Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
AWP Classifieds <= 4.4.5 - Unauthenticated SQL Injection via 'regions'
- strategy11team AWP Classifieds
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Kestra v1.3.3 and before is vulnerable to SQL Injection.
- SQL injection
- CVSS 5.3 Medium
CodeCanyon Perfex CRM Admin Kanban Endpoint AbstractKanban.php applySortQuery sql injection
- CodeCanyon Perfex CRM
- Other injection
- SQL injection
- CVSS 5.3 Medium
SourceCodester Web-based Pharmacy Product Management System edit-admin.php sql injection
- SourceCodester Web-based Pharmacy Product Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Online Classroom facultydetails sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Online Classroom addnewstudent sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Online Classroom studentdetails sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Online Classroom facultylogin sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Online Classroom studentlogin sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects BloodBank Managing System get_state.php sql injection
- code-projects BloodBank Managing System
- Other injection
- SQL injection
- CVSS 6.9 Medium
Shandong Hoteam Software PDM Product Data Management System DataService GetQueryMachineGridOnePageData sql injection
- Shandong Hoteam Software PDM Product Data Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects Gym Management System In PHP/Windows NT index.php sql injection
- code-projects Gym Management System In PHP
- code-projects Windows NT
- Other injection
- SQL injection
- CVSS 5.3 Medium
Dromara MaxKey StrUtils.java StrUtils.checkSqlInjection sql injection
- Dromara MaxKey
- Other injection
- SQL injection
- CVSS 5.1 Medium
AMTT Hotel Broadband Operation System cardhand_submit.php sql injection
- AMTT Hotel Broadband Operation System
- Other injection
- SQL injection
- CVSS 2.3 Low
Dolibarr has an Injection issue
- Other injection
- SQL injection
<=23.0.2 · no fixed version yet
GHSA-rvwr-q5hj-wq7g · CVE-2026-7688 - CVSS 6.9 Medium
Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform elecMaxMinAvgValue sql injection
- Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform
- Other injection
- SQL injection
- CVSS 6.9 Medium
Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System elecMaxMinAvgValue sql injection
- Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
YunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
- YunaiV yudao-cloud
- Other injection
- SQL injection
- CVSS 5.3 Medium
youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection
- youlaitech youlai-boot
- Other injection
- SQL injection
- CVSS 6.9 Medium
Jinher OA UserSel.aspx sql injection
- Jinher OA
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Online Hospital Management System viewappointment.php sql injection
- code-projects Online Hospital Management System
- Other injection
- SQL injection
- CVSS 7.5 High
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'map_post_type' Parameter
- cyberhobo Geo Mashup
- SQL injection
- CVSS 7.5 High
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'object_ids' Parameter
- cyberhobo Geo Mashup
- SQL injection
- CVSS 7.5 High
Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter
- cyberhobo Geo Mashup
- SQL injection
- CVSS 5.1 Medium
itsourcecode Courier Management System edit_user.php sql injection
- itsourcecode Courier Management System
- Other injection
- SQL injection
- CVSS 8.7 High
Sunnet｜CTMS - SQL Injection
- Sunnet CTMS
- SQL injection
- CVSS 6.5 Medium
Geo Mashup <= 1.13.19 - Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter
- cyberhobo Geo Mashup
- SQL injection
- CVSS 7.5 High
ARMember <= 4.0.60 - Unauthenticated SQL Injection via 'orderby' Parameter
- reputeinfosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
- SQL injection
- CVSS 6.9 Medium
itsourcecode Courier Management System edit_staff.php sql injection
- itsourcecode Courier Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection
- TimBroddin astro-mcp-server
- Other injection
- SQL injection
- CVSS 6.5 Medium
MixPHP Framework has an SQL injection vulnerability
- SQL injection
>=2.0.0, <=2.2.17 · no fixed version yet
GHSA-vf35-8m4j-gm8v · CVE-2026-42475 - CVSS 6.5 Medium
MixPHP Framework has an SQL injection vulnerability via crafted `data` array
- SQL injection
>=2.0.0, <=2.2.17 · no fixed version yet
GHSA-q57j-rwwx-7rwp · CVE-2026-42474 - CVSS 6.9 Medium
itsourcecode Electronic Judging System login.php sql injection
- itsourcecode Electronic Judging System
- Other injection
- SQL injection
- CVSS 5.1 Medium
code-projects Gym Management System edit_exercises.php sql injection
- code-projects Gym Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Pharmacy Sales and Inventory System ajax.php save_customer sql injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Pharmacy Sales and Inventory System ajax.php delete_customer sql injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Advanced School Management System checkEmail Endpoint commonController.php sql injection
- SourceCodester Advanced School Management System
- Other injection
- SQL injection
- CVSS 4.9 Medium
SQL Injection via ORDER BY clause in V2Board thru 1.7.4.
- SQL injection
- CVSS 6.9 Medium
SourceCodester Hotel Management System check sql injection
- SourceCodester Hotel Management System
- Other injection
- SQL injection
- CVSS 6.4 Medium
Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw
- IBM Langflow Desktop
- SQL injection
- CVSS 8.6 High
SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString
- siteserver SSCMS
- SQL injection
- CVSS 5.3 Medium
SourceCodester Pet Grooming Management Software update_customer.php sql injection
- SourceCodester Pet Grooming Management Software
- Other injection
- SQL injection
- CVSS 8.3 High
CKAN has Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
- SQL injection
- Broken access control
<2.10.10 || >=2.11.0, <2.11.5 · fixed in 2.10.10, 2.11.5
GHSA-h7j7-3rx6-xvcg · CVE-2026-42031 - CVSS 5.3 Medium
SourceCodester Pizzafy Ecommerce System ajax.php add_to_cart sql injection
- SourceCodester Pizzafy Ecommerce System
- Other injection
- SQL injection
- CVSS 5.3 Medium
n8n has SQL Injection in SeaTable Node
- SQL injection
<1.123.32 || >=2.0.0, <2.17.4 || >=2.18.0, <2.18.1 · fixed in 1.123.32, 2.17.4, 2.18.1
GHSA-mp4j-h6gh-f6mp · CVE-2026-42229 - CVSS 5.3 Medium
n8n has SQL Injection in Oracle Database Node via Limit Field
- SQL injection
- CWE-20
<1.123.32 || >=2.0.0, <2.17.4 || >=2.18.0, <2.18.1 · fixed in 1.123.32, 2.17.4, 2.18.1
GHSA-r6jc-mpqw-m755 · CVE-2026-42233 - CVSS 5.3 Medium
n8n has SQL Injection in Snowflake and MySQL Nodes
- SQL injection
<1.123.32 || >=2.0.0, <2.17.4 || >=2.18.0, <2.18.1 · fixed in 1.123.32, 2.17.4, 2.18.1
GHSA-hp3c-vfpm-q4f7 · CVE-2026-42237 - CVSS 5.1 Medium
SourceCodester Pizzafy Ecommerce System ajax.php save_user sql injection
- SourceCodester Pizzafy Ecommerce System
- Other injection
- SQL injection
- CVSS 7.2 High
appsmith has SQL Injection in FilterDataService via Unsafe DROP TABLE Execution
- SQL injection
<1.99 · fixed in 1.99
GHSA-h8cj-hpmg-636v - CVSS 5.1 Medium
SourceCodester Pizzafy Ecommerce System ajax.php save_menu sql injection
- SourceCodester Pizzafy Ecommerce System
- Other injection
- SQL injection
- CVSS 5.1 Medium
SourceCodester Pizzafy Ecommerce System Setting ajax.php save_settings sql injection
- SourceCodester Pizzafy Ecommerce System
- Other injection
- SQL injection
- CVSS 8.8 High
XATABoost CMS 1.0.0 SQL Injection via news.php
- XATABoost CMS
- SQL injection
- CVSS 5.1 Medium
SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection
- SourceCodester Pizzafy Ecommerce System
- Other injection
- SQL injection
- CVSS 5.3 Medium
SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- SQL injection
- CVSS 5.3 Medium
SourceCodester Pharmacy Sales and Inventory System ajax.php save_supplier sql injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- SQL injection
- CVSS 6.9 Medium
EyouCMS common.php GetSortData sql injection
- EyouCMS
- Other injection
- SQL injection
- CVSS 7.6 High
WordPress TaxoPress plugin <= 3.44.0 - SQL Injection vulnerability
- Steve Burge TaxoPress
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
SQL injection in MegaCMS by CRM Sistemas de Fidelización
- CRM Sistemas de Fidelización MegaCMS
- SQL injection
- CVSS 5.1 Medium
SourceCodester Pizzafy Ecommerce System ajax.php delete_category sql injection
- SourceCodester Pizzafy Ecommerce System
- Other injection
- SQL injection
- CVSS 5.3 Medium
JeecgBoot loadDict Endpoint SqlInjectionUtil.java SqlInjectionUtil sql injection
- JeecgBoot
- Other injection
- SQL injection