Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.5 Medium
Better Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- SQL injection
- CVSS 8.5 High
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion
- SQL injection
<4.1.6 · fixed in 4.1.6
GHSA-rw77-vq4g-x3hp · CVE-2026-56738 - CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated SQL Injection in ServiceNow AI Platform
- ServiceNow AI Platform
- SQL injection
- CVSS 5.3 Medium
YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection
- YunaiV ruoyi-vue-pro
- zhijiantianya ruoyi-vue-pro
- Other injection
- SQL injection
- CVSS 8.6 High
IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities
- IBM Enterprise Build of Quarkus
- SQL injection
- CVSS 8.8 High
SQL Injection in DIAEnergie
- Deltaww DIAEnergie
- SQL injection
- CVSS 8.8 High
SQL Injection in DIAEnergie
- Deltaww DIAEnergie
- SQL injection
- CVSS 6.9 Medium
java110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection
- java110 MicroCommunity
- Other injection
- SQL injection
- CVSS 5.3 Medium
Forma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection
- Forma LMS
- Other injection
- SQL injection
- CVSS 6.9 Medium
pmTicket Project-Management-Software add_project.php setSync sql injection
- pmTicket Project-Management-Software
- Other injection
- SQL injection
- CVSS 6.9 Medium
SoftNews Media Group DataLife Engine Search search.php strip_data sql injection
- SoftNews Media Group DataLife Engine
- Other injection
- SQL injection
- CVSS 7.5 High
ReactPress has SQL injection via dynamic column names in TypeORM query builders
- SQL injection
<3.7.0 · fixed in 3.7.0
GHSA-wmw4-mw6x-6vfm · CVE-2026-61685 - CVSS 6.9 Medium
Abdurrab5 online-makeup-store Customer Login customerSignin.php sql injection
- Abdurrab5 online-makeup-store
- Other injection
- SQL injection
- CVSS 6.9 Medium
Abdurrab5 online-makeup-store Admin Login index.php sql injection
- Abdurrab5 online-makeup-store
- Other injection
- SQL injection
- CVSS 7.6 High
WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability
- Shazzad Hossain Khan W4 Post List
- SQL injection
- CVSS 8.6 High
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0
- joomshaper.com Easy Store extension for Joomla
- SQL injection
- CVSS 8.6 High
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0
- joomshaper.com Easy Store extension for Joomla
- SQL injection
- CVSS 6.9 Medium
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)
- SQL injection
<2.6.25 || >=3.0.0, <3.0.8 · fixed in 2.6.25, 3.0.8
GHSA-jg26-q8hg-3pq4 · CVE-2026-92692 - CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability
- WBW Plugins Product Filter by WBW
- SQL injection
- CVSS 7.6 High
WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability
- Ben Roberts Ultimeter
- SQL injection
- CVSS 7.1 High
WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability
- Tainacan
- SQL injection
- CVSS 7.6 High
WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
- Syed Balkhi Easy Digital Downloads
- SQL injection
- CVSS 7.6 High
WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
- WebFactory Email Log
- SQL injection
- CVSS 8.5 High
WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability
- levelfourdevelopment WP EasyCart
- SQL injection
- CVSS 8.5 High
WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability
- Nick van Wobbie Mollie Forms
- SQL injection
- CVSS 8.5 High
WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability
- bdthemes Live Copy Paste for Elementor
- SQL injection
- CVSS 6.9 Medium
Neethuharii CafeManagement Login CafePortalLogin.php sql injection
- Neethuharii CafeManagement
- Other injection
- SQL injection
- CVSS 6.5 Medium
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- SQL injection
- CVSS 8.7 High
Photoview through 2.4.0 SQL Injection via album download route
- Photoview
- SQL injection
- CVSS 7.0 High
Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks
- isotope-core
- SQL injection
- CVSS 8.8 High
Broken Authentication vulnerability
- Zohocorp ManageEngine Applications Manager
- SQL injection
- CVSS 8.8 High
SQL Injection vulnerability
- Zohocorp ManageEngine OpManager
- Zohocorp ManageEngine Firewall Analyzer
- SQL injection
- CVSS 7.5 High
Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
- travispluse Rename wp-login.php to anything you want
- SQL injection
- CVSS 6.8 Medium
Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)
- Booking Manager
- SQL injection
- CVSS 8.6 High
JetFormBuilder Stripe Gateway < 1.1.0 - Unauthenticated Blind SQLi via Payment Token
- jet-form-builder-stripe-gateway
- SQL injection
- CVSS 5.3 Medium
iFlytek astron-agent getBotList API endpoint ChatBotMarketMapper.xml sql injection
- iFlytek astron-agent
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System exam-delete.php sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php update sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php update sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php add sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 8.7 High
ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.php
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 5.3 Medium
AdithyaYelloju Restaurant-Management-System Search Form display_menu.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests
- SQL injection
- CVSS 5.3 Medium
itsourcecode Leave Management System index.php sql injection
- itsourcecode Leave Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
TDuckCloud tduck-platform Pagination Inner Interceptor MybatisPlusConfig.java PaginationInnerInterceptor.concatOrderBy sql injection
- TDuckCloud tduck-platform
- Other injection
- SQL injection
- CVSS 8.1 High
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- SQL injection
- CVSS 6.9 Medium
anirbandutta9 College-Notes-Gallery login.php sql injection
- anirbandutta9 College-Notes-Gallery
- Other injection
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Connect
- Adobe Connect Android Mobile App
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Campaign Classic
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Campaign Classic
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
- Adobe Campaign Classic
- SQL injection
- CVSS 8.8 High
SQL injection in NVIDIA Infrastructure Controller
- NVIDIA Infrastructure Controller
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQLi in Karel Electronics' KarelIPS
- Karel Electronic Industry and Trade Inc. KarelIPS
- SQL injection
- CVSS 7.6 High
WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability
- DevItems HashBar – WordPress Notification Bar
- SQL injection
- CVSS 5.3 Medium
Yonyou U8cloud OpenAPI so.saleorder.sendaudit sql injection
- Yonyou U8cloud
- Other injection
- SQL injection
- CVSS 6.9 Medium
Yonyou KSOA search_list.jsp sql injection
- Yonyou KSOA
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
- SQL injection
- CVSS 7.9 High
Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution
- chartbrew
- SQL injection
- CVSS 5.8 Medium
Chartbrew: SQL Injection via row_limit Parameter in AI runQuery Tool
- chartbrew
- SQL injection