Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
code-projects Simple Laundry System userchecklogin.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Construction Management System borrowed_tool_report.php sql injection
- itsourcecode Construction Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
PHPGurukul Online Course Registration check_availability.php sql injection
- PHPGurukul Online Course Registration
- Other injection
- SQL injection
- CVSS 6.9 Medium
PHPGurukul Online Course Registration check_availability.php sql injection
- PHPGurukul Online Course Registration
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Easy Blog Site contact_us.php sql injection
- code-projects Easy Blog Site
- Other injection
- SQL injection
- CVSS 7.5 High
LORIS has a SQL injection in MRI feedback popup
- aces Loris
- SQL injection
- CVSS 7.5 High
WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection
- shamimmoeen WCAPF – Ajax Product Filter for WooCommerce
- SQL injection
- CVSS 6.5 Medium
User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]
- wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- SQL injection
- CVSS 6.9 Medium
SQL injection in Six Apart Ltd. Movable Type and others
- Six Apart Ltd. Movable Type
- Six Apart Ltd. Movable Type Advanced
- SQL injection
- CVSS 7.6 High
WordPress FOX plugin <= 1.4.5 - SQL Injection vulnerability
- RealMag777 FOX
- SQL injection
- CVSS 7.6 High
WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability
- YayCommerce YayMail
- SQL injection
- CVSS 8.5 High
WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability
- NSquared Simply Schedule Appointments
- SQL injection
- CVSS 7.6 High
WordPress Amelia plugin <= 2.1.1 - SQL Injection vulnerability
- Amelia
- SQL injection
- CVSS 8.5 High
WordPress Download Monitor plugin <= 5.1.8 - SQL Injection vulnerability
- WP Chill Download Monitor
- SQL injection
- CVSS 7.6 High
WordPress OttoKit plugin <= 1.1.20 - SQL Injection vulnerability
- Brainstorm Force OttoKit
- SQL injection
- CVSS 7.6 High
WordPress User Feedback plugin <= 1.10.1 - SQL Injection vulnerability
- Syed Balkhi User Feedback
- SQL injection
- CVSS 7.6 High
WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injection vulnerability
- WPMU DEV - Your All-in-One WordPress Platform Broken Link Checker
- SQL injection
- CVSS 5.4 Medium
Attendance Manager <= 0.6.2 - Authenticated (Subscriber+) SQL Injection via 'attmgr_off' Parameter
- tnomi Attendance Manager
- SQL injection
- CVSS 8.7 High
SQL injection in ICZ Corporation MATCHA INVOICE
- ICZ Corporation MATCHA INVOICE
- SQL injection
- CVSS 7.5 High
Drizzle ORM has SQL injection via improperly escaped SQL identifiers
- SQL injection
<0.45.2 || >=1.0.0-beta.2, <1.0.0-beta.20 · fixed in 0.45.2, 1.0.0-beta.20
GHSA-gpj5-g38j-94v9 · CVE-2026-39356 - CVSS 6.9 Medium
PowerJob vulnerable to SQL injection
- Other injection
- SQL injection
>=5.1.0, <=5.1.2 · no fixed version yet
GHSA-4fp2-3xgg-jg4w · CVE-2026-5736 - CVSS 8.8 High
ChurchCRM has a Second Order SQLI via FundRaiserEditor.php
- CRM
- SQL injection
- CVSS 7.2 High
ChurchCRM has a SQL Injection in Event Type Editor (Admin)
- CRM
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
ChurchCRM has a SQL injection searchwhat parameter via QueryView.php
- CRM
- SQL injection
- CVSS 8.1 High
SQL injection in ChurchCRM.0
- CRM
- SQL injection
- CVSS 8.1 High
ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a Blind SQL injection in SettingsIndividual.php
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a Blind SQL injection in PropertyAssign.php
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a Blind SQL injection in EventNames.php
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a SQL injection in MemberRoleChange.php
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php
- CRM
- SQL injection
- CVSS 7.2 High
ChurchCRM has a Blind SQL injection in SettingsUser.php
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php
- CRM
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Windmill < 1.603.3 File Ownership Handling SQLi RCE
- Windmill Labs Windmill CE (Community Edition)
- Windmill Labs Windmill EE (Enterprise Edition)
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Frappe has a SQL injection in bulk_update
- frappe
- SQL injection
- CVSS 6.4 Medium
runZero Platform SQL injection in saved queries
- runZero Platform
- SQL injection
- CVSS 5.3 Medium
itsourcecode Construction Management System borrowedtool.php sql injection
- itsourcecode Construction Management System
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the POST parameter bib_list in /cgi-bin/koha/opac-sendbasket.pl,…
- SQL injection
- CVSS 8.8 High
WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.7 High
EcclesiaCRM has a Critical SQL Injection
- phili67 ecclesiacrm
- SQL injection
- CVSS 5.3 Medium
itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection
- itsourcecode sanitize or validate this input
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Construction Management System Parameter borrowed_tool.php sql injection
- itsourcecode Construction Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection
- code-projects Simple IT Discussion Forum
- Other injection
- SQL injection
- CVSS 6.9 Medium
Cyber-III Student-Management-System Parameter login.php sql injection
- Cyber-III Student-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Online FIR System Login checklogin.php sql injection
- code-projects Online FIR System
- Other injection
- SQL injection
- CVSS 8.5 High
WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability
- David Lingren Media LIbrary Assistant
- SQL injection
- CVSS 7.2 High
GLPI has an Authenticated SQL Injection via log exports
- glpi
- SQL injection
- CVSS 8.1 High
GLPI has an Unauthenticated SQL Injection via Search engine
- glpi
- SQL injection
- CVSS 5.3 Medium
itsourcecode Construction Management System Parameter borrowed_equip.php sql injection
- itsourcecode Construction Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects Online Application System for Admission Endpoint admsnform.php sql injection
- code-projects Online Application System for Admission
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Simple Laundry System Parameter userfinishregister.php sql injection
- code-projects Simple Laundry System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Easy Blog Site login.php sql injection
- code-projects Easy Blog Site
- Other injection
- SQL injection
- CVSS 6.9 Medium
projectworlds Car Rental System Parameter pay.php sql injection
- projectworlds Car Rental System
- Other injection
- SQL injection
- CVSS 5.3 Medium
PHPGurukul Online Shopping Portal Project Parameter update-image1.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
- CVSS 5.3 Medium
PHPGurukul Online Shopping Portal Project Parameter update-image2.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
- CVSS 5.3 Medium
PHPGurukul Online Shopping Portal Project Parameter update-image3.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
- CVSS 6.9 Medium
projectworlds Car Rental System Parameter message_admin.php sql injection
- projectworlds Car Rental System
- Other injection
- SQL injection
- CVSS 5.3 Medium
PHPGurukul Online Shopping Portal Project Parameter cancelorder.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
- CVSS 5.3 Medium
PHPGurukul Online Shopping Portal Project Parameter categorywise-products.php sql injection
- PHPGurukul Online Shopping Portal Project
- Other injection
- SQL injection
- CVSS 6.9 Medium
projectworlds Car Rental Project Parameter book_car.php sql injection
- projectworlds Car Rental Project
- Other injection
- SQL injection