Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.9 Medium
code-projects Doctor Appointment System patient_login.php sql injection
- code-projects Doctor Appointment System
- Other injection
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB
- SQL injection
<0.0.0-20260721004815-cf42dd5680c8 · fixed in 0.0.0-20260721004815-cf42dd5680c8
GHSA-fph3-ghq9-vw66 · CVE-2026-69083 - CVSS 9.9 CriticalCritical · CVSS 9+
SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write
- SQL injection
<0.0.0-20260721002947-23a17d44b5f3 · fixed in 0.0.0-20260721002947-23a17d44b5f3
GHSA-vh22-h7hf-www7 · CVE-2026-69084 - CVSS 8.7 High
R2R 3.6.6 SQL Injection via Retrieval Search Filter Key
- SciPhi-AI R2R
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Medicine Delivery System Wishlist controller.php addwishlist sql injection
- itsourcecode Online Medicine Delivery System
- Other injection
- SQL injection
- CVSS 8.6 High
Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter
- worklenz
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
- SQL injection
- Code injection
<8.21.0 · fixed in 8.21.0
GHSA-2w86-xfrc-g85r · CVE-2026-71867 - CVSS 9.3 CriticalCritical · CVSS 9+
R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint
- SciPhi-AI R2R
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Medicine Delivery System Order Status Update controller.php pupdate sql injection
- itsourcecode Online Medicine Delivery System
- Other injection
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability
- Paolo GeoDirectory
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability
- e4jvikwp VikAppointments Services Booking Calendar
- SQL injection
- CVSS 6.9 Medium
SeaCMS WeChat index.php addslashes sql injection
- SeaCMS
- Other injection
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0
- joodb.feenders.de JooDatabase Lite extension for Joomla
- SQL injection
- CVSS 8.7 High
WWBN AVideo SQL Injection via get.json.php APIName channels
- WWBN AVideo
- SQL injection
- CVSS 8.6 High
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- OCS Inventory NG Ocsreports
- SQL injection
- CVSS 8.6 High
Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- OCS Inventory NG Ocsreports
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
- SQL injection
- Code injection
<8.21.0 · fixed in 8.21.0
GHSA-6mr6-jvcr-2f25 · CVE-2026-71866 - CVSS 7.1 High
Authenticated SQL Injection via nested eager-loading criteria
- cms
- SQL injection
- CVSS 7.5 High
SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content
- SQL injection
<0.0.0-20260704035518-d0f0fe146fb0 · fixed in 0.0.0-20260704035518-d0f0fe146fb0
GHSA-h89q-4j2h-7h88 · CVE-2026-59834 - CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability
- WC Lovers WCFM Marketplace
- SQL injection
- CVSS 8.8 High
SQL injection in Zohocorp ManageEngine Password Manager Pro and others
- Zohocorp ManageEngine Password Manager Pro
- Zohocorp ManageEngine PAM360
- SQL injection
- CVSS 4.1 Medium
WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation
- WPvivid — Backup, Migration & Staging
- SQL injection
- CVSS 5.3 Medium
Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi
- Comments
- SQL injection
- CVSS 8.6 High
Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction
- Baserow
- SQL injection
- CVSS 8.7 High
AVideo User_Location Plugin Unauthenticated SQL Injection
- WWBN AVideo
- SQL injection
- CVSS 7.2 High
Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer
- Hewlett Packard Enterprise (HPE) Fabric Composer
- SQL injection
- CVSS 5.3 Medium
Xinhu Rainrock RockOA index.php toaddval sql injection
- Xinhu Rainrock RockOA
- Other injection
- SQL injection
- CVSS 8.8 High
SQL Injection in TMT Machine's Talassoft Industrial Management Software
- TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software
- SQL injection
- CVSS 6.9 Medium
Chanjet CRM jxf_dump_table.php sql injection
- Chanjet CRM
- Other injection
- SQL injection
- CVSS 5.3 Medium
Xinhu Rainrock RockOA webmainAction.php getOrder sql injection
- Xinhu Rainrock RockOA
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL Injection in TRtek Technological Products's Store
- TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store
- SQL injection
- CVSS 5.1 Medium
CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-ser…
- Schneider Electric NetBotz 5 - 750/755
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL Injection in Teracity Sotware's Teracity E-OSB Platform
- Teracity Software Technologies Inc. E-OSB
- SQL injection
- CVSS 5.3 Medium
zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety sql injection
- zhongyu09 OpenChatBI
- Other injection
- SQL injection
- CVSS 6.5 Medium
Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute
- smub Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
- SQL injection
- CVSS 4.9 Medium
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- SQL injection
- CVSS 4.9 Medium
Photo Gallery by Ays <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter
- ays-pro Photo Gallery by Ays – Responsive Image Gallery
- SQL injection
- CVSS 6.5 Medium
Persistent Login <= 3.1.0 - Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie
- lukeseager Persistent Login
- SQL injection
- CVSS 4.9 Medium
Shopping Cart & eCommerce Store <= 5.9.2 - Authenticated (Administrator+) SQL Injection via 'product_order' Parameter
- levelfourstorefront Shopping Cart & eCommerce Store
- SQL injection
- CVSS 6.9 Medium
ShopEx ECShop flow.php flow_update_cart sql injection
- ShopEx ECShop
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishan0725 Hospital-Management-System search.php sql injection
- kishan0725 Hospital-Management-System
- Other injection
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability
- ウェブ屋のさとーさん Throws SPAM Away
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability
- Autorius E-goi Smart Marketing SMS and Newsletters Forms
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability
- Passionate Programmer Peter WP Data Access
- SQL injection
- CVSS 8.5 High
WordPress Charitable plugin <= 1.8.12.1 - SQL Injection vulnerability
- Syed Balkhi Charitable
- SQL injection
- CVSS 7.1 High
WAPT Server SQL Injection via /api/v3/hosts Endpoint
- Tranquil_IT WAPT
- SQL injection
- CVSS 6.9 Medium
code-projects Online Shopping System Search Functionality action.php sql injection
- code-projects Online Shopping System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Sales and Inventory System inv_searchfrm.php sql injection
- itsourcecode Sales and Inventory System
- Other injection
- SQL injection
- CVSS 8.8 High
SQLi in Ankara Hosting's Site Management Panel
- Ankara Hosting Site Management Panel
- SQL injection
- CVSS 5.3 Medium
Soarkey StudentManagement/学生信息管理系统 CourseDao.java CourseDao.course_ranking sql injection
- Soarkey StudentManagement
- Soarkey 学生信息管理系统
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Medicine Delivery System Password Recovery passwordrecover.php find_phone sql injection
- itsourcecode Online Medicine Delivery System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Medicine Delivery System Product Category Filter index.php loadResultList sql injection
- itsourcecode Online Medicine Delivery System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection
- itsourcecode Online Medicine Delivery System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Medicine Delivery System Product Detail index.php loadResultList sql injection
- itsourcecode Online Medicine Delivery System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Medicine Delivery System Customer Login login.php cusAuthentication sql injection
- itsourcecode Online Medicine Delivery System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Medicine Delivery System Login login.php employeeAuthentication sql injection
- itsourcecode Online Medicine Delivery System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Sales and Inventory System inv_edit.php sql injection
- itsourcecode Sales and Inventory System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SeaCMS zyapi.php sql injection
- SeaCMS
- Other injection
- SQL injection
- CVSS 8.7 High
Admidio before 5.0.12 SQL Injection via relation_type_list
- admidio
- SQL injection
- CVSS 5.3 Medium
itsourcecode Sales and Inventory System sup_searchfrm.php sql injection
- itsourcecode Sales and Inventory System
- Other injection
- SQL injection