Advisories · Weakness
SQL injection.
Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.7 High
Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
- lotus
- SQL injection
- CVSS 8.7 High
Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
- lotus
- SQL injection
- CVSS 8.7 High
JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API
- riclolsen json-scada
- SQL injection
- CVSS 8.8 High
Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
- Weaver Network Co., Ltd. E-cology
- SQL injection
- CVSS 8.8 High
i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php
- i-Netsolution Readymade Unilevel Ecommerce MLM
- SQL injection
- CVSS 8.8 High
PHPOK < 5.4.081 SQL Injection via api.php sort Parameter
- PHPOK
- SQL injection
- CVSS 8.8 High
NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint
- WPDeveloper NotificationX
- SQL injection
- CVSS 8.8 High
SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
- SeaCMS
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability
- TMS Amelia
- SQL injection
- CVSS 6.9 Medium
oretnom23 php-travel-agency-system Insertion insert.php sql injection
- oretnom23 php-travel-agency-system
- Other injection
- SQL injection
- CVSS 7.1 High
Frappe before 16.33.0 Blind SQL Injection via get_events
- frappe
- SQL injection
- CVSS 6.5 Medium
amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
- Drupal amazee.ai Private AI Provider
- SQL injection
- CVSS 6.5 Medium
CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136
- Drupal CSP log
- SQL injection
- CVSS 6.9 Medium
oretnom23 php-travel-agency-system update.php sql injection
- oretnom23 php-travel-agency-system
- Other injection
- SQL injection
- CVSS 6.9 Medium
oretnom23 php-travel-agency-system delete.php sql injection
- oretnom23 php-travel-agency-system
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Cake Ordering System transactionsave.php sql injection
- itsourcecode Online Cake Ordering System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Cake Ordering System orderdetail.php sql injection
- itsourcecode Online Cake Ordering System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Cake Ordering System inserttrans.php sql injection
- itsourcecode Online Cake Ordering System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Cake Ordering System deleteproduct.php sql injection
- itsourcecode Online Cake Ordering System
- Other injection
- SQL injection
- CVSS 5.3 Medium
ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection
- ProjectWorlds Advanced Library Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
- ProjectWorlds Advanced Library Management System
- Other injection
- SQL injection
- CVSS 5.1 Medium
ProjectWorlds Advanced Library Management System edit_member.php sql injection
- ProjectWorlds Advanced Library Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection
- ProjectWorlds Advanced Library Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
oretnom23 file-management-system-php File Management files.php sql injection
- oretnom23 file-management-system-php
- Other injection
- SQL injection
- CVSS 8.8 High
Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities
- Cisco Emergency Responder
- Cisco Unified Communications Manager
- SQL injection
- CVSS 6.9 Medium
oretnom23 file-management-system-php File Download download.php readfile sql injection
- oretnom23 file-management-system-php
- Other injection
- SQL injection
- CVSS 6.9 Medium
oretnom23 file-management-system-php Folder Management admin_class.php save_files sql injection
- oretnom23 file-management-system-php
- Other injection
- SQL injection
- CVSS 6.9 Medium
oretnom23 file-management-system-php User Account Management admin_class.php save_user sql injection
- oretnom23 file-management-system-php
- Other injection
- SQL injection
- CVSS 6.9 Medium
oretnom23 file-management-system-php admin_class.php login sql injection
- oretnom23 file-management-system-php
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection
- itsourcecode Sales-and-Inventory-System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Sales-and-Inventory-System cust_del.php sql injection
- itsourcecode Sales-and-Inventory-System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Sales-and-Inventory-System cust_edit.php sql injection
- itsourcecode Sales-and-Inventory-System
- Other injection
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability
- WPdreams Ajax Search Lite
- SQL injection
- CVSS 6.9 Medium
dhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection
- dhikshitha29 Insurance-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
dhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection
- dhikshitha29 Insurance-Management-System
- Other injection
- SQL injection
- CVSS 8.6 High
Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters
- Click n Chat (Chat Widget Integration)
- SQL injection
- CVSS 8.6 High
Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter
- Click n Chat (Chat Widget Integration)
- SQL injection
- CVSS 6.8 Medium
Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer
- Swift Performance Lite
- SQL injection
- CVSS 7.7 High
Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action
- Modern Events Calendar Lite
- Modern Event Calendar Pro
- SQL injection
- CVSS 5.3 Medium
projectworlds Advanced Library Management System report_search.php mysqli_query sql injection
- projectworlds Advanced Library Management System
- Other injection
- SQL injection
- CVSS 5.3 Medium
itsourcecode Online Cake Ordering System deletecustomer.php sql injection
- itsourcecode Online Cake Ordering System
- Other injection
- SQL injection
- CVSS 8.3 High
Trigger.dev before 4.5.6 SQL Injection via tags in Realtime Runs API
- triggerdotdev trigger.dev
- SQL injection
- CVSS 7.1 High
Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders
- triggerdotdev trigger.dev
- SQL injection
- CVSS 7.5 High
Missing authentication in Oracle Corporation Oracle Product Lifecycle Analytics
- Oracle Corporation Oracle Product Lifecycle Analytics
- SQL injection
- Privilege escalation
- CVSS 8.8 High
FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx
- FooSun DotNetCMS
- SQL injection
- CVSS 6.0 Medium
Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var
- jleyva moodle-block_configurablereports
- SQL injection
- CVSS 8.8 High
Apache Cocoon: SQL Injection
- Apache Software Foundation Apache Cocoon
- SQL injection
- CVSS 6.9 Medium
Osclass Item Model Item.php findUserItems sql injection
- Osclass
- Other injection
- SQL injection
- CVSS 7.1 High
TYPO3-EXT-SA-2026-029: SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
- SQL injection
<7.4.6 || >=8.0.0, <8.1.12 · fixed in 7.4.6, 8.1.12
PKSA-s32p-q272-ns98 · CVE-2026-112064 - CVSS 8.7 High
TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager)
- SQL injection
<3.1.3 · fixed in 3.1.3
PKSA-jx7x-rkr7-n2tb · CVE-2026-112238 - CVSS 8.7 High
YS-infoware｜BA-Workflow - SQL Injection
- YS-infoware BA-Workflow
- SQL injection
- CVSS 8.7 High
YS-infoware｜BA-Workflow - SQL Injection
- YS-infoware BA-Workflow
- SQL injection
- CVSS 8.7 High
YS-infoware｜BA-Workflow - SQL Injection
- YS-infoware BA-Workflow
- SQL injection
- CVSS 7.5 High
EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
- EventON - Subscriber
- SQL injection
- CVSS 6.9 Medium
Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection
- Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System
- Other injection
- SQL injection
- CVSS 6.9 Medium
vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection
- vraj404 Criminal-Management-System
- Other injection
- SQL injection
- CVSS 8.6 High
NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields
- nocobase
- SQL injection
- CVSS 6.9 Medium
vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
- vraj404 Criminal-Management-System
- Other injection
- SQL injection
- CVSS 6.9 Medium
vraj404 Criminal Management System Submission Form home.php sql injection
- vraj404 Criminal Management System
- Other injection
- SQL injection
- CVSS 6.9 Medium
vraj404 Criminal-Management-System search.php sql injection
- vraj404 Criminal-Management-System
- Other injection
- SQL injection