Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.8 Medium
n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances
- SQL injection
<1.123.67 || >=2.0.0-rc.0, <2.31.5 || >=2.32.0, <2.32.1 · fixed in 1.123.67, 2.31.5, 2.32.1
GHSA-jqwr-vx3p-r266 · CVE-2026-72775 - CVSS 5.3 Medium
n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
- SQL injection
<1.123.61 || >=2.0.0-rc.0, <2.27.4 || >=2.28.0, <2.28.1 · fixed in 1.123.61, 2.27.4, 2.28.1
GHSA-hwmj-qg4v-cvg9 · CVE-2026-59257 - CVSS 9.8 CriticalCritical · CVSS 9+
SQLi in Xpoda Türkiye Informatics Technology's No Code Platform
- Xpoda Türkiye Informatics Technology Inc. No Code Platform
- SQL injection
- CVSS 7.5 High
Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
- Events Manager
- SQL injection
- CVSS 5.3 Medium
itsourcecode Hospital Management System prescription.php sql injection
- itsourcecode Hospital Management System
- Other injection
- SQL injection
- CVSS 6.3 Medium
Improper access control in Oracle Corporation Oracle HCM Configuration Workbench
- Oracle Corporation Oracle HCM Configuration Workbench
- SQL injection
- Information disclosure
- CVSS 6.3 Medium
Improper access control in Oracle Corporation Oracle Learning Management
- Oracle Corporation Oracle Learning Management
- SQL injection
- Information disclosure
- CVSS 8.8 High
SQL injection in Oracle Corporation Oracle Demantra Demand Management
- Oracle Corporation Oracle Demantra Demand Management
- SQL injection
- Broken access control
- CVSS 6.3 Medium
Improper access control in Oracle Corporation Oracle Common Applications Calendar
- Oracle Corporation Oracle Common Applications Calendar
- SQL injection
- Information disclosure
- CVSS 6.3 Medium
Improper access control in Oracle Corporation Oracle Supply Chain Globalization
- Oracle Corporation Oracle Supply Chain Globalization
- SQL injection
- Information disclosure
- CVSS 8.3 High
Improper access control in Oracle Corporation Oracle Enterprise Command Center Framework
- Oracle Corporation Oracle Enterprise Command Center Framework
- SQL injection
- Broken access control
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 7.1 High
Aptabase SQL Injection via ClickHouse query backend
- aptabase
- SQL injection
- CVSS 7.1 High
Blind SQL Injection
- Tenable, Inc. Security Center
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp
- Kunshi Network Technology Co., Ltd. Linknat VOS3000
- Kunshi Network Technology Co., Ltd. Linknat VOS2009
- SQL injection
- CVSS 8.7 High
DHIS2 SQL injection in SQL View filter values
- dhis2-core
- SQL injection
- CVSS 8.8 High
SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
- dhis2-core
- SQL injection
- CVSS 8.6 High
SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox
- MCP Toolbox for Databases (googleapis/mcp-toolbox)
- SQL injection
- Broken access control
- CVSS 5.3 Medium
zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection
- zsadmin2025 ZS-Admin
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQLi in Turkmesh's Turkhotspot 5651 Loglama
- Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama
- SQL injection
- CVSS 7.5 High
Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection
- bpost-shipping-platform
- SQL injection
- CVSS 5.3 Medium
itsourcecode Hospital Management System prescriptionorder.php sql injection
- itsourcecode Hospital Management System
- Other injection
- SQL injection
- CVSS 7.5 High
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Apache Syncope: SQL injection vulnerability in Audit Events search
- Apache Software Foundation Apache Syncope
- SQL injection
- CVSS 6.9 Medium
Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection
- Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System
- Other injection
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Blind SQL Injection in Windu CMS
- JCD Windu CMS
- SQL injection
- CVSS 5.3 Medium
itsourcecode Hospital Management System prescriptionorderreport.php sql injection
- itsourcecode Hospital Management System
- Other injection
- SQL injection
- CVSS 8.6 High
Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more
- Modern Event Calendar Pro
- Modern Events Calendar Lite
- SQL injection
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System edit_subject.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System edit_room1.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection
- SourceCodester Class and Exam Timetabling System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Hospital Management System prescriptionrecord.php sql injection
- itsourcecode Hospital Management System
- Other injection
- SQL injection
- CVSS 5.9 MediumCritical · KEVKEV
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
- WordPress
- SQL injection
- CVSS 6.1 Medium
SQL injection in Amazon Athena Synapse connector
- aws-athena-query-federation
- SQL injection
- CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
- Sangoma Switchvox SMB Edition
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQLi in GIS Informatics' GisLab Laboratory Management System
- Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System
- SQL injection
- CVSS 6.9 Medium
code-projects Hospital Bed Management System Login Form sql injection
- code-projects Hospital Bed Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Hospital Management System prescriptionorderdetail.php sql injection
- itsourcecode Hospital Management System
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.
- SQL injection
- CVSS 4.9 Medium
Booking for Appointments and Events Calendar – Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import
- melograno Booking for Appointments and Events Calendar – Amelia
- SQL injection
- CVSS 4.9 Medium
WP Bulk Delete <= 1.4.2 - Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter
- xylus WP Bulk Delete
- SQL injection
- CVSS 8.7 High
Joomla Extension - themexpert.com - Unauthenticated SQL injection in Quix Page Builder Pro < 6.2.1
- themexpert.com Quix Page Builder Pro extension for Joomla
- SQL injection
- CVSS 4.9 Medium
WP TripAdvisor Review Slider <= 14.6 - Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter
- jgwhite33 WP TripAdvisor Review Slider
- SQL injection
- CVSS 6.5 Medium
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
- themeum Tutor LMS – eLearning and online course solution
- SQL injection
- CVSS 6.5 Medium
Tickera <= 3.6.0.0 - Authenticated (Staff+) SQL Injection via 's' Parameter
- Tickera – Sell Tickets & Manage Events
- SQL injection
- CVSS 6.5 Medium
Quiz and Survey Master (QSM) <= 11.2.0 - Authenticated (Custom+) SQL Injection via 'pages' Parameter
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- SQL injection
- CVSS 6.5 Medium
WP Job Portal < 2.5.5 - Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter
- WP Job Portal
- SQL injection
- CVSS 4.9 Medium
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter
- cleverplugins SEO Booster
- SQL injection
- CVSS 4.9 Medium
SEO Booster <= 7.3.1 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- cleverplugins SEO Booster
- SQL injection
- CVSS 6.5 Medium
MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter
- wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
- SQL injection
- CVSS 7.5 High
Advance Product Search- Voice & Ajax Search for WooCommerce <= 1.4.4 - Unauthenticated SQL Injection via 's' and 'match' Parameter
- themehunk Advance Product Search- Voice & Ajax Search for WooCommerce
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to access sensitive database information via crafted SQL statements.
- SQL injection
- CVSS 8.8 High
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allowing authenticated user to manipulate SQL queries via crafted input.
- SQL injection
- CVSS 6.9 Medium
H3C SecPath F1000-C8300 g=log_fw_nbc_mail_jsondata sql injection
- H3C SecPath F1000-C8300
- Other injection
- SQL injection
- CVSS 8.7 High
DataEase Data Dashboard SqlVariable transFilter Unfiltered SQL Injection
- dataease
- SQL injection
- CVSS 8.7 High
DataEase: Stored SQL Injection Vulnerability
- dataease
- SQL injection