Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.8 High
The Open ISES Project 3.30A SQL Injection via add_facnote.php
- Open ISES Project
- SQL injection
- CVSS 8.8 High
The Open ISES Project 3.30A SQL Injection via city_graph.php
- Open ISES Project
- SQL injection
- CVSS 8.8 High
The Open ISES Project 3.30A SQL Injection via inc_types_graph.php
- Open ISES Project
- SQL injection
- CVSS 8.8 High
The Open ISES Project 3.30A SQL Injection via sever_graph.php
- Open ISES Project
- SQL injection
- CVSS 8.8 High
The Open ISES Project 3.30A SQL Injection via form_post.php
- Open ISES Project
- SQL injection
- CVSS 8.8 High
The Open ISES Project 3.30A SQL Injection via nearby.php
- Open ISES Project
- SQL injection
- CVSS 8.8 High
The Open ISES Project 3.30A SQL Injection via main.php
- Open ISES Project
- SQL injection
- CVSS 8.8 High
Kados R10 GreenBee SQL Injection via update_feature.php
- Kados R10 GreenBee
- SQL injection
- CVSS 8.8 High
Kados R10 GreenBee SQL Injection via update_release.php
- Kados R10 GreenBee
- SQL injection
- CVSS 7.1 High
MaxOn ERP Software 8.x-9.x SQL Injection via nomor Parameter
- Talagasoft MaxOn ERP
- SQL injection
- CVSS 8.8 High
HaPe PKH 1.1 SQL Injection via desa Parameter
- Sitejo HaPe PKH
- SQL injection
- CVSS 8.8 High
HaPe PKH 1.1 SQL Injection via nama_kelompok Parameter
- Sitejo HaPe PKH
- SQL injection
- CVSS 8.8 High
HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php
- Sitejo HaPe PKH
- SQL injection
- CVSS 8.8 High
E-Registrasi Pencak Silat 18.10 SQL Injection via id_partai
- eregistrasi-kejuaraan-silat Registrasi Pencak Silat
- SQL injection
- CVSS 8.8 High
Zechat 1.5 SQL Injection via uname Parameter
- Bylancer Zechat
- SQL injection
- CVSS 8.5 High
FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports
- FreePBX security-reporting
- SQL injection
- CVSS 4.9 Medium
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
- shabti Frontend Admin by DynamiApps
- SQL injection
- CVSS 6.5 Medium
Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages.
- SQL injection
- CVSS 7.0 High
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save
- SQL injection
<11.5.17 || >=12.0.0-RC1, <12.3.7 || >=2026.1.0, <2026.1.3 · fixed in 11.5.17, 12.3.7, 2026.1.3
GHSA-r2f4-ff2p-xc64 · CVE-2026-5394 - CVSS 6.5 Medium
Photo Gallery by 10Web <= 1.8.40 - Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- SQL injection
- CVSS 7.5 High
Appointment Booking Calendar <= 1.6.11.8 - Unauthenticated SQL Injection via 'append_where_sql' Parameter
- croixhaug Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- SQL injection
- CVSS 6.3 Medium
Symfony Vulnerable to SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
- SQL injection
<5.4.52 || >=6.0.0, <6.4.40 || >=7.0.0, <7.4.12 || >=8.0.0, <8.0.12 · fixed in 5.4.52, 6.4.40, 7.4.12, 8.0.12
GHSA-6qh9-h6wf-jgqc · CVE-2026-45073 - CVSS 9.8 CriticalCritical · CVSS 9+
Langroid has Prompt to SQL Injection, Leading to RCE
- SQL injection
- Code injection
<0.63.0 · fixed in 0.63.0
GHSA-mxfr-6hcw-j9rq · CVE-2026-25879 - CVSS 8.7 High
Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection
- leiweibau Pi.Alert
- SQL injection
- CVSS 8.5 High
WordPress Duplicate Page and Post plugin <= 2.9.5 - SQL Injection vulnerability
- Arjun Thakur Duplicate Page and Post
- SQL injection
- CVSS 6.8 Medium
PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function
- DALIBO PostgreSQL Anonymizer
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Active Products Tables for WooCommerce plugin <= 1.0.9 - SQL Injection vulnerability
- RealMag777 Active Products Tables for WooCommerce
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress TableOn plugin <= 1.0.5.1 - SQL Injection vulnerability
- RealMag777 TableOn
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Easy Form Builder plugin <= 4.0.6 - SQL Injection vulnerability
- hassantafreshi Easy Form Builder
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability
- Tainacan
- SQL injection
- CVSS 8.5 High
WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability
- Stylemix MasterStudy LMS
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Active Products Tables for WooCommerce plugin <= 1.0.8 - SQL Injection vulnerability
- RealMag777 Active Products Tables for WooCommerce
- SQL injection
- CVSS 8.6 High
SQL injection in Synology Active Backup for Business
- Synology Active Backup for Business
- SQL injection
- CVSS 8.7 High
Unauthenticated SQLi in getAccountData function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in user_alarmprofile view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in tag view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in system_tag view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in system view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in devices_configuration view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in dashboard view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in alarming view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in getWidgetTags function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in getProjectTags function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in VerifyCreateLicences function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in getComponentScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in getDeviceScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in getProjectScalings function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in inmessage model
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in saveObjectFromData function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in saveDashboardLayout function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in saveDashboardLayout function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection in dotCMS Publish Audit API
- dotCMS Core
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in getDevicegroups function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.1 High
Authenticated SQLi in Easy View
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.0 High
Authenticated SQLi in UpdateParam function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.0 High
Authenticated SQLi in UpdateParam function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.0 High
Authenticated SQLi in DeleteSysLogEntry function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.0 High
Authenticated SQLi in _RemoveRequest function
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 6.9 Medium
Authenticated SQLi in dsgvo_contracts view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection
- CVSS 7.0 High
Authenticated SQLi in accountstatus view
- MB connect line mbCONNECT24
- MB connect line mymbCONNECT24
- SQL injection