Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.6 High
Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQLi via tzwrs_update_cell
- Tz Weekly Radio Schedule
- SQL injection
- CVSS 8.6 High
Tz Weekly Radio Schedule <= 1.8.1 - Unauthenticated SQL Injection via week
- Tz Weekly Radio Schedule
- SQL injection
- CVSS 8.6 High
Product Question and Answer <= 1.1.0 - Unauthenticated SQL Injection via p_id and read
- Product Question and Answer
- SQL injection
- CVSS 8.6 High
Price Drop Alert for WooCommerce <= 1.1 - Unauthenticated SQL Injection via product
- Price Drop Alert for Woo Commerce
- SQL injection
- CVSS 8.6 High
WP Shortcut Link <= 1.2.0 - Unauthenticated SQL Injection via url
- wp shortcut link and advertisement baner
- SQL injection
- CVSS 7.7 High
SQL injection in Zohocorp ManageEngine DataSecurity Plus
- Zohocorp ManageEngine DataSecurity Plus
- SQL injection
- CVSS 7.2 High
CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php
- cubecart v6
- SQL injection
- CVSS 7.2 High
CubeCart: SQL Identifier Injection via Backtick Bypass in maintenance.index.inc.php
- cubecart v6
- SQL injection
- CVSS 7.7 High
SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution
- dataease SQLBot
- SQL injection
- CVSS 6.0 Medium
SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read
- dataease SQLBot
- SQL injection
- CVSS 8.4 High
SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names
- signoz
- SQL injection
- CVSS 8.3 High
ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter
- itflow
- SQL injection
- CVSS 8.1 High
ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration
- itflow
- SQL injection
- CVSS 9.2 CriticalCritical · CVSS 9+
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
- SQL injection
<4.5.12 || >=4.6.0, <4.6.5 || >=5.0.0, <5.1.9 || >=5.2.0, <5.2.14 || >=5.3.0, <5.3.7 · fixed in 4.5.12, 4.6.5, 5.1.9, 5.2.14, 5.3.7
GHSA-vjqc-q4mp-2rvf · CVE-2026-79752 - CVSS 8.2 High
MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation
- MapServer
- SQL injection
- CVSS 7.1 High
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
- frappe hrms
- SQL injection
- CVSS 7.1 High
Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions
- traccar
- SQL injection
- CVSS 6.9 Medium
code-projects Matrimonial System partner_preference.php writepartnerprefs sql injection
- code-projects Matrimonial System
- Other injection
- SQL injection
- CVSS 8.4 High
SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders
- signoz
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Marten's LINQ provider has SQL injection via unescaped string literals
- SQL injection
>=7.0.0, <8.37.4 || >=9.0.0, <9.13.0 · fixed in 8.37.4, 9.13.0
GHSA-rfx3-98h7-v3xp · CVE-2026-75513 - CVSS 7.6 High
WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
- Moreconvert Team MC Woocommerce Wishlist
- SQL injection
- CVSS 7.6 High
WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability
- PublishPress Series
- SQL injection
- CVSS 7.6 High
WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability
- WP Lab WP-Lister Lite for eBay
- SQL injection
- CVSS 7.6 High
WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability
- Sonal S Sinha SKT Addons for Elementor
- SQL injection
- CVSS 7.6 High
WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability
- WCVendors WC Vendors Marketplace
- SQL injection
- CVSS 7.6 High
WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability
- Ludwig You WPMasterToolKit
- SQL injection
- CVSS 7.6 High
WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability
- Tribulant Software Newsletters
- SQL injection
- CVSS 7.6 High
WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability
- Flipper Code WP Maps
- SQL injection
- CVSS 8.5 High
WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability
- RexTheme Product Feed Manager
- SQL injection
- CVSS 8.2 High
Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings
- Snowflake CLI
- SQL injection
- CVSS 8.6 High
Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
- Yo
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.
- SQL injection
- CVSS 4.9 Medium
Cisco ISE REST API SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- SQL injection
- CVSS 7.1 High
Cisco Identity Services Engine SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- SQL injection
- CVSS 4.9 Medium
Cisco Identity Services Engine SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- SQL injection
- CVSS 4.9 Medium
Cisco Identity Services Engine Certificate Management SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- SQL injection
- CVSS 4.9 Medium
Cisco Identity Services Engine Information Disclosure Vulnerability
- Cisco Identity Services Engine Software
- SQL injection
- CVSS 4.9 Medium
Cisco Identity Services Engine SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- SQL injection
- CVSS 4.9 Medium
Cisco Identity Services Engine SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- SQL injection
- CVSS 4.9 Medium
Cisco ISE Profiler SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- SQL injection
- CVSS 7.6 High
Cisco ISE SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- SQL injection
- CVSS 8.8 High
Cisco Secure Firewall Management Center Software SQL Injection Vulnerability
- Cisco Secure Firewall Management Center (FMC)
- SQL injection
- CVSS 7.5 High
Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability
- Cisco Identity Services Engine Software
- SQL injection
- CVSS 8.8 High
Cisco Nexus Dashboard Software Security Hardening Release September 2026 - SQL Injection
- Cisco Nexus Dashboard
- SQL injection
- CVSS 5.3 Medium
itsourcecode Leave Management System index.php sql injection
- itsourcecode Leave Management System
- Other injection
- SQL injection
- CVSS 8.8 High
Tanium addressed a SQL injection vulnerability in Threat Response.
- Tanium Threat Response
- SQL injection
- CVSS 7.2 High
Tanium addressed a SQL injection vulnerability in Asset.
- Tanium Asset
- SQL injection
- CVSS 7.2 High
Tanium addressed a SQL injection vulnerability in Asset.
- Tanium Asset
- SQL injection
- CVSS 6.9 Medium
SourceCodester Inventory and Monitoring System btn_functions.php add sql injection
- SourceCodester Inventory and Monitoring System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Inventory and Monitoring System index.php sql injection
- SourceCodester Inventory and Monitoring System
- Other injection
- SQL injection
- CVSS 6.5 Medium
MikroORM: SQL injection via unvalidated order direction in orderBy
- mikro-orm
- SQL injection
- CVSS 6.5 Medium
Scada-LTS Authenticated Blind SQL Injection
- Scada-LTS
- SQL injection
- CVSS 6.9 Medium
code-projects Matrimonial System Regular Search search.php sql injection
- code-projects Matrimonial System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Leave Management System index.php sql injection
- itsourcecode Leave Management System
- Other injection
- SQL injection
- CVSS 7.6 High
WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability
- Themeum WP Mega Menu
- SQL injection
- CVSS 8.6 High
Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter
- Ni WooCommerce Sales Report
- SQL injection
- CVSS 6.8 Medium
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Import Options
- WP Import Export Lite
- SQL injection
- CVSS 6.8 Medium
WP Import Export Lite < 3.9.33 - Authenticated SQLi via Export Filter Rules
- WP Import Export Lite
- SQL injection
- CVSS 6.5 Medium
WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 5.1 Medium
gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection
- gedelumbung HospitalManagement
- Other injection
- SQL injection