Monthly
SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the `mobile` parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.
Blind SQL injection in Emlog CMS Pro's `User_Model::getUserDataByLogin()` function allows a remote attacker who controls the application's AUTH_KEY to enumerate database contents via the authentication cookie validation path. The `$account` value read from the HMAC-signed cookie is interpolated directly into SQL with no sanitization; the HMAC guard, which requires AUTH_KEY to forge, is the sole access barrier before the vulnerable query executes. All Emlog Pro releases before 2.6.16 are affected; the vendor released a confirmed patch at the pro-2.6.16 tag. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in ILIAS e-learning platform versions before 9.22, 10.10, and 11.3 allows authenticated users holding write permission on any repository container to achieve full database compromise and administrator account takeover. The repository trash table's sort parameter is passed unsanitized into an ORDER BY clause, and because the ILIAS database layer has multi-statement execution enabled, stacked queries permit arbitrary DML and DDL - not merely data enumeration. Patch versions are available from the vendor; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
SQL injection in llmware 0.4.6's collection-database abstraction layer allows an authenticated API caller to disclose rows from collections they are scoped out of, with full UNION-based data extraction possible on PostgreSQL backends. The flaw resides in resources.py, where attacker-controlled filter values are string-interpolated directly into SQL WHERE clauses without parameterization; the filter validator checks only key names against an allow-list but never sanitizes values. Affected public API entry points are Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
SQL injection in the Apache Griffin Hive Metastore Module exposes all versions of the retired data quality platform to database compromise through unsanitized query construction. The Apache Software Foundation has confirmed the project is permanently retired and no patch will be issued, leaving any remaining deployments permanently vulnerable. Organizations still running Apache Griffin should treat this as an end-of-life risk requiring migration rather than a patchable vulnerability.
Blind SQL injection in GOLDENHORN ONEIT, an enterprise trade management platform by TAC Information Services Internal and External Trade Inc., allows low-privileged authenticated attackers to enumerate and extract the full database contents. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring only a valid low-privilege account, with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; the flaw was disclosed by TR-CERT (TR-26-0990).
SQL injection in DreamMaker by Interinfo allows low-privileged authenticated remote attackers to inject arbitrary SQL commands, granting full read, modify, and delete access to the underlying database. Disclosed via TWCERT with a CVSS 4.0 score of 8.7, the flaw affects all known versions per the wildcard CPE. No public exploit code or CISA KEV listing has been identified at time of analysis.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. A publicly available proof-of-concept exists via WPScan, though exploitation is gated behind WordPress administrator credentials.
SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the `mobile` parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.
Blind SQL injection in Emlog CMS Pro's `User_Model::getUserDataByLogin()` function allows a remote attacker who controls the application's AUTH_KEY to enumerate database contents via the authentication cookie validation path. The `$account` value read from the HMAC-signed cookie is interpolated directly into SQL with no sanitization; the HMAC guard, which requires AUTH_KEY to forge, is the sole access barrier before the vulnerable query executes. All Emlog Pro releases before 2.6.16 are affected; the vendor released a confirmed patch at the pro-2.6.16 tag. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in ILIAS e-learning platform versions before 9.22, 10.10, and 11.3 allows authenticated users holding write permission on any repository container to achieve full database compromise and administrator account takeover. The repository trash table's sort parameter is passed unsanitized into an ORDER BY clause, and because the ILIAS database layer has multi-statement execution enabled, stacked queries permit arbitrary DML and DDL - not merely data enumeration. Patch versions are available from the vendor; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
SQL injection in llmware 0.4.6's collection-database abstraction layer allows an authenticated API caller to disclose rows from collections they are scoped out of, with full UNION-based data extraction possible on PostgreSQL backends. The flaw resides in resources.py, where attacker-controlled filter values are string-interpolated directly into SQL WHERE clauses without parameterization; the filter validator checks only key names against an allow-list but never sanitizes values. Affected public API entry points are Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
SQL injection in the Apache Griffin Hive Metastore Module exposes all versions of the retired data quality platform to database compromise through unsanitized query construction. The Apache Software Foundation has confirmed the project is permanently retired and no patch will be issued, leaving any remaining deployments permanently vulnerable. Organizations still running Apache Griffin should treat this as an end-of-life risk requiring migration rather than a patchable vulnerability.
Blind SQL injection in GOLDENHORN ONEIT, an enterprise trade management platform by TAC Information Services Internal and External Trade Inc., allows low-privileged authenticated attackers to enumerate and extract the full database contents. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring only a valid low-privilege account, with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; the flaw was disclosed by TR-CERT (TR-26-0990).
SQL injection in DreamMaker by Interinfo allows low-privileged authenticated remote attackers to inject arbitrary SQL commands, granting full read, modify, and delete access to the underlying database. Disclosed via TWCERT with a CVSS 4.0 score of 8.7, the flaw affects all known versions per the wildcard CPE. No public exploit code or CISA KEV listing has been identified at time of analysis.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
SQL injection in WPLP Cookie Consent WordPress plugin (versions 3.0.0 through before 4.4.2) allows authenticated administrators to execute arbitrary SQL queries via an unvalidated pagination parameter passed directly into a database query without sanitization. The vendor CVSS includes a scope-change flag (S:C), indicating the injection may permit cross-schema database reads beyond the plugin's own tables. A publicly available proof-of-concept exists via WPScan, though exploitation is gated behind WordPress administrator credentials.