Monthly
SQL injection in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software (versions V.4 through V.16) exposes industrial operations data to full database compromise by low-privileged authenticated remote attackers. Exploitation over the network requires only a valid user account, with no interaction from other users, enabling full confidentiality, integrity, and availability impact against the backend database. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and high impact make this a significant risk for affected deployments.
SQL injection in Xinhu Rainrock RockOA (versions up to 2.3.2) allows low-privileged remote attackers to manipulate database queries via the `Value` argument in the `toaddval` function at `/index.php?m=index&a=publicsavevalue&ajaxbool=true`. A public proof-of-concept exploit exists, and the vendor did not respond to responsible disclosure, leaving no official patch available. CVSS 4.0 rates impact as uniformly Low across confidentiality, integrity, and availability, suggesting bounded data exposure rather than full database compromise. No public exploit identified at time of analysis meets the CISA KEV threshold.
SQL injection in Chanjet CRM's jxf_dump_table.php endpoint allows remote unauthenticated attackers to manipulate the gblOrgID parameter and execute arbitrary SQL against the backend database. All Chanjet CRM releases through build 20260707 are affected, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no special conditions or credentials are required. A public proof-of-concept is available on GitHub, elevating practical risk above the moderate 6.9 base score; no patch exists because the vendor did not respond to coordinated disclosure.
SQL injection in Xinhu Rainrock RockOA up to version 2.7.6 allows authenticated remote attackers to manipulate backend database queries via the `highorder` argument in the `getOrder` function of `webmain/webmainAction.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring low-privilege authentication, with limited but real confidentiality, integrity, and availability impact. A public proof-of-concept exploit has been published on GitHub (E:P); the vendor did not respond to coordinated disclosure, leaving no official patch available.
SQL injection in TRtek's Products's Store web application (all versions before build 030631b2) lets remote attackers inject arbitrary SQL through unsanitized input, exposing and altering the backend database. The flaw is unauthenticated and network-reachable with a maximal CVSS of 9.8, though no public exploit or active exploitation has been identified and the product appears to be a niche Turkish commercial application with limited deployment. Coordinated disclosure was handled by Turkey's national CSIRT (TR-CERT / USOM).
SQL injection in Teracity Software Technologies' E-OSB application allows remote unauthenticated attackers to inject arbitrary SQL commands against the backend database, per TR-CERT advisory TR-26-0962. All versions before V02.26.07.08.01 are affected, and with a CVSS 9.8 (AV:N/PR:N) the flaw can be exploited over the network without authentication to fully read, modify, or destroy database contents. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL injection in zhongyu09 OpenChatBI allows authenticated remote attackers to manipulate queries processed by the incomplete `_validate_sql_safety` function within the text2sql pipeline. Versions 0.2.0 through 0.2.2 ship with zero SQL validation; version 0.3.0 introduced a bypassable validator, and v1.0.0b1/main retains the same incomplete logic with an optional - but non-default - stricter mode. The vendor did not respond to coordinated disclosure, leaving no official patch guidance; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios.
SQL injection in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software (versions V.4 through V.16) exposes industrial operations data to full database compromise by low-privileged authenticated remote attackers. Exploitation over the network requires only a valid user account, with no interaction from other users, enabling full confidentiality, integrity, and availability impact against the backend database. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and high impact make this a significant risk for affected deployments.
SQL injection in Xinhu Rainrock RockOA (versions up to 2.3.2) allows low-privileged remote attackers to manipulate database queries via the `Value` argument in the `toaddval` function at `/index.php?m=index&a=publicsavevalue&ajaxbool=true`. A public proof-of-concept exploit exists, and the vendor did not respond to responsible disclosure, leaving no official patch available. CVSS 4.0 rates impact as uniformly Low across confidentiality, integrity, and availability, suggesting bounded data exposure rather than full database compromise. No public exploit identified at time of analysis meets the CISA KEV threshold.
SQL injection in Chanjet CRM's jxf_dump_table.php endpoint allows remote unauthenticated attackers to manipulate the gblOrgID parameter and execute arbitrary SQL against the backend database. All Chanjet CRM releases through build 20260707 are affected, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no special conditions or credentials are required. A public proof-of-concept is available on GitHub, elevating practical risk above the moderate 6.9 base score; no patch exists because the vendor did not respond to coordinated disclosure.
SQL injection in Xinhu Rainrock RockOA up to version 2.7.6 allows authenticated remote attackers to manipulate backend database queries via the `highorder` argument in the `getOrder` function of `webmain/webmainAction.php`. The CVSS 4.0 vector confirms network-accessible exploitation requiring low-privilege authentication, with limited but real confidentiality, integrity, and availability impact. A public proof-of-concept exploit has been published on GitHub (E:P); the vendor did not respond to coordinated disclosure, leaving no official patch available.
SQL injection in TRtek's Products's Store web application (all versions before build 030631b2) lets remote attackers inject arbitrary SQL through unsanitized input, exposing and altering the backend database. The flaw is unauthenticated and network-reachable with a maximal CVSS of 9.8, though no public exploit or active exploitation has been identified and the product appears to be a niche Turkish commercial application with limited deployment. Coordinated disclosure was handled by Turkey's national CSIRT (TR-CERT / USOM).
SQL injection in Teracity Software Technologies' E-OSB application allows remote unauthenticated attackers to inject arbitrary SQL commands against the backend database, per TR-CERT advisory TR-26-0962. All versions before V02.26.07.08.01 are affected, and with a CVSS 9.8 (AV:N/PR:N) the flaw can be exploited over the network without authentication to fully read, modify, or destroy database contents. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL injection in zhongyu09 OpenChatBI allows authenticated remote attackers to manipulate queries processed by the incomplete `_validate_sql_safety` function within the text2sql pipeline. Versions 0.2.0 through 0.2.2 ship with zero SQL validation; version 0.3.0 introduced a bypassable validator, and v1.0.0b1/main retains the same incomplete logic with an optional - but non-default - stricter mode. The vendor did not respond to coordinated disclosure, leaving no official patch guidance; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
SQL injection in Photo Gallery by Ays - Responsive Image Gallery (all versions through 6.8.2) allows authenticated administrators to extract arbitrary data from the WordPress database by appending malicious SQL to the 's' search parameter. The vulnerability spans two distinct code paths in the plugin's category list table class - record_count() via $wpdb->get_var() and prepare_items()/get_image_categories() via $wpdb->get_results() - supporting both blind and UNION-based exfiltration techniques. No public exploit has been identified at time of analysis; the high privilege requirement significantly constrains realistic attack scenarios.