SQL injection.

SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

• SPIP
• SQL injection

GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection

• rubengc GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
• SQL injection

NextGen Healthcare Mirth Connect SQL Injection

• NextGen Healthcare Mirth Connect
• SQL injection

Unlimited Elements For Elementor <= 2.0.16 - Unauthenticated SQL Injection

• unitecms Unlimited Elements For Elementor
• SQL injection

Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection

• gingerplugins Sticky Chat Widget – Floating Chat Icons, Contact Form, Call, Click to Chat, Email & Message Buttons
• SQL injection

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php

• SQL injection

OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

• The OpenNMS Group Meridian
• The OpenNMS Group Horizon
• SQL injection

Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

• SQL injection

<11.5.19 || >=12.0.0-RC1, <12.3.10 || >=2026.1.0, <2026.1.6 · fixed in 11.5.19, 12.3.10, 2026.1.6

FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action

• FileRun
• SQL injection

WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability

• Par avisverifies Verified Reviews (Avis Vérifiés)
• SQL injection

OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier

• openpanel
• SQL injection

SQLi in GIS Informatics' GisLab Laboratory Management System

• GIS Informatics GisLab Laboratory Management System
• SQL injection

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4

• joomshaper.com SP Property extension for Joomla
• SQL injection

SQLi in Armiya Information Technologies' Access Control System

• Armiya Information Technologies Ltd. Co. Access Control System
• SQL injection

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php.

• SQL injection

Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection

• Rizwan17 inventory-management-system
• Other injection
• SQL injection

Rizwan17 inventory-management-system manage.php update_record sql injection

• Rizwan17 inventory-management-system
• Other injection
• SQL injection

SQL injection in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• SQL injection

SQL injection in WebPros cPanel

• WebPros cPanel
• SQL injection

SQL injection in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• SQL injection

SQL injection in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• SQL injection

siyuan before v3.8.2 SQL Injection via fullTextSearchBlock

• siyuan
• SQL injection

SQL injection in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• SQL injection

SQL injection in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• SQL injection

WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter

• aukejomm WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping
• SQL injection

Quentn WP < 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter

• Quentn WP
• SQL injection

Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter

• Quentn WP
• SQL injection

ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id

• ELEX WooCommerce Request a Quote
• SQL injection

WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta

• themeum WP Crowdfunding
• SQL injection

Mail Mint <= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter

• getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
• SQL injection

Tanium addressed a SQL injection vulnerability in Comply.

• Tanium Comply
• SQL injection

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the…

• SQL injection

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands…

• SQL injection

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and mul…

• SQL injection

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

• SQL injection

>=5.1.0, <5.1.10 || >=5.2.0, <5.2.15 || >=5.3.0, <5.3.7 · fixed in 5.1.10, 5.2.15, 5.3.7

Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores

• Okta Access Gateway
• SQL injection

ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• SQL injection

itsourcecode Sales and Inventory System us_edit.php sql injection

• itsourcecode Sales and Inventory System
• Other injection
• SQL injection

Microsoft SQL Server Elevation of Privilege Vulnerability

• Microsoft SQL Server 2017 (CU 31)
• Microsoft SQL Server 2017 (GDR)
• SQL injection

Microsoft Office SharePoint Information Disclosure Vulnerability

• Microsoft SharePoint Server Subscription Edition
• SQL injection

SQL Server Elevation of Privilege Vulnerability

• Microsoft SQL Server 2017 (CU 31)
• Microsoft SQL Server 2017 (GDR)
• SQL injection

Microsoft Office SharePoint Elevation of Privilege Vulnerability

• Microsoft SharePoint Server Subscription Edition
• SQL injection

Microsoft SQL Server Elevation of Privilege Vulnerability

• Microsoft SQL Server 2017 (CU 31)
• Microsoft SQL Server 2017 (GDR)
• SQL injection

Azure Arc SQL Server Extension Elevation of Privilege Vulnerability

• Microsoft Azure Arc SQL Server Extension
• SQL injection
• Authentication bypass

aircheng-org iWebShop-5 member.php member_list sql injection

• aircheng-org iWebShop-5
• Other injection
• SQL injection

Private Metrics Server SQL Injection

• Commvault Cloud
• SQL injection

WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’

• WPML Multilingual CMS
• SQL injection

code-projects Student Crud Operation edit.php sql injection

• code-projects Student Crud Operation
• Other injection
• SQL injection

itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection

• itsourcecode Sales and Inventory System
• Other injection
• SQL injection

SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)

• SAP_SE SAP S/4HANA (Intercompany Matching and Reconciliation)
• SQL injection

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters.

• SQL injection

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data.

• SQL injection

Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore.

• SQL injection

A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement.

• SQL injection

itsourcecode Sales and Inventory System cust_edit1.php sql injection

• itsourcecode Sales and Inventory System
• Other injection
• SQL injection

itsourcecode Sales and Inventory System pro_searchfrm.php sql injection

• itsourcecode Sales and Inventory System
• Other injection
• SQL injection

SourceCodester Class and Exam Timetabling System delete_subject.php sql injection

• SourceCodester Class and Exam Timetabling System
• Other injection
• SQL injection

itsourcecode Sales and Inventory System us_edit1.php sql injection

• itsourcecode Sales and Inventory System
• Other injection
• SQL injection

SourceCodester Online Voting System ajax.php save_category sql injection

• SourceCodester Online Voting System
• Other injection
• SQL injection

jaychouchannel Tourism-Management-System CommonDao CommonController.java sql injection

• jaychouchannel Tourism-Management-System
• Other injection
• SQL injection