Advisories · Weakness

SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-50736 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

SQL injection in EnterpriseDB pglogical
- EnterpriseDB pglogical
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-15444 CVE record

CVSS 4.9 Medium

Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-14785 CVE record

CVSS 7.5 High

Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection
- mihail-chepovskiy Web Directory Free
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-10207 CVE record

CVSS 7.5 High

PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter
- PickPlugins Question Answer
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-16462 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

SQL injection via unauthenticated GetGridData endpoint
- Weidmueller Interface PROCON-WEB SCADA
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-12800 CVE record

CVSS 7.5 High

Premium Packages <= 6.2.0 - Unauthenticated SQL Injection
- codename065 Premium Packages – Sell Digital Products Securely
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-13161 CVE record

CVSS 7.5 High

TrueBooker <= 1.2.2 - Unauthenticated SQL Injection
- themetechmount TrueBooker – Appointment Booking and Scheduler System
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-15267 CVE record

CVSS 6.5 Medium

Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection
- Taskbuilder – Project Management & Task Management Tool With Kanban Board
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-14516 CVE record

CVSS 7.5 High

Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection
- ladela Online Scheduling and Appointment Booking System – Bookly
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-12741 CVE record

CVSS 7.5 High

WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection
- epsiloncool WP Fast Total Search – The Power of Indexed Search
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-15673 CVE record

CVSS 4.4 Medium

SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings
- cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-15670 CVE record

CVSS 4.9 Medium

SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-15671 CVE record

CVSS 4.9 Medium

SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter
- cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-16811 CVE record

CVSS 4.9 Medium

ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-6251 CVE record

CVSS 6.5 Medium

Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter
- Chaty Pro
- SQL injection
Not analysed yet 28 Jul 2026
CVE-2026-17191 CVE record

CVSS 8.5 High

VeloCloud Orchestrator Flow Metrics API SQL Injection
- Arista Networks VeloCloud Orchestrator On-Prem
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-66427 CVE record

CVSS 7.6 High

WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability
- jgwhite33 WP Google Review Slider
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-59551 CVE record

CVSS 8.5 High

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
- rtCamp rtMedia for WordPress, BuddyPress and bbPress
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-59550 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress AWP Classifieds plugin <= 4.4.7 - SQL Injection vulnerability
- Strategy11 Team AWP Classifieds
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-59549 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
- rtCamp rtMedia for WordPress, BuddyPress and bbPress
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-59538 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress GamiPress plugin <= 7.9.7 - SQL Injection vulnerability
- Ruben Garcia GamiPress
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-59537 CVE record

CVSS 7.6 High

WordPress Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.10.22 - SQL Injection vulnerability
- Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-59533 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Relevanssi Light plugin <= 1.2.2 - SQL Injection vulnerability
- Christoph Vielgrader Relevanssi Light
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-59527 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
- RomanCode MapSVG
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-65876 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0
- joomshaper.com SP Page Builder extension for Joomla
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-65877 CVE record

CVSS 8.2 High

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1
- joomshaper.com SP Page Builder extension for Joomla
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-65766 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1
- joomshaper.com SP Page Builder extension for Joomla
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-14189 CVE record

CVSS 3.8 Low

WPBot AI ChatBot < 8.5.2 - Admin+ Second-Order SQL Injection via qc_bot_str_fields
- WPBot
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2026-51077 CVE record

CVSS 7.5 High

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component
- SQL injection
Not analysed yet 27 Jul 2026
CVE-2025-50455 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1.
- SQL injection
Not analysed yet 27 Jul 2026
@budibase/server npm

CVSS 7.1 High

Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
- SQL injection
- Other injection
<=3.38.1 · no fixed version yet

GHSA-pmpg-2mxq-6xwr · CVE-2026-73617 Not analysed yet 24 Jul 2026
@budibase/server npm

CVSS 7.6 High

Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
- SQL injection
<=3.38.1 · no fixed version yet

GHSA-2xgg-r2wc-c5r2 · CVE-2026-73408 Not analysed yet 24 Jul 2026
@budibase/server npm

CVSS 9.6 CriticalCritical · CVSS 9+

Budibase: SQL Injection via `multipleStatements: true`
- SQL injection
<=3.38.1 · no fixed version yet

GHSA-q6x4-v3qx-85qw · CVE-2026-73300 Not analysed yet 24 Jul 2026
CVE-2026-65707 CVE record

CVSS 8.5 High

Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint
- likeshop
- SQL injection
Not analysed yet 24 Jul 2026
CVE-2026-15663 CVE record

CVSS 4.9 Medium

Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
- kstover Ninja Forms – The Contact Form Builder That Grows With You
- SQL injection
Not analysed yet 24 Jul 2026
CVE-2026-16765 CVE record

CVSS 6.9 Medium

CodeAstro Online Classroom loginlinkadmin.php sql injection
- CodeAstro Online Classroom
- Other injection
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-63359 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Appriss Insights VINE SQLI
- Appriss Insights Victim Information Notification Exchange (VINE)
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-65761 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1
- joomshaper.com Easy Store extension for Joomla
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-65532 CVE record

CVSS 7.6 High

WordPress Persian Woocommerce SMS plugin <= 7.2.2 - SQL Injection vulnerability
- PersianScript Persian Woocommerce SMS
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-65526 CVE record

CVSS 8.5 High

WordPress Visualizer plugin <= 4.0.1 - SQL Injection vulnerability
- Themeisle Visualizer
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-65494 CVE record

CVSS 7.1 High

WordPress Dokan Pro plugin <= 5.0.2 - SQL Injection vulnerability
- Dokan Pro
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-65462 CVE record

CVSS 7.6 High

WordPress Uncanny Automator plugin <= 7.3.2 - SQL Injection vulnerability
- Uncanny Owl Uncanny Automator
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-65454 CVE record

CVSS 8.5 High

WordPress Quiz And Survey Master plugin <= 11.2.0 - SQL Injection vulnerability
- ExpressTech Systems Quiz And Survey Master
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-65451 CVE record

CVSS 8.5 High

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
- RomanCode MapSVG
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-65450 CVE record

CVSS 8.5 High

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
- RomanCode MapSVG
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-61950 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress TrueBooker plugin <= 1.2.3 - SQL Injection vulnerability
- themetechmount TrueBooker
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-61949 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Bookly plugin <= 27.7 - SQL Injection vulnerability
- Bookly
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-61948 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability
- Shahjada WPDM – Premium Packages
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-59526 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability
- RomanCode MapSVG
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-59525 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Participants Database plugin <= 2.7.8.3 - SQL Injection vulnerability
- Roland Barker Participants Database
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-59514 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Buddyboss Platform plugin <= 3.0.5 - SQL Injection vulnerability
- MightyNetworks vs BuddyBoss Buddyboss Platform
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-25405 CVE record

CVSS 8.5 High

WordPress eRoom plugin <= 1.7.1 - SQL Injection vulnerability
- DigitalME eRoom
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-24552 CVE record

CVSS 8.5 High

WordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerability
- John-Michael L'Allier Create
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-15448 CVE record

CVSS 6.5 Medium

Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter
- Tickera – Sell Tickets & Manage Events
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-13119 CVE record

CVSS 6.5 Medium

Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter
- roundupwp Registrations for the Events Calendar – Event Registration Plugin
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-13009 CVE record

CVSS 6.5 Medium

AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter
- wupsales AI Copilot – Content Generator
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-15906 CVE record

CVSS 6.5 Medium

Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter
- codename065 Premium Packages – Sell Digital Products Securely
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-15761 CVE record

CVSS 6.5 Medium

Tickera <= 3.6.0.1 - Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter
- Tickera – Sell Tickets & Manage Events
- SQL injection
Not analysed yet 23 Jul 2026
CVE-2026-9713 CVE record

CVSS 7.5 High

Product Designer for WooCommerce WordPress | Lumise <= 2.1.1 - Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload
- King-Theme Product Designer for WooCommerce WordPress | Lumise
- SQL injection
Not analysed yet 23 Jul 2026
n8n npm

CVSS 5.3 Medium

n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
- SQL injection
<1.123.67 || >=2.0.0-rc.0, <2.31.5 || >=2.32.0, <2.32.1 · fixed in 1.123.67, 2.31.5, 2.32.1

GHSA-652q-gvq3-74qv · CVE-2026-72750 Not analysed yet 22 Jul 2026