet 3 Apr 2026
CVE-2026-27834 CVE record

CVSS 7.2 High

Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter
- Piwigo
- SQL injection
Not analysed yet 3 Apr 2026
CVE-2026-27634 CVE record

CVSS 8.7 High

Piwigo: Pre-auth SQL injection via date filter parameters in ws_std_image_sql_filter
- Piwigo
- SQL injection
Not analysed yet 3 Apr 2026
github.com/mattermost/focalboard Go

CVSS 8.1 High

Focalboard doesn't sanitize category IDs before incorporating them into dynamic SQL statements
- SQL injection
<=7.10.6 · no fixed version yet

GHSA-p32q-v29x-wq9r · CVE-2026-25773 Not analysed yet 3 Apr 2026
devcode-it/openstamanager Packagist

CVSS 8.8 High

OpenSTAManager: SQL Injection via Aggiornamenti Module
- SQL injection
<2.10.2 · fixed in 2.10.2

GHSA-2fr7-cc4f-wh98 · CVE-2026-35168 Not analysed yet 3 Apr 2026
CVE-2026-34717 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
- opf openproject
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-5368 CVE record

CVSS 6.9 Medium

projectworlds Car Rental Project Parameter login.php sql injection
- projectworlds Car Rental Project
- Other injection
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-5334 CVE record

CVSS 6.9 Medium

itsourcecode Online Enrollment System Parameter index.php sql injection
- itsourcecode Online Enrollment System
- Other injection
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-5328 CVE record

CVSS 5.3 Medium

shsuishang modulithshop ProductItemDao ProductIndexServiceImpl.java listItem sql injection
- shsuishang modulithshop
- Other injection
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-33616 CVE record

CVSS 7.5 High

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-33615 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the setinfo Endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-33614 CVE record

CVSS 7.5 High

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
Not analysed yet 2 Apr 2026
CVE-2026-5322 CVE record

CVSS 6.9 Medium

AlejandroArciniegas mcp-data-vis MCP server.js request sql injection
- AlejandroArciniegas mcp-data-vis
- Other injection
- SQL injection
Not analysed yet 2 Apr 2026