Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability
- WP BASE Booking
- SQL injection
- CVSS 6.9 Medium
onetwothreeneth HospitalManagementSystem transaction_details.php sql injection
- onetwothreeneth HospitalManagementSystem
- Other injection
- SQL injection
- CVSS 6.9 Medium
UNION HospitalManagementSystem patient_info.php sql injection
- UNION HospitalManagementSystem
- Other injection
- SQL injection
- CVSS 6.9 Medium
onetwothreeneth HospitalManagementSystem controller.php sql injection
- onetwothreeneth HospitalManagementSystem
- Other injection
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16
- ordasoft.com OrdaSoft Joomla CCK
- SQL injection
- CVSS 5.3 Medium
feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection
- feelec-yishu feelcrm-os
- Other injection
- SQL injection
- CVSS 8.5 High
WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability
- Sirv
- SQL injection
- CVSS 7.6 High
WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability
- Groundhogg
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Admission System schoolyear.php sql injection
- itsourcecode Online Admission System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Admission System Project login1.php sql injection
- itsourcecode Online Admission System Project
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php course sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php update sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system Registration deliverysignup.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system Admin Registration signup.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system deliverymyord.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Admission System key.php sql injection
- itsourcecode Online Admission System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Admission System new.php sql injection
- itsourcecode Online Admission System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Admission System examinee.php sql injection
- itsourcecode Online Admission System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Admission System creteria.php sql injection
- itsourcecode Online Admission System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Admission System confirm.php sql injection
- itsourcecode Online Admission System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php update sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Admission System register1.php sql injection
- itsourcecode Online Admission System
- Other injection
- SQL injection
- CVSS 5.1 Medium
SourceCodester Drug Recommendation System Symptom Creation add_symptom.php mysqli_real_escape_string sql injection
- SourceCodester Drug Recommendation System
- Other injection
- SQL injection
- CVSS 5.1 Medium
SourceCodester Drug Recommendation System Drug Creation add_drug.php sql injection
- SourceCodester Drug Recommendation System
- Other injection
- SQL injection
- CVSS 5.1 Medium
SourceCodester Drug Recommendation System edit_class.php sql injection
- SourceCodester Drug Recommendation System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Drug Recommendation System Student Registration add_student.php sql injection
- SourceCodester Drug Recommendation System
- Other injection
- SQL injection
- CVSS 6.9 Medium
itsourcecode Online Admission System login1.php sql injection
- itsourcecode Online Admission System
- Other injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter().
- SQL injection
- CVSS 6.5 Medium
ApiAdmin v.5.0 and before is vulnerable to SQL Injection in the user-list endpoint GET /admin/User/getUsers via the gid parameter.
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system Take Order delivery.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 5.3 Medium
kishor-23 food-waste-management-system Order Assignment Block admin.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system donate.php sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
kishor-23 food-waste-management-system Food Donation Form fooddonateform.php insert sql injection
- kishor-23 food-waste-management-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
RainyGao DocSys Database Management BaseController.java BaseController.createDBForMysql sql injection
- RainyGao DocSys
- Other injection
- SQL injection
- CVSS 6.9 Medium
mooSocial all-products sql injection
- mooSocial
- Other injection
- SQL injection
- CVSS 5.1 Medium
Comsenz Discuz! Admin Medal Moderation mod.php modmedalsubmit sql injection
- Comsenz Discuz!
- Other injection
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- SQL injection
- CVSS 8.8 High
Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter
- storeapps Smart Manager – WooCommerce Bulk Edit: Products, Orders, Users & More (Spreadsheet)
- SQL injection
- CVSS 7.5 High
WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter
- osamaesh WP Visitor Statistics (Real Time Traffic)
- SQL injection
- CVSS 6.3 Medium
Unlimited Elements For Elementor 1.5.142 - 2.0.20 - Subscriber+ SQLi via get_addon_output_data
- Unlimited Elements for Elementor
- SQL injection
- CVSS 8.6 High
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters
- SaveTo Wishlist Lite
- SQL injection
- CVSS 6.8 Medium
Unlimited Elements For Elementor 1.5.139 - 2.0.20 - Unauthenticated SQLi via 'ucs' Parameter
- Unlimited Elements for Elementor
- SQL injection
- CVSS 7.5 High
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- SQL injection
- CVSS 6.5 Medium
SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
- psmplugins SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent
- SQL injection
- CVSS 6.5 Medium
Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter
- beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
- SQL injection
- CVSS 8.3 High
Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name
- SQL injection
- Broken access control
<4.5.6 · fixed in 4.5.6
GHSA-9q4r-4842-93vw · CVE-2026-114081 - CVSS 7.1 High
UTMStack < 11.2.16 JPQL Injection via searchPropertyValues
- UTMStack
- SQL injection
- CVSS 8.7 High
UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter
- UTMStack
- SQL injection
- CVSS 5.3 Medium
CodeAstro Simple Loan Management System index.php sql injection
- CodeAstro Simple Loan Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Simple Pharmacy Management System delete.php sql injection
- CodeAstro Simple Pharmacy Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
CodeAstro Simple Pharmacy Management System view.php sql injection
- CodeAstro Simple Pharmacy Management System
- Other injection
- SQL injection
- CVSS 7.1 High
SQL Injection in GG Soft's Paperwork
- GG Soft Software Services Inc. Paperwork
- SQL injection
- CVSS 6.9 Medium
onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection
- onetwothreeneth HospitalManagementSystem
- Other injection
- SQL injection
- CVSS 8.8 High
YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
- yeswiki
- SQL injection
- CVSS 8.7 High
YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch
- yeswiki
- SQL injection
- CVSS 8.8 High
YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
- yeswiki
- SQL injection
- CVSS 7.2 High
YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
- yeswiki
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Admission System Project confirm.php sql injection
- itsourcecode Online Admission System Project
- Other injection
- SQL injection