Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Blocksy Companion Pro plugin < 2.1.29 - SQL Injection vulnerability
- Creative Themes Blocksy Companion Pro
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WPJobster theme <= 6.3.5 - SQL Injection vulnerability
- Jobster Marketplace WPJobster
- SQL injection
- CVSS 8.5 High
WordPress WooCommerce Frontend Manager – Ultimate plugin < 6.7.7 - SQL Injection vulnerability
- WC Lovers. WooCommerce Frontend Manager – Ultimate
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability
- Themeum Tutor LMS Pro
- SQL injection
- CVSS 8.5 High
WordPress Events Schedule - WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection vulnerability
- CurlyThemes Events Schedule - WordPress Events Calendar Plugin
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
SQL injection in Android
- Android
- SQL injection
- CVSS 7.5 High
JetEngine <= 3.8.10.1 - Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint
- Crocoblock JetEngine
- SQL injection
- CVSS 8.5 High
WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability
- wpWax Directorist Booking
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability
- TMS wpDataTables
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability
- Emraan Cheema ListingPro
- SQL injection
- CVSS 6.5 Medium
n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
- SQL injection
<2.24.0 · fixed in 2.24.0
GHSA-jpq7-226w-6cxx · CVE-2026-54313 - CVSS 6.5 Medium
n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes
- SQL injection
<2.25.7 || >=2.26.0, <2.26.2 · fixed in 2.25.7, 2.26.2
GHSA-c37g-w77q-m4vp · CVE-2026-54310 - CVSS 9.3 CriticalCritical · CVSS 9+
WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability
- Liquid Web / StellarWP The Events Calendar
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress GEO my WordPress plugin <= 4.5.5 - SQL Injection vulnerability
- Eyal Fitoussi GEO my WordPress
- SQL injection
- CVSS 7.6 High
WordPress Attendance Manager plugin <= 0.6.2 - SQL Injection vulnerability
- tnomi Attendance Manager
- SQL injection
- CVSS 8.5 High
WordPress WP Sessions Time Monitoring Full Automatic plugin <= 1.1.4 - SQL Injection vulnerability
- activity-log.com WP Sessions Time Monitoring Full Automatic
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress InPost Gallery plugin <= 2.1.4.6 - SQL Injection vulnerability
- RealMag777 InPost Gallery
- SQL injection
- CVSS 8.8 High
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter
- https://wpreviewslider.com/ WP Review Slider Pro
- SQL injection
- CVSS 8.8 High
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter
- https://wpreviewslider.com/ WP Review Slider Pro
- SQL injection
- CVSS 8.5 High
WordPress WCMultiShipping plugin <= 3.0.2 - SQL Injection vulnerability
- WCMultiShipping
- SQL injection
- CVSS 8.5 High
WordPress Taskbuilder plugin <= 5.0.7 - SQL Injection vulnerability
- Taskbuilder
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress eCommerce Product Catalog plugin <= 3.5.5 - SQL Injection vulnerability
- impleCode eCommerce Product Catalog
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability
- JExtensions Store GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Advanced 301 and 302 Redirect plugin <= 1.6.9 - SQL Injection vulnerability
- yydevelopment Advanced 301 and 302 Redirect
- SQL injection
- CVSS 8.5 High
WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability
- ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability
- Ahmad JS Help Desk
- SQL injection
- CVSS 8.5 High
WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerability
- codepeople WP Time Slots Booking Form
- SQL injection
- CVSS 8.5 High
WordPress GamiPress plugin <= 7.8.7 - SQL Injection vulnerability
- Ruben Garcia GamiPress
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Realtyna Organic IDX plugin plugin <= 5.1.0 - SQL Injection vulnerability
- Realtyna Organic IDX plugin
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP Data Access plugin <= 5.5.70 - SQL Injection vulnerability
- Passionate Programmer Peter WP Data Access
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability
- Dev4Press GD Rating System
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Order Delivery Date for WooCommerce plugin <= 4.5.1 - SQL Injection vulnerability
- tychesoftwares Order Delivery Date for WooCommerce
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.1 - SQL Injection vulnerability
- Funnel Builder by FunnelKit
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress wpForo Forum plugin <= 3.0.4 - SQL Injection vulnerability
- Tomdever wpForo Forum
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Contest Gallery plugin <= 28.1.6 - SQL Injection vulnerability
- Wasiliy Strecker Contest Gallery
- SQL injection
- CVSS 8.5 High
WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability
- StylemixThemes MasterStudy LMS
- SQL injection
- CVSS 7.5 High
WordPress WPGraphQL plugin < 2.11.1 - SQL Injection vulnerability
- WPGraphQL
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability
- SpeakOut! Email Petitions
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress GeekyBot plugin <= 1.2.0 - SQL Injection vulnerability
- Ahmad GeekyBot
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress GeoDirectory plugin <= 2.8.152 - SQL Injection vulnerability
- Paolo GeoDirectory
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability
- Jacob N. Breetvelt WP Photo Album Plus
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability
- Form Maker by 10Web
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability
- NSquared Simply Schedule Appointments
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability
- Flipper Code – WordPress Development Company WP Maps
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability
- Naked Cat Plugins (by Webdados) Feed KuantoKusta for WooCommerce – Free
- SQL injection
- CVSS 8.5 High
WordPress PowerPress Podcasting plugin <= 11.15.10 - SQL Injection vulnerability
- Blubrry Podcasting PowerPress Podcasting
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Metacat has an unauthenticated SQL injection vulnerability
- NCEAS metacat
- SQL injection
- Authentication bypass
- CVSS 8.8 High
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
- dwbooster Booking Calendar Contact Form
- SQL injection
- CVSS 7.1 High
WordPress Sliced Invoices 3.8.2 SQL Injection via post Parameter
- SlicedInvoices Sliced Invoices
- SQL injection
- CVSS 8.8 High
Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php
- mattkaye Answer My Question
- SQL injection
- CVSS 8.8 High
BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid
- bbsetheme BBS e-Franchise
- SQL injection
- CVSS 8.8 High
WordPress 404 Redirection Manager Plugin 1.0 SQL Injection
- 404-redirection-manager 404 Redirection Manager
- SQL injection
- CVSS 8.8 High
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
- dwbooster Booking Calendar Contact Form
- SQL injection
- CVSS 5.3 Medium
Grit42 Grit data_table_entity.rb DataTableEntity sql injection
- Grit
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint.
- SQL injection
- CVSS 8.8 High
A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL co…
- SQL injection
- CVSS 5.3 Medium
Grit42 Grit GritEntityController grit_entity_controller.rb sql injection
- Grit
- Other injection
- SQL injection
- CVSS 5.1 Medium
CodeAstro Student Attendance Management System createStudents.php sql injection
- CodeAstro Student Attendance Management System
- Other injection
- SQL injection