Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
DataEase: Arbitrary SQL execution in preview path (direct data disclosure)
- dataease
- SQL injection
- CVSS 8.7 High
DataEase: SQL injection vulnerability
- dataease
- SQL injection
- CVSS 4.0, no score published
MantisBT: SQL Injection via history_order Configuration Value
- SQL injection
<2.28.4 · fixed in 2.28.4
GHSA-mw6p-33vw-46cc · CVE-2026-47142 - CVSS 8.1 High
Apache Fineract: Office list: SQL Injection via Subquery in orderBy
- Apache Software Foundation Apache Fineract
- SQL injection
- CVSS 8.8 High
Apache Fineract: SQL injection in runreports endpoint
- Apache Software Foundation Apache Fineract
- SQL injection
- CVSS 8.1 High
Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
- Apache Software Foundation Apache Fineract
- SQL injection
- CVSS 8.7 High
Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9
- joomdonation.com EDocman extension for Joomla
- SQL injection
- CVSS 8.7 High
Joomla Extension - digital-peak.com - Unauthenticated blind SQL injection in DP Calendar 8.18.0 - 10.11.2
- digital-peak.com DP Calendar extension for Joomla
- SQL injection
- CVSS 8.7 High
MetaGuru｜HCM - SQL Injection
- MetaGuru HCM
- SQL injection
- CVSS 8.6 High
Quotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc Parameter
- Quotes llama
- SQL injection
- CVSS 5.9 Medium
SQL injection in ASUS Router
- ASUS Router
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe ColdFusion 2025
- Adobe ColdFusion 2023
- SQL injection
- CVSS 7.2 High
Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Commerce
- Adobe Commerce B2B
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
FacturaScripts: Authenticated SQL injection in the FacturaScripts REST API filter parameter via parenthesis bypass in `Where::sqlColumn`
- SQL injection
- Server-side request forgery (SSRF)
<2026.2 · fixed in 2026.2
GHSA-5qmh-x653-g8qj · CVE-2026-45262 - CVSS 8.8 High
Microsoft SQL Server Elevation of Privilege Vulnerability
- Microsoft SQL Server 2016 Service Pack 3 (GDR)
- Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack
- SQL injection
- CVSS 7.5 High
Microsoft SQL Server Elevation of Privilege Vulnerability
- Microsoft SQL Server 2016 Service Pack 3 (GDR)
- Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack
- SQL injection
- CVSS 6.9 Medium
SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection
- SourceCodester Simple and Nice Shopping Cart Script
- Other injection
- SQL injection
- CVSS 8.3 High
Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities
- Path traversal
- SQL injection
>=1.1.6, <1.11.0 · fixed in 1.11.0
GHSA-8g6f-qw9x-4q6q · CVE-2026-15736 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
- Apache Software Foundation Apache Kylin
- SQL injection
- CVSS 9.2 CriticalCritical · CVSS 9+
Input Validation Vulnerabilities in Snowflake Spark Connector
- Snowflake Spark Connector
- SQL injection
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
code-projects Online Job Portal DeleteUser.php sql injection
- code-projects Online Job Portal
- Other injection
- SQL injection
- CVSS 6.9 Medium
code-projects Online Job Portal EditUser.php sql injection
- code-projects Online Job Portal
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Electronic Judging System add_judges.php sql injection
- itsourcecode Electronic Judging System
- Other injection
- SQL injection
- CVSS 5.5 Medium
SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO)
- SAP_SE SAP S/4HANA Project Management (PPM-PRO)
- SQL injection
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System edit_exam2.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 8.5 High
DIRAC: SQL injection and lack of access control in PilotManager service
- SQL injection
- Broken access control
>=6, <8.0.79 || >=8.1.0a1, <9.0.22 || >=9.1.0, <9.1.10 · fixed in 8.0.79, 9.0.22, 9.1.10
GHSA-7xw9-549r-8jrc - CVSS 9.9 CriticalCritical · CVSS 9+
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval
- SQL injection
- Code injection
>=6, <8.0.79 || >=8.1.0a1, <9.0.22 || >=9.1.0, <9.1.10 · fixed in 8.0.79, 9.0.22, 9.1.10
GHSA-m4m7-4cw8-62j6 · CVE-2026-61667 - CVSS 5.5 Medium
Decidim: Admin user search allows SQL injection through similarity-based sorting
- SQL injection
<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0 · fixed in 0.30.9, 0.31.5, 0.32.0
GHSA-jvqq-cvh4-xm37 · CVE-2026-45376 - CVSS 5.3 Medium
CodeAstro Simple Online Leave Management System POST accept.php sql injection
- CodeAstro Simple Online Leave Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Simple Online Leave Management System deletemp.php sql injection
- CodeAstro Simple Online Leave Management System
- Other injection
- SQL injection
- CVSS 7.6 High
WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability
- Hannan گرویتی فرم فارسی
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress AIWU plugin <= 1.5.4 - SQL Injection vulnerability
- Sergey AIWU
- SQL injection
- CVSS 8.5 High
WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability
- Saad Iqbal APIExperts Square for WooCommerce
- SQL injection
- CVSS 8.5 High
WordPress CWS SVGicons plugin <= 1.5.5 - SQL Injection vulnerability
- CreativeWS CWS SVGicons
- SQL injection
- CVSS 7.6 High
WordPress Advanced Shipment Tracking for WooCommerce plugin <= 4.0 - SQL Injection vulnerability
- Zorem Advanced Shipment Tracking for WooCommerce
- SQL injection
- CVSS 8.5 High
WordPress WP Inventory Manager plugin <= 2.4.0 - SQL Injection vulnerability
- WP Inventory Manager
- SQL injection
- CVSS 8.5 High
WordPress GD Rating System plugin <= 3.7 - SQL Injection vulnerability
- Milan Petrovic GD Rating System
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability
- AcyMailing Newsletter Team AcyMailing SMTP Newsletter
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability
- Themeum Kirki
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability
- LatePoint
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Simple Business Directory Pro plugin <= 15.9.4 - SQL Injection vulnerability
- quantumcloud Simple Business Directory Pro
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Amelia plugin <= 2.4.2 - SQL Injection vulnerability
- Melograno Venture Studio Amelia
- SQL injection
- CVSS 8.5 High
WordPress Vitepos plugin <= 3.4.2 - SQL Injection vulnerability
- appsbd Vitepos
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Book Store System login.php sql injection
- SourceCodester Online Book Store System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Hospital Management System patviewprescription.php sql injection
- itsourcecode Hospital Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Simple Online Leave Management System dashboard.php sql injection
- CodeAstro Simple Online Leave Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
Jinher OA PlanGiveOut.aspx sql injection
- Jinher OA
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint
- SQL injection
- CVSS 6.9 Medium
Metasoft 美特软件 MetaCRM PHPRPC Remote Call rpc.jsp RPCService.query sql injection
- Metasoft 美特软件 MetaCRM
- Other injection
- SQL injection
- CVSS 5.3 Medium
AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection
- AojiaoZero Antaris
- Other injection
- SQL injection
- CVSS 5.1 Medium
Capgo - SQL Injection via Unvalidated limit Parameter in Admin Stats Endpoint
- Capgo
- SQL injection
- CVSS 6.9 Medium
sergomanov SmartHomeAdatum Login users.php sql injection
- sergomanov SmartHomeAdatum
- Other injection
- SQL injection
- CVSS 5.1 Medium
AMTT Hotel Broadband Operation System switch_status.php sql injection
- AMTT Hotel Broadband Operation System
- Other injection
- SQL injection
- CVSS 6.9 Medium
RafyMrX TOKO-ONLINE-ROTI add.php sql injection
- RafyMrX TOKO-ONLINE-ROTI
- Other injection
- SQL injection
- CVSS 6.9 Medium
RafyMrX TOKO-ONLINE-ROTI login.php sql injection
- RafyMrX TOKO-ONLINE-ROTI
- Other injection
- SQL injection
- CVSS 6.9 Medium
Aster Telecom Azcall HTTP sis.php sql injection
- Aster Telecom Azcall
- Other injection
- SQL injection
- CVSS 5.3 Medium
IceHRM UserReport Endpoint EmployeeAttendanceReport.php sql injection
- IceHRM
- Other injection
- SQL injection
- CVSS 5.3 Medium
Bahmni bahmnicore Search Endpoint sql additionalParams sql injection
- bahmnicore
- Other injection
- SQL injection
- CVSS 9.8 Critical
Duplicate Advisory: PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL
- SQL injection
<=4.6.77 · no fixed version yet
GHSA-q65p-7p84-495c - CVSS 7.5 High
WP CTA <= 2.2.2 - Unauthenticated Time-Based Blind SQL Injection via 'fildname' Parameter
- blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder
- SQL injection