Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.8 High
SQL Injection in HAVELSAN's Sef - AI Chatbot Platform
- HAVELSAN Inc. Sef - AI Chatbot Platform
- SQL injection
- CVSS 6.5 Medium
Event Tickets and Registration <= 5.29.5 - Authenticated (Contributor+) SQL Injection via 'orderby' Parameter
- stellarwp Event Tickets and Registration
- SQL injection
- CVSS 6.5 Medium
MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter
- wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions
- SQL injection
- CVSS 6.2 Medium
BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter
- BuildKit
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php activity sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Pet Shop Management System admin_reservefilter.php sql injection
- itsourcecode Pet Shop Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Pet Shop Management System admin_reject_completed.php sql injection
- itsourcecode Pet Shop Management System
- Other injection
- SQL injection
- CVSS 8.6 High
ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter
- MacWarrior clipbucket-v5
- SQL injection
- CVSS 6.5 Medium
Rubygem-katello: sql injection in registry proxy via labels
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- SQL injection
- CVSS 5.3 Medium
itsourcecode Leave Management System controller.php sql injection
- itsourcecode Leave Management System
- Other injection
- SQL injection
- CVSS 9.9 CriticalCritical · CVSS 9+
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking
- SQL injection
<0.0.0-20260721043339-eef10568384e · fixed in 0.0.0-20260721043339-eef10568384e
GHSA-33jq-p8c2-q3q4 · CVE-2026-69085 - CVSS 9.3 CriticalCritical · CVSS 9+
WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability
- nickboss WordPress File Upload
- SQL injection
- CVSS 7.6 High
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
- Ultimate Member
- SQL injection
- CVSS 7.6 High
WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability
- captivateaudio Captivate Sync
- SQL injection
- CVSS 8.5 High
WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability
- VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder
- SQL injection
- CVSS 8.5 High
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- SQL injection
- CVSS 7.0 High
n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
- n8n
- SQL injection
- CVSS 7.1 High
n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
- n8n
- SQL injection
- CVSS 7.2 High
SQL Injection in Grafana Integration Endpoint (query.php)
- Pandora FMS
- SQL injection
- CVSS 8.6 High
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter
- Pro Like Button
- SQL injection
- CVSS 7.5 High
Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
- Paytm Payment Gateway
- SQL injection
- CVSS 5.3 Medium
itsourcecode Leave Management System controller.php sql injection
- itsourcecode Leave Management System
- Other injection
- SQL injection
- CVSS 7.1 High
Kiteworks Secure Data Forms SQL injection
- Kiteworks Secure Data Forms
- SQL injection
- CVSS 7.2 High
Kiteworks Core SQL Injection
- Kiteworks Core
- SQL injection
- CVSS 6.9 Medium
AdithyaYelloju Restaurant-Management-System table_booking.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
AdithyaYelloju Restaurant-Management-System Order Placement ord.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection
- AdithyaYelloju Restaurant-Management-System
- Other injection
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
- joomcode.com JCTables extension for Joomla
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
SQL Injection in Trex Digital Manufacturing's Trex MES
- Trex Digital Smart Manufacturing Systems Inc. Trex MES
- SQL injection
- CVSS 7.6 High
WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability
- WPTasty Business Directory
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Multiple Vulnerabilities in Dolusoft Software's SOPLOG
- Dolusoft Software Technologies SOPLOG
- SQL injection
- CVSS 5.1 Medium
OS4ED openSIS-Classic Save Data DatabaseInc.php db_properties sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 5.3 Medium
OS4ED openSIS-Classic Student List Search Endpoint GetStuListFnc.php DBQuery sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 8.5 High
WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability
- David Lingren Media LIbrary Assistant
- SQL injection
- CVSS 8.5 High
WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability
- Liquid Web / StellarWP Event Tickets
- SQL injection
- CVSS 7.6 High
WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability
- Vidish Category Discount Woocommerce
- SQL injection
- CVSS 7.6 High
WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability
- Melapress Admin Notices Manager
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability
- Hossni Mubarak Books Gallery
- SQL injection
- CVSS 7.6 High
WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability
- weDevs WP ERP
- SQL injection
- CVSS 7.6 High
WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability
- Estatik
- SQL injection
- CVSS 8.5 High
WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
- Ruben Garcia GamiPress
- SQL injection
- CVSS 8.5 High
WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability
- Fatcatapps Easy Pricing Tables
- SQL injection
- CVSS 7.6 High
WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability
- Fatcatapps Quiz Cat
- SQL injection
- CVSS 8.2 High
WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability
- Passionate Programmer Peter WP Data Access
- SQL injection
- CVSS 7.6 High
WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability
- Melapress WP Activity Log
- SQL injection
- CVSS 5.3 Medium
OS4ED openSIS-Classic Student Search CustomFieldsFnc.php sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 5.3 Medium
OS4ED openSIS-Classic Assignment Management Endpoint Assignments.php DBQuery_assignment sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 5.1 Medium
OS4ED openSIS-Classic General Information Tab Student.php save action sql injection
- OS4ED openSIS-Classic
- Other injection
- SQL injection
- CVSS 5.5 Medium
Moodle: sql injection in question bank web service
- SQL injection
- CVSS 7.1 High
DigiWin｜EasyFlow .NET - SQL Injection
- DigiWin EasyFlow .NET
- SQL injection
- CVSS 6.5 Medium
WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
- wpdirectorykit WP Directory Kit
- SQL injection
- CVSS 7.5 High
Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
- stylemix Motors – Car Dealership & Classified Listings Plugin
- SQL injection
- CVSS 6.9 Medium
SourceCodester Car Driving School Management System Master.php save_enrollment sql injection
- SourceCodester Car Driving School Management System
- Other injection
- SQL injection
- CVSS 5.1 Medium
SourceCodester Online Leave Management System page reports sql injection
- SourceCodester Online Leave Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System exam-delete.php sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System btn_functions.php sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
SourceCodester Online Reviewer Management System questions-view.php sql injection
- SourceCodester Online Reviewer Management System
- Other injection
- SQL injection
- CVSS 2.1 Low
SQL injection in Zetetic SQLCipher
- Zetetic SQLCipher
- SQL injection
- CVSS 8.5 High
Toptech TMS7 and TopHAT SQL Injection
- Toptech Systems TMS7
- Toptech Systems TopHAT
- SQL injection