Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System archive5.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 5.3 Medium
Chengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injection
- Chengdu Everbrite Network Technology BeikeShop
- Other injection
- SQL injection
- CVSS 5.3 Medium
Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injection
- Kushan2k student-management-system
- Other injection
- SQL injection
- CVSS 5.3 Medium
jflyfox jfinal_cms AdvicefeedbackController.java list sql injection
- jflyfox jfinal_cms
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System index1.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System index2.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 6.9 Medium
Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection
- Chanjet CRM
- Other injection
- SQL injection
- CVSS 5.3 Medium
Tiobon Employee Self-Service System Login Endpoint BlogSearch.aspx sql injection
- Tiobon Employee Self-Service System
- Other injection
- SQL injection
- CVSS 6.9 Medium
Jinher OA nextselectplan.aspx sql injection
- Jinher OA
- Other injection
- SQL injection
- CVSS 5.3 Medium
Jinher OA GetFormSn.aspx sql injection
- Jinher OA
- Other injection
- SQL injection
- CVSS 6.5 Medium
Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- SQL injection
- CVSS 4.9 Medium
OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order_by' Parameter
- crafium OptinCraft – Drag & Drop Optins & Popup Builder for WordPress
- SQL injection
- CVSS 4.9 Medium
Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters
- expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Open XDMoD Vulnerable to Unauthenticated SQL Injection Leading to Full Database Compromise
- ubccr xdmod
- SQL injection
- CVSS 6.9 Medium
code-projects Hotel and Tourism Reservation System details.php sql injection
- code-projects Hotel and Tourism Reservation System
- Other injection
- SQL injection
- CVSS 5.3 Medium
NocoDB: SQL Injection via Column Title in Bulk GroupBy
- SQL injection
<2026.05.1 · fixed in 2026.05.1
GHSA-p8wx-5f39-w3x4 · CVE-2026-47384 - CVSS 6.0 Medium
NocoDB: Postgres SQL Injection in Formula `ARRAYSORT`
- SQL injection
<2026.04.1 · fixed in 2026.04.1
GHSA-cxv7-gmmp-228p · CVE-2026-47375 - CVSS 6.9 Medium
tittuvarghese CollegeManagementSystem fetch.php sql injection
- tittuvarghese CollegeManagementSystem
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injection
- SourceCodester Ship Ferry Ticket Reservation System
- Other injection
- SQL injection
- CVSS 5.3 Medium
projectworlds Online Art Gallery Shop Project adminHome.ph sql injection
- projectworlds Online Art Gallery Shop Project
- Other injection
- SQL injection
- CVSS 5.3 Medium
projectworlds Online Art Gallery Shop Project adminHome.php sql injection
- projectworlds Online Art Gallery Shop Project
- Other injection
- SQL injection
- CVSS 8.9 High
OpenMeter: SQL injection through meter creation
- SQL injection
<1.0.0-beta.228 · fixed in 1.0.0-beta.228
GHSA-wc3v-3457-c8cm · CVE-2026-8462 - CVSS 9.8 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection in Osnexus Quantastor
- Osnexus QuantaStor
- SQL injection
- CVSS 5.3 Medium
itsourcecode Fees Management System receipt.php sql injection
- itsourcecode Fees Management System
- Other injection
- SQL injection
- CVSS 8.8 High
WordPress Plugin Google Review Slider 6.1 SQL Injection via tid
- jgwhite33 Google Review Slider
- SQL injection
- CVSS 8.8 High
PHP EI-Tube Script 3 SQL Injection via search parameter
- eitube EI-Tube
- SQL injection
- CVSS 8.8 High
Listing Hub CMS 1.0 SQL Injection via pages.php id
- Themerig Listing Hub CMS
- SQL injection
- CVSS 8.8 High
Care2x 2.7 Hospital Information System SQL Injection via ck_config
- Care2x
- SQL injection
- CVSS 8.8 High
All in One Video Downloader 1.2 SQL Injection via admin page-edit
- Nicheoffice All in One Video Downloader
- SQL injection
- CVSS 5.3 Medium
itsourcecode Fees Management System manage_user.php sql injection
- itsourcecode Fees Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Fees Management System manage_student.php sql injection
- itsourcecode Fees Management System
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQLi in Akmer Informatics' TeknoPass
- Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass
- SQL injection
- CVSS 7.6 High
WordPress Photo Gallery by 10Web plugin <= 1.8.41 - SQL Injection vulnerability
- Photo Gallery by 10Web
- SQL injection
- CVSS 6.5 Medium
MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter
- StylemixThemes MasterStudy LMS Pro
- SQL injection
- CVSS 7.6 High
WordPress School Management plugin <= 93.2.0 - SQL Injection vulnerability
- Mojoomla School Management
- SQL injection
- CVSS 6.9 Medium
SourceCodester Pizzafy E-Commerce System Administrative Control Panel admin_class_novo.php login sql injection
- SourceCodester Pizzafy E-Commerce System
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Student Admission System index.php sql injection
- code-projects Student Admission System
- Other injection
- SQL injection
- CVSS 7.5 High
ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter
- ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
- SQL injection
- CVSS 6.5 Medium
ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter
- ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
- SQL injection
- CVSS 6.9 Medium
DedeCMS carbuyaction.php RemoveXSS sql injection
- DedeCMS
- Other injection
- SQL injection
- CVSS 6.9 Medium
DedeCMS flink.php dede_htmlspecialchars sql injection
- DedeCMS
- Other injection
- SQL injection
- CVSS 6.9 Medium
DedeCMS Feedback feedback.php TrimMsg sql injection
- DedeCMS
- Other injection
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP Job Portal plugin <= 2.5.1 - SQL Injection vulnerability
- Ahmad WP Job Portal
- SQL injection
- CVSS 5.3 Medium
itsourcecode Fees Management System manage_payment.php sql injection
- itsourcecode Fees Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Fees Management System manage_fee.php sql injection
- itsourcecode Fees Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Fees Management System manage_course.php sql injection
- itsourcecode Fees Management System
- Other injection
- SQL injection
- CVSS 7.6 High
Kiteworks Secure Data Forms has a SQL Injection vulnerability
- kiteworks Secure Data Forms
- SQL injection
- CVSS 5.3 Medium
itsourcecode Fees Management System ajax.php sql injection
- itsourcecode Fees Management System
- Other injection
- SQL injection
- CVSS 7.8 High
SQL injection in Google Android
- Google Android
- SQL injection
- CVSS 8.8 High
Pixa Bank 2.0 SQL Injection via agence-ajax.php API
- Pixastudio Pixa Bank
- SQL injection
- CVSS 8.8 High
WP AutoSuggest 0.24 SQL Injection via autosuggest.php
- eliekhoury WP AutoSuggest
- SQL injection
- CVSS 8.8 High
Joomla JE Photo Gallery 1.1 SQL Injection via categoryid
- Joomlaextensions JE Photo Gallery
- SQL injection
- CVSS 7.1 High
No-Cms 1.0 SQL Injection via order_by Parameter
- goFrendiAsgard No-CMS
- SQL injection
- CVSS 7.1 High
Paroiciel 11.20 SQL Injection via eGeqIdEquipe Parameter
- Paroiciel
- SQL injection
- CVSS 7.1 High
Paroiciel 11.20 SQL Injection via zProIdPro Parameter
- Paroiciel
- SQL injection
- CVSS 8.8 High
Paroiciel 11.20 SQL Injection via tRecIdListe Parameter
- Paroiciel
- SQL injection
- CVSS 6.9 Medium
code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection
- code-projects Hotel and Tourism Reservation System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Payroll System home_employee.php sql injection
- CodeAstro Payroll System
- Other injection
- SQL injection
- CVSS 7.1 High
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
- nextcloud security-advisories
- SQL injection
- CVSS 8.2 High
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
- nextcloud security-advisories
- SQL injection