SQL injection.

Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin

• Miantang IoT-PHP
• SQL injection

IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

• thebradleysanders IOTSmartHome
• SQL injection

SQL Injection Vulnerability in ZTE SmartLife App

• ZTE SmartLife
• SQL injection

JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter

• beardev JoomSport – for Sports: Team & League, Football, Hockey & more
• SQL injection

WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection

• afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
• SQL injection

WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Injection

• jgwhite33 WP TripAdvisor Review Slider
• SQL injection

Stock-Inventory-Management-System - Unauthenticated SQL Injection and Hardcoded Credentials in login.php Enable Full Authentication Bypass

• mrswapnilsahu Stock-Inventory-Management-System
• SQL injection

Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter

• 2wstechnologies Askeet — Talk to Your WooCommerce Data
• SQL injection

TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter

• realmag777 TableOn – WordPress Posts Table Filterable
• SQL injection

User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection

• gm_alex User Access Manager
• SQL injection

PostgreSQL Misconfiguration and Command Injection Vulnerability in ZTE NX799J (Red Magic 11 Air) Product

• ZTE NX799J (Red Magic 11 Air)
• SQL injection

Ajax Load More < 8.0.1 - Unauthenticated SQL Injection via custom_args

• Ajax Load More
• SQL injection

PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter

• supercleanse PrettyLinks – Affiliate Link Management, URL Shortener, Link Cloaking, Tracking & Branded Short Links
• SQL injection

Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

• Relevanssi Premium – A Better Search
• comesio Relevanssi – A Better Search
• SQL injection

ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' Parameter

• wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
• SQL injection

VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection

• e4jvikwp VikAppointments Services Booking Calendar
• SQL injection

lavkush-maurya Student-Registration-System changepass.php sql injection

• lavkush-maurya Student-Registration-System
• Other injection
• SQL injection

ESAFENET CDG usbkey;logindojojs sql injection

• ESAFENET CDG
• Other injection
• SQL injection

Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection

• Shandong Hoteam PDM Product Data Management System
• Other injection
• SQL injection

Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()

• maximeAmini Atals-Livre
• SQL injection

SQL injection in Veeam ONE

• Veeam ONE
• SQL injection

chetans9 core-php-admin-panel customers.php sql injection

• chetans9 core-php-admin-panel
• Other injection
• SQL injection

Koha - SQL Injection in reports/issues_stats.pl

• Koha
• SQL injection

Koha - SQL Injection in reports/bor_issues_top.pl

• Koha
• SQL injection

Koha - SQL Injection in reports/issues_avg_stats.pl

• Koha
• SQL injection

Koha - SQL Injection in reports/catalogue_stats.pl

• Koha
• SQL injection

Koha - SQL Injection in reports/acquisitions_stats.pl

• Koha
• SQL injection

Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter

• Database for Contact Form 7, WPforms, Elementor forms
• SQL injection

cemtan sar2html Search sar2html.py sql injection

• cemtan sar2html
• Other injection
• SQL injection

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

• Adobe Campaign Classic
• SQL injection

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

• Adobe Campaign Classic
• SQL injection

Shlink Blind SQL Injection via tags/stats orderBy Parameter

• Shlink
• SQL injection

Sequelize: SQL Injection (Oracle DB)

• SQL injection

<6.37.4 · fixed in 6.37.4

Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter

• krayin laravel-crm
• SQL injection

Duplicate Advisory: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB

• SQL injection

* · no fixed version yet

Duplicate Advisory: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

• SQL injection

* · no fixed version yet

Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

• SQL injection

<=3.7.2 · no fixed version yet

osCommerce Email Template Configuration EmailController.php EmailController sql injection

• osCommerce
• Other injection
• SQL injection

LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

• LogMyTrip
• SQL injection

SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication

• sm page duplicator
• SQL injection

Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking

• Super Store Finder WordPress
• SQL injection

Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form

• Link Library
• SQL injection

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature.

• SQL injection

SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component

• SQL injection

PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

• laughingman7743 PyAthena
• SQL injection

AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter

• AcyMailing
• SQL injection

CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter

• cubewp1211 CubeWP Framework
• SQL injection

WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter

• wpvividplugins WPvivid — Backup, Migration & Staging
• SQL injection

Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter

• Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs
• SQL injection

Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter

• davejesch Database Collation Fix
• SQL injection

GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter

• westerndeal GSheetConnector – CF7 Google Sheets Connector
• SQL injection

Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter

• Icegram Engage – Popups, Optins, CTAs & Lead Generation
• SQL injection

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

• Participants Database
• SQL injection

Pinpoint Booking System <= 2.9.9.6.9 - Authenticated (Administrator+) SQL Injection via 'field' Parameter

• dotonpaper Pinpoint Booking System – Version 2
• SQL injection

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

• SQL injection

<2.0.61 · fixed in 2.0.61

SQL injection in WebPros cPanel and others

• WebPros cPanel
• WebPros WP Squared
• SQL injection

pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

• pgadmin.org pgAdmin 4
• SQL injection
• CWE-115

pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

• pgadmin.org pgAdmin 4
• SQL injection

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

• SQL injection
• Other injection

<2.1.1 · fixed in 2.1.1

Authenticated SQL Injection in PHP Poll Script

• PHP Jabbers PHP Poll Script
• SQL injection