Advisories · Weakness

SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2017-20278 CVE record

CVSS 8.8 High

Joomla JoomRecipe 1.0.3 SQL Injection via category parameter
- Joomboost JoomRecipe
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20277 CVE record

CVSS 8.8 High

Joomla JoomRecipe 1.0.4 Component Blind SQL Injection via search_author
- Joomboost Joomla JoomRecipe
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20276 CVE record

CVSS 8.8 High

Joomla! Component SIMGenealogy 2.1.5 SQL Injection
- Simbunch SIMGenealogy
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20275 CVE record

CVSS 8.8 High

Joomla! Component PHP-Bridge 1.2.3 SQL Injection via id Parameter
- Henryschorradt Bridge
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20274 CVE record

CVSS 8.8 High

Joomla LMS King Professional 3.2.4.0 SQL Injection via learningpath
- King-products LMS King Professional
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20273 CVE record

CVSS 8.8 High

Joomla Event Registration Pro Calendar 4.1.3 SQL Injection
- Joomlashowroom Event Registration Pro Calendar
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20272 CVE record

CVSS 8.8 High

Joomla Ultimate Property Listing 1.0.2 SQL Injection via sf_selectuser_id
- Faboba Ultimate Property Listing
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20271 CVE record

CVSS 8.8 High

Joomla StreetGuessr Game 1.1.8 SQL Injection via catid
- Nordmograph StreetGuessr Game
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20270 CVE record

CVSS 8.8 High

Joomla! Component Twitch Tv 1.1 SQL Injection
- Raindropsinfotech Twitch Tv
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20269 CVE record

CVSS 8.8 High

Joomla! Component KissGallery 1.0.0 SQL Injection
- Terrywcarter KissGallery
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20268 CVE record

CVSS 8.8 High

Joomla! Component Zap Calendar Lite 4.3.4 SQL Injection
- Zcontent Zap Calendar Lite
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20267 CVE record

CVSS 8.8 High

Joomla! Component Calendar Planner 1.0.1 SQL Injection
- Joomlathat Calendar Planner
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20266 CVE record

CVSS 8.8 High

Joomla SP Movie Database 1.3 SQL Injection via searchword
- Joomshaper SP Movie Database
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20265 CVE record

CVSS 7.1 High

Joomla! Component Flip Wall 8.0 SQL Injection
- Pulseextensions Flip Wall
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20264 CVE record

CVSS 7.1 High

Joomla! Component Sponsor Wall 8.0 SQL Injection
- Pulseextensions Sponsor Wall
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20263 CVE record

CVSS 8.8 High

Joomla! FocalPoint Pro Free 1.2.3 SQL Injection via location
- Focalpointx FocalPoint Pro / Free
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20262 CVE record

CVSS 8.8 High

Joomla! Component Ajax Quiz 1.8 SQL Injection
- Webkul Ajax Quiz
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20261 CVE record

CVSS 8.8 High

Joomla! Component Bargain Product VM3 1.0 SQL Injection
- Weborange Bargain Product VM3
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20260 CVE record

CVSS 8.8 High

Joomla! Component Price Alert 3.0.2 SQL Injection
- Weborange Price Alert
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20259 CVE record

CVSS 8.8 High

Joomla OSDownloads 1.7.4 SQL Injection via item view
- Joomlashack OSDownloads
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20258 CVE record

CVSS 8.8 High

Joomla! Component RPC Responsive Portfolio 1.6.1 SQL Injection
- Extro RPC
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20257 CVE record

CVSS 8.8 High

Joomla! Component Quiz Deluxe 3.7.4 SQL Injection
- Joomplace Quiz Deluxe
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20256 CVE record

CVSS 8.8 High

Joomla Survey Force Deluxe 3.2.4 SQL Injection via invite Parameter
- Joomplace Survey Force Deluxe
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20255 CVE record

CVSS 8.8 High

Joomla! Component JB Visa 1.0 SQL Injection via visatype
- Joombooking JB Visa
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20254 CVE record

CVSS 8.8 High

Joomla! Component User Bench 1.0 SQL Injection via userid
- Gegabyte User Bench
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20253 CVE record

CVSS 8.8 High

Joomla! Component My Projects 2.0 SQL Injection
- Gegabyte My Projects
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2017-20252 CVE record

CVSS 8.8 High

Joomla NextGen Editor 2.1.0 SQL Injection via plname Parameter
- nextgeneditor NextGen Editor
- SQL injection
Not analysed yet 19 Jun 2026
CVE-2026-12045 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution
- pgadmin.org pgAdmin 4
- Command injection
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-12050 CVE record

CVSS 5.3 Medium

pgAdmin 4: SQL injection in named restore point endpoint
- pgadmin.org pgAdmin 4
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-12044 CVE record

CVSS 8.7 High

pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates
- pgadmin.org pgAdmin 4
- SQL injection
- CWE-116
Not analysed yet 18 Jun 2026
budibase npm

CVSS 8.4 High

budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL
- SQL injection
<3.39.19 · fixed in 3.39.19

GHSA-qqf5-x7mj-v43p · CVE-2026-64657 Not analysed yet 18 Jun 2026
CVE-2026-56012 CVE record

CVSS 8.5 High

WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability
- David Lingren Media LIbrary Assistant
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-54222 CVE record

CVSS 8.6 High

Blind SQL Injection in UBB.threads
- UBB Systems UBB.threads
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-40455 CVE record

CVSS 8.6 High

SQL Injection in LMS
- LMS
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-54419 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

PIAF-HMS multiple unauthenticated SQL injection vulnerabilities via mysql_query
- claudiopizzillo PIAF-HMS
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-55740 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter
- Nur-Alam39 bus-ticket
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-10736 CVE record

CVSS 4.9 Medium

Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-11360 CVE record

CVSS 4.9 Medium

Advanced Order Export For WooCommerce <= 4.0.10 - Authenticated (Shop Manager+) SQL Injection via 'sort_direction' Parameter
- algolplus Advanced Order Export For WooCommerce
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-11776 CVE record

CVSS 4.9 Medium

Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- SQL injection
Not analysed yet 18 Jun 2026
CVE-2026-11777 CVE record

CVSS 4.9 Medium

Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- SQL injection
Not analysed yet 18 Jun 2026
dev.langchain4j:langchain4j-mariadb +1 Maven

CVSS 7.6 High

LangChain4j: SQL injection via metadata filters in langchain4j-mariadb and langchain4j-pgvector
- SQL injection
<1.2.1-beta8 || >=1.3.0-beta9, <1.5.1-beta11 || >=1.6.0-beta12, <1.11.8-beta19 || >=1.12.1-beta21, <1.16.3-beta26 · fixed in 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, 1.16.3-beta26

GHSA-2mfg-cc43-9pcj · CVE-2026-55405 Not analysed yet 17 Jun 2026
CVE-2026-35069 CVE record

CVSS 5.7 Medium

SQL injection in Dell PowerFlex
- Dell PowerFlex
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-35068 CVE record

CVSS 3.5 Low

SQL injection in Dell PowerFlex
- Dell PowerFlex
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54812 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability
- StylemixThemes Motors
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54809 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress GIFT4U plugin <= 1.0.10 - SQL Injection vulnerability
- VillaTheme GIFT4U
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54808 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability
- WP Travel Gutenberg Blocks
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54813 CVE record

CVSS 8.5 High

WordPress SureDash plugin <= 1.8.0 - SQL Injection vulnerability
- Brainstorm Force SureDash
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54815 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Cargo Shipping Location for WooCommerce plugin <= 5.6 - SQL Injection vulnerability
- Cargo RD Cargo Shipping Location for WooCommerce
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54818 CVE record

CVSS 8.5 High

WordPress Slimstat Analytics plugin <= 5.4.11 - SQL Injection vulnerability
- VeronaLabs Slimstat Analytics
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54819 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Listdom plugin <= 5.4.0 - SQL Injection vulnerability
- Webilia Inc. Listdom
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2025-59554 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Advanced Ads – Tracking plugin < 3.0.7 - SQL Injection vulnerability
- Advanced Ads GmbH Advanced Ads – Tracking
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54811 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress WP eMember plugin < v10.9.4 - SQL Injection vulnerability
- Tips and Tricks HQ WP eMember
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54187 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress JetEngine plugin <= 3.8.10.1 - SQL Injection vulnerability
- Jetimpex Inc. JetEngine
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54186 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability
- eyecix JobSearch
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-54185 CVE record

CVSS 8.5 High

WordPress Cornerstone plugin < 7.8.8 - SQL Injection vulnerability
- THEMECO Cornerstone
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-49084 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress JetEngine plugin < 3.8.9.1 - SQL Injection vulnerability
- Jetimpex Inc. JetEngine
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-49079 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress JetSearch plugin <= 3.5.17 - SQL Injection vulnerability
- Jetimpex Inc. JetSearch
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-49076 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress JetEngine plugin <= 3.8.9.1 - SQL Injection vulnerability
- Crocoblock JetEngine
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-48967 CVE record

CVSS 8.5 High

WordPress Geo Mashup plugin <= 1.13.19 - SQL Injection vulnerability
- Dylan Kuhn Geo Mashup
- SQL injection
Not analysed yet 17 Jun 2026
CVE-2026-48875 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress JetSmartFilters plugin <= 3.8.1 - SQL Injection vulnerability
- Jetimpex Inc. JetSmartFilters
- SQL injection
Not analysed yet 17 Jun 2026