Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.5 High
WordPress Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection vulnerability
- Aman Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQLi in Akilli Commerce's E-Commerce Website
- Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website
- SQL injection
- CVSS 5.9 Medium
SQL injection in Siemens blueplanet 100 NX3 M8 and others
- Siemens blueplanet 100 NX3 M8
- Siemens blueplanet 100 TL3 GEN2
- SQL injection
- CVSS 6.5 Medium
Eight Day Week Print Workflow <= 1.2.6 - Authenticated (Subscriber+) SQL Injection via 'title' Parameter
- 10up Eight Day Week Print Workflow
- SQL injection
- CVSS 7.5 High
AI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated SQL Injection in getListForTbl()
- wupsales AI Chatbot & Workflow Automation by AIWU
- SQL injection
- CVSS 3.4 Low
SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library
- SAP_SE SAP HANA Deployment Infrastructure (HDI) deploy library
- SQL injection
- CVSS 9.6 CriticalCritical · CVSS 9+
SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)
- SAP_SE SAP S/4HANA (SAP Enterprise Search for ABAP)
- SQL injection
- CVSS 7.5 High
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
- Path traversal
- SQL injection
>=0.26.0, <0.28.17 · fixed in 0.28.17
GHSA-pv5w-4p9q-p3v2 · CVE-2026-44635 - CVSS 8.7 High
pgAdmin 4: OS command injection vulnerability in Import/Export query export
- Command injection
- SQL injection
<9.15 · fixed in 9.15
GHSA-j74f-g7vx-fh4x · CVE-2026-7816 - CVSS 8.7 High
SQL injection vulnerability in pgAdmin 4 Maintenance Tool
- SQL injection
<9.15 · fixed in 9.15
GHSA-hp84-p2gq-6fvr · CVE-2026-7815 - CVSS 8.8 High
elFinder MySQL has a SQL Injection in its Volume Driver (elFinderVolumeMySQL)
- SQL injection
<2.1.68 · fixed in 2.1.68
GHSA-c3gj-q88f-7hqj · CVE-2026-44521 - CVSS 6.0 Medium
Corteza 2024.9.8 - SQL Injection in MSSQL JSON-path meta filter via incorrect T-SQL string escaping
- corteza
- SQL injection
- CVSS 6.3 Medium
PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries
- SQL injection
- CWE-20
>=2.4.1, <4.6.34 · fixed in 4.6.34
GHSA-3643-7v76-5cj2 · CVE-2026-44337 - CVSS 9.8 CriticalCritical · CVSS 9+
HireFlow v1.2 is vulnerable to SQL injection in the /login and /search endpoints.
- SQL injection
- CVSS 7.3 High
SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve unauthorized administrative access, and potentially gain remote code execution…
- SQL injection
- CVSS 8.8 High
WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss_params
- Modalsurvey Survey & Poll
- SQL injection
- CVSS 8.8 High
Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthenticated
- Balbooa Joomla Forms Builder
- SQL injection
- CVSS 8.8 High
Opencart TMD Vendor System 3.x Blind SQL Injection via product route
- opencartextensions Extension TMD Vendor System
- SQL injection
- CVSS 5.3 Medium
CodeAstro Online Catering Ordering System deleteorder.php sql injection
- CodeAstro Online Catering Ordering System
- Other injection
- SQL injection
- CVSS 7.4 High
SQL injection in pdo_firebird via NUL bytes in quoted strings
- PHP
- SQL injection
- CVSS 7.0 High
SQL injection in gibbon
- gibbon
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions
- emlog
- SQL injection
- CVSS 7.6 High
MikroORM has SQL injection via runtime-controlled identifiers and JSON-path keys
- SQL injection
<6.6.14 · fixed in 6.6.14
GHSA-cfw5-68c4-ffqp · CVE-2026-44680 - CVSS 8.6 High
SureTriggers < 1.1.23 – Unauthenticated SQLi
- OttoKit: All-in-One Automation Platform
- SQL injection
- CVSS 6.9 Medium
zyx0814 FilePress Shares Filelist API admin.php sql injection
- zyx0814 FilePress
- Other injection
- SQL injection
- CVSS 6.9 Medium
CodeAstro Leave Management System login.php sql injection
- CodeAstro Leave Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester SUP Online Shopping replymsg.php sql injection
- SourceCodester SUP Online Shopping
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester SUP Online Shopping message.php sql injection
- SourceCodester SUP Online Shopping
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester SUP Online Shopping wishlist.php sql injection
- SourceCodester SUP Online Shopping
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester SUP Online Shopping viewmsg.php sql injection
- SourceCodester SUP Online Shopping
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Comment System post_comment.php sql injection
- SourceCodester Comment System
- Other injection
- SQL injection
- CVSS 5.3 Medium
code-projects Simple Chat System sendMessage.php sql injection
- code-projects Simple Chat System
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint.
- SQL injection
- CVSS 6.3 Medium
SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].
- SQL injection
- CVSS 7.3 High
Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username that is both a valid SQL statement and a valid regular express…
- SQL injection
- CVSS 5.3 Medium
JeecgBoot JSON Object loadTreeData sql injection
- JeecgBoot
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Feedback System checklogin.php sql injection
- code-projects Feedback System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Online Classroom askquery.php sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection
- SourceCodester Pharmacy Sales and Inventory System
- Other injection
- SQL injection
- CVSS 7.6 High
WordPress Team Member plugin <= 8.5 - SQL Injection vulnerability
- WPMart Team Member
- SQL injection
- CVSS 7.5 High
BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter
- BetterDocs Pro
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
- SQL injection
- Information disclosure
<7.5.0 · fixed in 7.5.0
GHSA-9h64-2846-7x7f - CVSS 7.1 High
Daptin fuzzy search injects unvalidated column name into raw SQL
- SQL injection
<0.11.5 · fixed in 0.11.5
GHSA-pwqg-q8pg-pp6r · CVE-2026-44349 - CVSS 8.8 High
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
- SQL injection
<3.18.1 · fixed in 3.18.1
GHSA-xwqr-rcqg-22mr · CVE-2026-42550 - CVSS 9.3 CriticalCritical · CVSS 9+
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
- SQL injection
<4.1.2 · fixed in 4.1.2
GHSA-289f-fq7w-6q2w · CVE-2026-46364 - CVSS 7.7 High
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
- SQL injection
<4.1.2 · fixed in 4.1.2
GHSA-pm8c-3qq3-72w7 · CVE-2026-46359 - CVSS 7.5 High
Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter
- GravityMore Gravity Bookings
- SQL injection
- CVSS 8.8 High
YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`
- SQL injection
- CWE-841
<4.0.5 · fixed in 4.0.5
GHSA-xhw7-j96h-c3g5 · CVE-2026-43937 - CVSS 9.3 CriticalCritical · CVSS 9+
Masa CMS unauthenticated SQL injection via altTable parameter in JSON API
- MasaCMS
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Masa CMS SQL injection via sortDirection parameter in beanFeed
- MasaCMS
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL Injection vulnerability via sortBy in beanFeed
- MasaCMS
- SQL injection
- CVSS 8.1 High
SQL injection in ProFTPD
- ProFTPD
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
SQLBot prompt injection allows arbitrary SQL execution and remote code execution
- dataease SQLBot
- SQL injection
- CVSS 7.5 High
WeePie Cookie Allow <= 3.4.11 - Unauthenticated SQL Injection via 'consent' Parameter
- WeePie Cookie Allow
- SQL injection
- CVSS 7.5 High
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WebinarIgnition plugin <= 4.08.253 - SQL Injection vulnerability
- Saleswonder LLC WebinarIgnition
- SQL injection
- CVSS 5.3 Medium
itsourcecode Courier Management System print_pdets.php sql injection
- itsourcecode Courier Management System
- Other injection
- SQL injection
- CVSS 7.5 High
GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'
- ahmadgb GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content
- SQL injection
- CVSS 8.7 High
SQL injection in Oracle Corporation Oracle MCP Server Helper Tool product of Oracle Open Source…
- Oracle Corporation Oracle MCP Server Helper Tool product of Oracle Open Source Projects
- SQL injection