Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection
- Dataease
- Other injection
- SQL injection
- CVSS 7.1 High
Fuel CMS 1.4.13 Blind SQL Injection via col Parameter
- Getfuelcms Fuel CMS
- SQL injection
- CVSS 8.8 High
EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname
- EgavilanMedia PHPCRUD
- SQL injection
- CVSS 8.8 High
LayerBB 1.1.4 SQL Injection via search_query Parameter
- LayerBB
- SQL injection
- CVSS 8.8 High
WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx
- Supsystic Membership
- SQL injection
- CVSS 8.8 High
WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS
- Supsystic Pricing Table
- SQL injection
- CVSS 8.8 High
WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx
- Supsystic Ultimate Maps
- SQL injection
- CVSS 7.5 High
Duplicate Advisory: phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
- SQL injection
<4.1.2 · fixed in 4.1.2
GHSA-p9wc-4pjv-rg82 - CVSS 9.8 Critical
Duplicate Advisory: phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
- SQL injection
<4.1.2 · fixed in 4.1.2
GHSA-ch9q-c9mp-j5gq - CVSS 8.7 High
Vvveb: Authenticated SQL injection in /user/orders via order_by and direction
- givanz Vvveb
- SQL injection
- CVSS 8.8 High
PHP Timeclock 1.04 SQL Injection via login.php
- PHP Timeclock
- SQL injection
- CVSS 4.9 Medium
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Marten has an injection vulnerability in its full-text search regConfig parameter
- Other injection
- SQL injection
<8.37.0 · fixed in 8.37.0
GHSA-vmw2-qwm8-x84c · CVE-2026-45288 - CVSS 7.1 High
ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 8.9 High
n8n Has a Source Control Pull SQL Injection
- SQL injection
<1.123.43 || >=2.0.0-rc.0, <2.20.7 || >=2.21.0, <2.21.1 · fixed in 1.123.43, 2.20.7, 2.21.1
GHSA-mhrx-qhrj-673w · CVE-2026-44792 - CVSS 3.7 Low
PostgreSQL REFRESH PUBLICATION allows SQL injection via table name
- PostgreSQL
- SQL injection
- CVSS 8.8 High
PostgreSQL refint allows stack buffer overflow and SQL injection
- PostgreSQL
- SQL injection
- Memory corruption
- CVSS 7.2 High
PostgreSQL pg_createsubscriber allows SQL injection via subscription name
- PostgreSQL
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQLi in Akıllı Ticaret's E-Commerce Pack
- Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website
- SQL injection
- CVSS 6.5 Medium
Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter
- Taskbuilder – Project Management & Task Management Tool With Kanban Board
- SQL injection
- CVSS 7.1 High
SQL injection in Alinto SOGo
- Alinto SOGo
- SQL injection
- CVSS 7.1 High
SQL injection in Alinto SOGo
- Alinto SOGo
- SQL injection
- CVSS 6.5 Medium
Unlimited Elements For Elementor <= 2.0.7 - Authenticated (Contributor+) SQL Injection via 'filter_search' Parameter
- unitecms Unlimited Elements For Elementor
- SQL injection
- CVSS 8.1 High
SQL injection in WebPros cPanel and others
- WebPros cPanel
- WebPros WP Squared
- SQL injection
- CVSS 8.8 High
ERPNext: Possibility of SQL Injection due to missing validation
- frappe erpnext
- SQL injection
- CVSS 8.8 High
ERPNext: Possibility of SQL Injection due to missing validation
- frappe erpnext
- SQL injection
- CVSS 8.7 High
Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm
- phili67 ecclesiacrm
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings
- MISP
- SQL injection
- CVSS 4.9 Medium
CubeCart: Authenticated SQL Injection via `sort[]` Parameter in Admin Orders Transactions Listing
- cubecart v6
- SQL injection
- CVSS 7.2 High
CubeCart: Time-based Blind SQL Injection
- cubecart v6
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Strapi Vulnerable to SQL Injection in Content Type Builder
- SQL injection
>=5.0.0, <5.33.2 · fixed in 5.33.2
GHSA-3xcq-8mjw-h6mx · CVE-2026-22599 - CVSS 6.1 Medium
Trust Protection Foundation: SQL Injection Vulnerability
- Palo Alto Networks Trust Protection Foundation
- SQL injection
- CVSS 7.1 High
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby
- Joomsky J2 JOBS
- SQL injection
- CVSS 7.1 High
Joomla J2 JOBS 1.3.0 Authenticated SQL Injection via sortby
- Joomsky J2 JOBS
- SQL injection
- CVSS 8.8 High
Joomla com_hdwplayer 4.2 SQL Injection via search.php
- com_hdwplayer
- SQL injection
- CVSS 6.5 Medium
ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
- metagauss ProfileGrid – User Profiles, Groups and Communities
- SQL injection
- CVSS 7.5 High
Avada Builder <= 3.15.1 - Unauthenticated SQL Injection via 'product_order' Parameter
- themefusion Avada (Fusion) Builder
- SQL injection
- CVSS 7.5 High
JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
- beardev JoomSport – for Sports: Team & League, Football, Hockey & more
- SQL injection
- CVSS 6.5 Medium
Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter
- smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
- SQL injection
- CVSS 7.2 High
SQL Injection Vulnerability
- Advantech SaaS Composer
- Advantech IoTSuite Growth Linux docker
- SQL injection
- CVSS 6.5 Medium
qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file.
- SQL injection
- CVSS 6.5 Medium
qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file.
- SQL injection
- CVSS 7.5 High
Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection
- webmuehle Court Reservation – Manage Your Court Bookings Online
- SQL injection
- CVSS 7.2 High
Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
- CVSS 7.2 High
Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
- CVSS 7.2 High
Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
- CVSS 7.2 High
Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
- CVSS 7.2 High
Authenticated Remote Code Execution via SQL Injection in AOS-8 and AOS-10 Operating Systems
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Wireless Operating System (AOS)
- SQL injection
- CVSS 6.5 Medium
Shelf: SQL Injection via sortBy Parameter
- Shelf-nu shelf.nu
- SQL injection
- CWE-20
- CVSS 6.3 Medium
SQL injection in Fortinet FortiMail
- Fortinet FortiMail
- SQL injection
- CVSS 4.9 Medium
SQL injection in Fortinet FortiNDR
- Fortinet FortiNDR
- SQL injection
- CVSS 7.6 High
SQL Injection in Graph Container Parameter
- Pandora FMS
- SQL injection
- CVSS 8.8 High
SQL injection in ivanti Endpoint Manager
- ivanti Endpoint Manager
- SQL injection
- CVSS 7.5 High
SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3
- SQL injection
>=0.16.0, <0.22.2 · fixed in 0.22.2
GHSA-r73h-97w8-m54h · CVE-2026-32687 - CVSS 7.4 High
SQL injection in Open-Xchange GmbH OX Dovecot Pro
- Open-Xchange GmbH OX Dovecot Pro
- SQL injection
- CWE-235
- CVSS 7.7 High
WordPress WP Travel plugin <= 11.4.0 - SQL Injection vulnerability
- WP Travel
- SQL injection
- CVSS 8.5 High
WordPress Xpro Elementor Addons plugin <= 1.5.1 - SQL Injection vulnerability
- Xpro Elementor Addons
- SQL injection
- CVSS 7.6 High
WordPress BEAR plugin <= 1.1.7.1 - SQL Injection vulnerability
- RealMag777 BEAR
- SQL injection
- CVSS 8.5 High
WordPress APIExperts Square for WooCommerce plugin <= 4.7.1 - SQL Injection vulnerability
- Saad Iqbal APIExperts Square for WooCommerce
- SQL injection
- CVSS 8.5 High
WordPress Views for WPForms plugin <= 3.4.6 - SQL Injection vulnerability
- Aman Views for WPForms
- SQL injection