Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.4 CriticalCritical · CVSS 9+
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php.
- SQL injection
- CVSS 7.3 High
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.
- SQL injection
- CVSS 7.3 High
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.
- SQL injection
- CVSS 7.6 High
WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability
- WC Lovers WCFM Marketplace
- SQL injection
- CVSS 4.3 Medium
Cisco Unity Connection SQL Injection Vulnerability
- Cisco Unity Connection
- SQL injection
- CVSS 7.6 High
WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability
- bdthemes Element Pack Elementor Addons
- SQL injection
- CVSS 8.5 High
WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability
- Beaver Builder
- SQL injection
- CVSS 8.6 High
Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
@vendure/core has a SQL Injection vulnerability
- SQL injection
>=1.7.4, <2.3.4 || >=3.0.0, <3.5.7 || >=3.6.0, <3.6.2 · fixed in 2.3.4, 3.5.7, 3.6.2
GHSA-9pp3-53p2-ww9v · CVE-2026-40887 - CVSS 7.1 High
Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)
- chamilo-lms
- SQL injection
- CVSS 6.7 Medium
SQL Server Elevation of Privilege Vulnerability
- Microsoft SQL Server 2016 Service Pack 3 (GDR)
- Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack
- SQL injection
- CVSS 6.7 Medium
SQL Server Elevation of Privilege Vulnerability
- Microsoft SQL Server 2016 Service Pack 3 (GDR)
- Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack
- SQL injection
- CVSS 6.5 Medium
SQL injection in Fortinet FortiManager and others
- Fortinet FortiManager
- Fortinet FortiAnalyzer
- SQL injection
- CVSS 7.9 High
SQL injection in Fortinet FortiDDoS-F
- Fortinet FortiDDoS-F
- SQL injection
- CVSS 6.2 Medium
SQL injection in Fortinet FortiClientEMS
- Fortinet FortiClientEMS
- SQL injection
- CVSS 7.5 High
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter
- Crocoblock JetEngine
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse
- SAP_SE SAP Business Planning and Consolidation and SAP Business Warehouse
- SQL injection
- CVSS 7.7 High
Craft Commerce has a SQL Injection can lead to Remote Code Execution via TotalRevenue Widget
- SQL injection
>=4.0.0, <4.10.3 || >=5.0.0, <5.5.5 · fixed in 4.10.3, 5.5.5
GHSA-875v-7m49-8x88 · CVE-2026-32271 - CVSS 8.7 High
Craft Commerce hasVariant/hasProduct Blind SQL Injection
- SQL injection
>=5.0.0, <5.6.0 · fixed in 5.6.0
GHSA-r54v-qq87-px5r · CVE-2026-32272 - CVSS 7.1 High
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettings.php?f=update_settings.
- SQL injection
- CVSS 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_att.php.
- SQL injection
- CVSS 2.7 Low
Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php.
- SQL injection
- CVSS 2.7 Low
Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the file /storage/admin/tenants/view_details.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php.
- SQL injection
- CVSS 2.7 Low
SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/maintenance/manage_storage_unit.php.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
A SQL injection vulnerability exists in the School Management System (version 1.0) by manikandan580.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.
- SQL injection
- CVSS 5.3 Medium
code-projects Easy Blog Site post.php sql injection
- code-projects Easy Blog Site
- Other injection
- SQL injection
- CVSS 6.9 Medium
PHPGurukul Daily Expense Tracking System register.php sql injection
- PHPGurukul Daily Expense Tracking System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Construction Management System equipments.php sql injection
- itsourcecode Construction Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Construction Management System employees.php sql injection
- itsourcecode Construction Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- SQL injection
- CVSS 8.7 High
SQL Injection in Custom Fields leads to Database Compromise
- Pandora FMS
- SQL injection
- CVSS 8.7 High
SQL Injection in Module Search leads to Database Compromise
- Pandora FMS
- SQL injection
- CVSS 6.9 Medium
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Simple Content Management System index.php sql injection
- code-projects Simple Content Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Simple Content Management System login.php sql injection
- code-projects Simple Content Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Faculty Management System subject-print.php sql injection
- code-projects Faculty Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Vehicle Showroom Management System UpdateVehicleFunction.php sql injection
- code-projects Vehicle Showroom Management System
- Other injection
- SQL injection
- CVSS 8.6 High
Product Filter for WooCommerce by WBW < 3.1.3 - Unauthenticated SQLi
- Product Filter for WooCommerce by WBW
- SQL injection
- CVSS 6.8 Medium
Form Maker < 1.15.38 - SQL Injection
- Form Maker by 10Web
- SQL injection
- CVSS 6.9 Medium
code-projects Vehicle Showroom Management System Login_check.php sql injection
- code-projects Vehicle Showroom Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Lost and Found Thing Management addcat.php sql injection
- code-projects Lost and Found Thing Management
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Lost and Found Thing Management catageory.php sql injection
- code-projects Lost and Found Thing Management
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Simple ChatBox Endpoint insert.php sql injection
- code-projects Simple ChatBox
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Vehicle Showroom Management System StaffDetailsFunction.php sql injection
- code-projects Vehicle Showroom Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Vehicle Showroom Management System StaffAddingFunction.php sql injection
- code-projects Vehicle Showroom Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Vehicle Showroom Management System PaymentStatusFunction.php sql injection
- code-projects Vehicle Showroom Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Vehicle Showroom Management System BookVehicleFunction.php sql injection
- code-projects Vehicle Showroom Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Vehicle Showroom Management System MonthTotalReportUpdateFunction.php sql injection
- code-projects Vehicle Showroom Management System
- Other injection
- SQL injection