Advisories · Weakness

SQL injection.

Untrusted input reaching a database query. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-109197 CVE record

CVSS 7.5 High

WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter
- wpdirectorykit WP Directory Kit
- SQL injection
Not analysed yet 31 Oct 2026
CVE-2026-101325 CVE record

CVSS 5.3 Medium

Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter
- contrid Newsletters
- SQL injection
Not analysed yet 31 Oct 2026
CVE-2025-9462 CVE record

CVSS 6.5 Medium

WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter
- tobias_conrad WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden
- SQL injection
Not analysed yet 31 Oct 2026
CVE-2026-119163 CVE record

CVSS 7.5 High

FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter
- teamfunnelkit FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
- SQL injection
Not analysed yet 31 Oct 2026
CVE-2026-62849 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection
- mqttsnet thinglinks
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-61620 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

HoneySQL unchecked entity names can lead to SQL injection results
- seancorfield honeysql
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-39732 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability
- Ivijan-Stefan Stipic Transliterator
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-115820 CVE record

CVSS 6.5 Medium

Majestic Support <= 1.2.2 - Authenticated (Subscriber+) SQL Injection via 'columns' Parameter
- ahmadmj Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-119619 CVE record

CVSS 6.9 Medium

37954679 cak-filemanagement-system save_student.php mysqli_query sql injection
- 37954679 cak-filemanagement-system
- Other injection
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-119656 CVE record

CVSS 8.7 High

CoreShop through 1.5.5 SQL Injection via order Parameter in Agent/GetGoodsPageList
- CoreUnion CoreShop
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-119655 CVE record

CVSS 8.7 High

CoreShop through 1.5.5 SQL Injection via order Parameter in GetGoodsPageList
- CoreUnion CoreShop
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-111503 CVE record

CVSS 7.1 High

SQL injection in Dell OpenManage Enterprise
- Dell OpenManage Enterprise
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2025-68394 CVE record

CVSS 8.4 High

SQL Injection in Protectel
- ARKETEAM PROTECTELMAJ
- ARKETEAM BDF
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2025-68393 CVE record

CVSS 8.4 High

SQL Injection in Protectel
- ARKETEAM PROTECTELMAJ
- ARKETEAM BDF
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-119562 CVE record

CVSS 2.3 Low

phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
- phpMyAdmin
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-119554 CVE record

CVSS 6.0 Medium

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber
- moodle
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-119427 CVE record

CVSS 2.3 Low

phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
- phpMyAdmin
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-119419 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
- cakephp
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-119418 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
- cakephp
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-64618 CVE record

Apache Fineract: SQL injection vulnerability in Search API
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-65874 CVE record

Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
- Apache Software Foundation Apache Fineract
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-117572 CVE record

CVSS 4.1 Medium

WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
- WP Visitor Statistics (Real Time Traffic)
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-118698 CVE record

CVSS 6.5 Medium

JoomSport <= 5.7.14 - Authenticated (Contributor+) SQL Injection via 'pgroup' Shortcode Attribute
- beardev JoomSport – for Sports: Team & League, Football, Hockey & more
- SQL injection
Not analysed yet 30 Oct 2026
CVE-2026-61654 CVE record

CVSS 8.3 High

Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
- lightdash
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-11587 CVE record

CVSS 7.2 High

Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0
- Centreon
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-61996 CVE record

CVSS 8.5 High

WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability
- favethemes MLS On The Fly
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-39736 CVE record

CVSS 8.5 High

WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability
- Crocoblock JetEngine
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-49142 CVE record

CVSS 8.7 High

OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
- openemr
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-110184 CVE record

CVSS 7.5 High

Newsmatic <= 1.5.0 - Unauthenticated SQL Injection via 'slug' Parameter
- blazethemes Newsmatic
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-115964 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability
- StylemixThemes Motors
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-115965 CVE record

CVSS 8.5 High

WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
- BuddyPress
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-118192 CVE record

CVSS 6.5 Medium

JoomSport <= 5.7.11 - Authenticated (Contributor+) SQL Injection via 'team_id' Shortcode Attribute
- beardev JoomSport – for Sports: Team & League, Football, Hockey & more
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-114358 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

SQL Injection Vulnerability in Radius Xenia M2M Platform
- Radius Synergies Radius Xenia M2M Platform
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-89216 CVE record

CVSS 8.6 High

vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter
- vTables
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-93904 CVE record

CVSS 7.5 High

Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameter
- dejanmarkovic Social Web Suite – Social Media Auto Post, Social Media Auto Publish
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-93855 CVE record

CVSS 7.5 High

SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
- brewlabs SendPress Newsletters
- SQL injection
Not analysed yet 29 Oct 2026
CVE-2026-61569 CVE record

CVSS 7.5 High

AVideo-Encoder: pre-authentication streamer-login SQL injection
- WWBN AVideo-Encoder
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-54455 CVE record

CVSS 7.6 High

OpenCATS: Authenticated SQL injection in activity DataGrid date filters
- OpenCATS
- SQL injection
- CWE-20
Not analysed yet 28 Oct 2026
CVE-2026-115603 CVE record

CVSS 8.5 High

WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability
- Advanced Ads GmbH Advanced Ads – Tracking
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-111850 CVE record

CVSS 8.5 High

WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability
- BuddyPress
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-111411 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability
- Aman FunnelKit Automations
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-115607 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability
- Crowd Favorite DXP ToolKit
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-103792 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

SQL injection in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-86386 CVE record

CVSS 4.3 Medium

SQL injection in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-14571 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SQL injection (SQLi) in the user authentication module of Futurum Software
- Futurum Software User Authentication Module
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-86401 CVE record

CVSS 2.7 Low

SQL injection in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-90719 CVE record

CVSS 2.7 Low

SQL injection in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-90723 CVE record

CVSS 2.7 Low

SQL injection in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-90724 CVE record

CVSS 2.7 Low

SQL injection in Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-76005 CVE record

CVSS 6.5 Medium

WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute
- chuck1982 WP Inventory Manager
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-116750 CVE record

CVSS 6.5 Medium

VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attribute
- e4jvikwp VikRentCar Car Rental Management System
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-116609 CVE record

CVSS 6.5 Medium

WP Visitor Statistics (Real Time Traffic) <= 8.8 - Authenticated (Contributor+) SQL Injection via 'from' Shortcode Attribute
- osamaesh WP Visitor Statistics (Real Time Traffic)
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-115281 CVE record

CVSS 6.8 Medium

Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
- Recipe Card Blocks Lite
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-115224 CVE record

CVSS 4.1 Medium

Smart Popup by Supsystic < 2.0.2 - Admin+ SQLi via Popup Page/Category Binding
- Customer Engagement System
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-111027 CVE record

CVSS 6.8 Medium

Welcart e-Commerce < 2.12.6 - Editor+ SQLi via 'log_id' Parameter
- Welcart e-Commerce
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-104694 CVE record

CVSS 6.8 Medium

Thrive Automator < 11.2 - Editor+ Blind SQLi via 'additional' Parameter
- Thrive Automator
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-118378 CVE record

CVSS 8.5 High

Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name
- tabularis
- SQL injection
Not analysed yet 28 Oct 2026
CVE-2026-57190 CVE record

CVSS 7.0 High

Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
- asterisk
- certified-asterisk
- SQL injection
Not analysed yet 27 Oct 2026
CVE-2026-87085 CVE record

CVSS 6.5 Medium

Tanium addressed a SQL injection vulnerability in Provision.
- Tanium Provision
- SQL injection
Not analysed yet 27 Oct 2026
CVE-2026-108308 CVE record

CVSS 6.5 Medium

Tanium addressed a SQL injection vulnerability in Patch.
- Tanium Patch
- SQL injection
Not analysed yet 27 Oct 2026