SQLi
Monthly
SQL injection in AipexBase through commit 690adb9 allows an authenticated low-privilege attacker to read other users' database rows and tables by injecting SQL through the order_by and group_by fields of the /api/data/invoke endpoint. The attacker can supply subqueries or MySQL error-based functions (EXTRACTVALUE/UPDATEXML) to bypass the SqlGuard denylist and row-level security, but impact is limited to confidentiality with no write or modification path described. No public exploit identified at time of analysis; CVSS 7.1 with PR:L indicates a moderate-severity issue requiring valid authentication and a MySQL-style backend.
Authenticated SQL injection in WebVella ERP through 1.8.8 allows any valid user account to read unauthorized entities, including user and role tables, by sending crafted single-quoted literals in WHERE clauses to the EQL query API at POST /api/v3/en_US/eql. The flaw is CWE-89 in EqlBuilder's unsanitized SQL string interpolation, and the CVSS vector confirms PR:L, so unauthenticated attackers cannot exploit it directly. No public exploit code was identified at time of analysis, and although CVSS 4.0 scores this 7.1, the independent assessment correctly frames it as a genuine but moderate-priority issue rather than an overstated high-CVSS finding.
Unauthenticated SQL injection in Thecosy IceCMS through 4.1.5 allows remote attackers to read arbitrary database contents by appending crafted SQL after the LIMIT clause that is concatenated into a MyBatis-Plus QueryWrapper for the num path parameter of /WebArticle/findarticlesbynum. Exploitation requires no authentication, no user interaction, and no special conditions beyond network reachability of the endpoint (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5); the supplied CVSS 4.0 vector scores 8.7 with the same confidentiality-only impact. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a public technical write-up describing the injection point is referenced, so exposure should be treated as a genuine high-priority data-disclosure risk for internet-facing instances that have not moved past 4.1.5.
Unauthenticated SQL injection in IceCMS (Thecosy IceCMS) through 4.1.5 lets any remote attacker who can reach the /WebResource/findresourcebynum endpoint read arbitrary data from the backend database by supplying a crafted 'num' path parameter. The parameter is concatenated after the SQL LIMIT clause via MyBatis-Plus QueryWrapper.last() with no parameterization, so union-based or blind injection can be used to exfiltrate table contents. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - no data modification, denial of service, or code execution - and no authentication, user interaction, or non-default configuration is required. The issue is not listed in CISA KEV and no confirmed active exploitation has been reported, but a detailed public write-up of the injection point exists, making the flaw straightforward to reproduce against network-reachable instances.
Authenticated SQL injection in ZR.Admin.NET through 3.8.2 allows any account holding the system:user:list permission to inject subquery or CASE expressions into the ORDER BY clause of the shared ToPage paging helper by supplying a crafted PagerInfo.Sort query parameter to GET /system/user/list, enabling blind extraction of database contents such as stored credentials. The flaw is read-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor-published CVSS 4.0 base of 7.1) and requires a valid low-privileged session with that specific list permission, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis, though a public technical writeup describing the ORDER BY injection path exists; a vendor patch is available.
SQL injection in Helical Insight through 7.0.0 allows authenticated users with at least viewer privileges to execute arbitrary SQL queries via crafted Numeric or String placeholder values sent to the /executeDatasource endpoint, bypassing the broken SqlDetect guard. This enables reading unexposed database tables and modifying data within the report's configured data source, with impact limited by the privileges of the database account used by the application. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
SQL injection in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) affects all versions through 8.16.1 and lets an authenticated low-privileged user, such as a subscriber, contributor or customer account, inject arbitrary SQL through the plugin's vulnerable request handling, exposing database contents. The issue is remotely reachable with low attack complexity and needs no victim interaction, but it does require a valid account on a site that both runs the affected plugin and permits untrusted low-privilege registration; sites that do not hand out such accounts face materially lower real-world exposure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is driven by the population of sites exposing low-privileged authenticated access to the plugin.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific backend cache API endpoint to bypass the missing authentication check and reach SQL-executing logic, with the injected statement executed by the Kylin service (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Per Apache's advisory, practical exposure is concentrated on Kylin instances directly reachable from the public internet - the vendor characterizes this as uncommon - while in-house deployments confined to trusted internal networks are mostly not impacted, so the operative precondition is network reachability of the service rather than any configuration toggle. No CVSS vector from the vendor, EPSS score, KEV listing, or public exploit code was provided in the available intelligence, so no public exploit has been identified at time of analysis and quantitative exploitation signals are absent; severity rests on the vulnerability class and the vendor's own scoping. A fixed release exists in Apache Kylin 5.0.5.
Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.
Blind SQL injection in the halfdata Green Popups WordPress plugin before 7.6.3 lets a remote attacker inject crafted SQL through an HTTP request and extract data from the site's database one inferred bit at a time. The vendor (Patchstack) rates this 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating network reachability, low complexity, a scope change, and high confidentiality impact, while our independent assessment scores it 9.3 as well but with PR:L instead of PR:N - meaning the true privilege prerequisite is not confirmed from the available data and pre-authentication exploitability cannot be assumed. There is no CISA KEV entry and no public exploit code identified at time of analysis, so this should be treated as a serious but not confirmed actively exploited issue; because it is blind, extraction is inference-based and slower than direct-output injection but still permits theft of user, configuration, and credential-adjacent data.
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.
SQL injection in the Wheels CFML framework through 4.1.2 lets remote attackers manipulate SQL statements when an application feeds request data into inline-literal query paths - opt-in parameterize=false queries, IN lists, and developer-written where strings at positions the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. The flaw is reachable unauthenticated over the network (CVSS 3.1 9.8, PR:N) but only materialises on MySQL or MariaDB backends running with the default backslash-escaping behaviour (NO_BACKSLASH_ESCAPES absent), and only where the developer has constructed the vulnerable query form; bound/parameterized queries and whereBetween() as of 4.1.2 are not affected. No public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in Wheels 4.2.0.
SQL injection in Frappe HRMS 14.x (before 14.38.2), 15.x (before 15.64.0), and 16.x (before 16.18.0) allows any authenticated user, including a low-privilege account, to extract sensitive information from the database via crafted requests to endpoints that lack input validation. The flaw requires only a valid session (CVSS PR:L) and no user interaction, resulting in high confidentiality impact with scope change. Patched versions 14.38.2, 15.64.0, and 16.18.0 are available, and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions up to 0.9.7) enables remote attackers to extract sensitive information from the site's database by injecting crafted SQL commands into an unspecified request handler. The vulnerability is rated critical with a CVSS score of 9.3, and the supplied vector indicates network exploitability, low complexity, and no authentication or user interaction required (PR:N/UI:N); however, the independent assessment notes that the true authentication requirements are unconfirmed and may involve a low-privilege account, and the exact trigger parameter is not publicly documented. No public exploit code or confirmed active exploitation is identified at time of analysis.
SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the TMS Amelia (ameliabooking) plugin for WordPress, affecting all versions through 2.4.10, allows remote attackers to inject arbitrary SQL into database queries executed by the plugin. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are that the plugin be installed and active at a version at or below 2.4.10 on a network-reachable WordPress instance, making exposure broad across unpatched booking sites. The impact is confidentiality-focused: the classification indicates high confidentiality impact with no integrity or availability impact, so the practical risk is large-scale extraction of data from the site's WordPress database rather than data destruction or code execution. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); no EPSS score was available in the source data, but given the unauthenticated, pre-auth access path and the database-level target, this should be treated as high priority on paper.
SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.
SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.
SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated time-based blind SQL injection in the WordPress Link Library plugin (all versions up to and including 7.9.2) lets remote attackers append arbitrary SQL to the plugin's existing query via the 'link_url' parameter and use timing side-channels to extract sensitive information from the site's database. The injection is reached through the plugin's front-end link user-submission functionality - the code path the vendor patch modifies in usersubmission.php - so a site only becomes directly attackable if that submission form is enabled and publicly reachable, and no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) with impact limited to confidentiality (C:H/I:N/A:N, base 7.5). Because the technique is blind and time-based, extraction is slow and requires many timed requests, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a top-tier emergency.
SQL injection in Znuny's ticket-search backend (versions through 7.3.6) allows an authenticated remote attacker with a valid agent or customer account to inject arbitrary SQL through the ContentSearch parameter, enabling theft or modification of ticketing data. The flaw requires the attacker to reach the search interface and supply a value for a parameter that the code expects to contain only the literal 'AND' or 'OR', yet concatenates verbatim into the generated query (CWE-89). No public exploit code was identified at the time of analysis and no CISA KEV listing applies; the assessed impact is high confidentiality and integrity loss with no confirmed availability impact.
SQL injection in the Wheels CFML framework versions 1.1.8 through 4.1.1 can let unauthenticated remote attackers alter SQL queries when applications pass caller-supplied string values into dynamic finders such as findOneByEmail, query-builder where(property, value) and where(property, operator, value), string/UUID-key lookup paths like findByKey, updateByKey, deleteByKey, findOrCreateBy..., or validatesUniquenessOf. The parser mishandles a doubled single quote by treating it as the end of a string literal, potentially exposing authentication, password-reset, and token lookups; the whereBetween() variant in 4.0.0 through 4.1.1 is additionally gated on MySQL/MariaDB running with backslash escaping enabled, and numeric-column values are not affected. The issue is fixed in 4.1.2, and no public exploit was identified at time of analysis.
SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows remote attackers to execute arbitrary SQL against the underlying database by sending crafted POST data to the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint. Because the endpoint uses extract($_REQUEST) and interpolates user-supplied values directly into a raw INSERT statement, an attacker can read, modify, or delete billing, member, employee, permission, and credential data, or drop database tables, without authentication or user interaction. The vendor fixed the flaw in 3.8.6 with prepared statements and input validation; no public exploit code was identified at time of analysis.
Unauthenticated SQL injection in WeGIA prior to 3.8.6 lets any remote attacker who can reach the application read, alter, or destroy its MySQL database through the billing endpoint web/html/socio/sistema/cadastro_cobranca.php. Because that endpoint is reachable without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and passes the valor, valor_pago, id_pessoa, id_socio and id_sociotipo parameters straight into UPDATE, INSERT and SELECT statements, an attacker can exfiltrate billing records and credential data or truncate tables to cause application-wide data loss. No public exploit code was identified at time of analysis and there is no CISA KEV entry indicating active exploitation, but the low attack complexity and lack of authentication make prompt upgrading to 3.8.6 the priority action.
Authenticated SQL injection in WeGIA versions prior to 3.8.6 allows a user with access to the Material & Patrimônio module to inject arbitrary SQL through the id_produto parameter of web/html/matPat/restaurar_produto_desocultar.php, enabling extraction of sensitive database records and modification of institutional and inventory data. The flaw is rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privileged account plus module-level authorization, so anonymous visitors cannot trigger it. No public exploit identified at time of analysis; the vulnerable code path ships by default in affected releases and a vendor fix (3.8.6) is available.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows any remote attacker to read and modify the underlying database by sending a single POST request to web/html/socio/sistema/cadastro_cobranca.php. The codigo parameter is folded into the WHERE codigo= clause of an UPDATE statement without parameter binding, and supplying a quoted string defeats MariaDB's implicit numeric conversion on the VARCHAR column, permitting arbitrary SQL execution without a session. Exposed records include user credential hashes and billing entries in the cobrancas table; the issue is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in InvoiceShelf before 2.4.0 allows any logged-in user to inject arbitrary SQL expressions into the ORDER BY clause of invoice and other list endpoints, enabling boolean-based blind extraction of database contents. The flaw stems from the orderByField query parameter being passed unfiltered into Laravel Eloquent orderBy() calls across multiple model scopes, including Invoice::scopeApplyFilters; an attacker with a valid low-privilege account - potentially an untrusted outsider on deployments that permit self-registration or multi-tenancy - can therefore read data beyond their authorization. Exploitation is confirmed to require authentication, is limited to confidentiality impact (no writes or denial of service), and proceeds slowly through blind inference. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the vendor has released a fix in version 2.4.0.
Stored SQL injection in DataEase versions prior to 2.10.26 allows authenticated users to inject arbitrary SQL into backend queries by storing crafted binning values (FieldGroupDTO.min, .max, .startTime, .endTime) in dataset group-field definitions. The payload is only triggered when a chart that references the tainted field is rendered, giving an attacker with a valid DataEase account high-impact read/write/delete access to the configured backend database (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Exploitation requires a low-privileged authenticated account with dataset-editing rights; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in DataEase's CalciteProvider allows authenticated users with access to a configured datasource to alter the metadata queries the platform builds for getSchema, validate, save, and update flows, executing attacker-controlled SQL against the connected backend database using the application's stored datasource credentials. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.7), reflecting high confidentiality, integrity, and availability impact on the backend database with no victim interaction required, though exploitation is constrained by the need for a valid DataEase account that has been granted datasource access and by the privileges of the application-held datasource account. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released v2.10.27, which introduces identifier quoting, literal escaping, and parameter binding in CalciteProvider.
Unauthenticated SQL injection in the e107 CMS alt_auth plugin allows a remote attacker to execute arbitrary SQL through a crafted login username whenever the plugin's otherdb or e107db authentication backend is configured against a live external database, affecting all e107 releases prior to 2.3.7. No authentication or user interaction is required once that configuration exists; the assessed impact is high on confidentiality and integrity, bounded by the privileges of the configured external database account, and failed queries can leak the generated SQL through the debug-message path to assist blind injection. No public exploit identified at time of analysis, and default e107 installations - which do not ship alt_auth enabled and do not point a backend at an external DB - are not exposed.
SQL injection in Redash (versions after 8.0.0 through 26.9.0) lets an authenticated user with view-only access to both the Query Results data source and a referenced data source inject arbitrary SQL that runs with the referenced data source's privileges. The flaw lives in redash/query_runner/query_results.py, where param_query_N_{key=value} parameters were substituted into the target query's SQL via replace_query_parameters() rather than through the ParameterizedQuery schema validator, and where the is_safe permission check was skipped; the vendor CVSS 4.0 base score is 8.7, and no public exploit code or CISA KEV entry was identified at time of analysis. Because exploitation requires valid credentials plus dual data-source access, this is realistically an insider or compromised-account risk, with the greatest exposure in deployments that grant low-privilege users view-only access to sensitive referenced data sources.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Authenticated SQL injection in Tenable Nessus lets any user with a valid low-privilege Nessus account read or modify data stored by the scanner through the web interface or API, affecting every instance running a version below 10.12.5. The flaw is rated CVSS v4.0 8.7 and maps to CWE-89; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Tenable has shipped a vendor patch in Nessus 10.12.5, and the issue is best treated as a credible, elevated-priority finding rather than an emergency, because exploitation requires pre-existing credentials plus network reachability to the Nessus interface.
SQL injection in the Custom Reports module of Progress MOVEit Transfer lets a high-privileged authenticated user inject arbitrary SQL into report queries, compromising confidentiality, integrity, and availability of the managed file transfer database; affected releases are those before 2025.1.6 and 2026.0.0 through 2026.0.3. The attack vector is network-reachable with no user interaction required, but the CVSS vector (PR:H) shows the attacker must already hold an administrative or otherwise highly privileged session with access to the Custom Reports feature, which is the principal barrier to exploitation. There is no public exploit identified at time of analysis and this CVE is not confirmed actively exploited (no CISA KEV listing); the practical risk condition is an internet-facing MOVEit Transfer instance combined with a compromised privileged credential.
Authenticated SQL injection in the Yiuman Citrus Java framework (versions through 0.15.0) allows any user with a valid low-privilege account to inject arbitrary SQL into the ORDER BY clause by tampering with the sortBy request parameter. The flaw lives in the citrus-support generic query helper and is reachable through any generic list route on controllers extending BaseQueryController or BaseQueryRestful, which means every application built on the framework that exposes such a route inherits the exposure. Impact is read-only database disclosure achieved through boolean- or time-based blind inference rather than direct record retrieval, and exploitation requires both valid credentials and a deployed, reachable generic query endpoint; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this should be treated as a moderate-severity, externally exploitable information-disclosure risk rather than an active campaign.
Authenticated SQL injection in Dromara Skyeye (all builds through commit 65d3ddcede70) lets any low-privileged user read arbitrary data from the backend database, including records belonging to other tenants, by sending crafted 'keyword' values to the queryWarehousingDetails and queryOutgoingDetails ERP statistics endpoints. The flaw is reachable over the network with only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor score 7.1 under CVSS 4.0), needs no user interaction, and impacts confidentiality only - there is no evidence of data modification or code execution. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; a detailed public technical writeup exists, and the issue is a genuine but moderate-priority finding whose main limiting factor is the authentication requirement.
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.
Blind SQL injection in the Webnus Modern Events Calendar Lite plugin for WordPress (versions before 7.37.0) lets an authenticated low-privilege user inject SQL through a plugin endpoint that fails to neutralize special elements, allowing them to read arbitrary data from the site's database. The provided vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) requires a valid low-privileged account, so sites that restrict registration or grant only minimal roles present a materially higher barrier; our independent assessment keeps the high confidentiality impact but scores scope as unchanged (S:U) and shifts the integrity/availability impact to a low integrity impact, which lowers the practical blast radius claimed by the vendor vector. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
SQL injection in the Koha integrated library system's Most-circulated items report (reports/cat_issues_top.pl) allows an authenticated staff account holding the reports module permission - explicitly not requiring superlibrarian - to inject arbitrary SQL through the Criteria, Filter, and Limit request parameters and read any table reachable by the Koha database user, including borrower userids, bcrypt password hashes, two-factor secrets, api_keys, and sessions. The flaw is rated CVSS 7.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) and our independent assessment concurs it is a genuine, well-characterized CWE-89 injection that merits prompt patching but is not a drop-everything emergency, principally because the PR:L staff-authentication-plus-reports-permission gate blocks any unauthenticated path. No public exploit code has been identified at time of analysis: this CVE is not in CISA KEV and there is no confirmed active exploitation. Patched releases are available in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03.
Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in JTL-WMS lets any user holding a low-privileged session inject arbitrary T-SQL into the application's database queries, granting full read and write control over the backend Microsoft SQL Server data and opening a pivot path toward connected systems. The flaw (CWE-89) carries a CVSS score of 9.4 and is network-reachable with no user interaction, but exploitation requires valid credentials (CVSS PR:L) - fully anonymous attacks are not supported by the assessed vector, and exposure is further bounded by whether the instance is network-reachable to the attacker and whether the vulnerable code path is deployed. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a joint advisory covering this CVE together with CVE-2026-89309.
Unauthenticated SQL injection in the Fast Courier WordPress plugin (versions 5.0.0 through 5.2.3) lets any remote attacker who can reach the plugin's unauthenticated REST route inject arbitrary SQL and read data from the underlying WordPress database. No credentials or user interaction are required (CVSS vector PR:N/UI:N), and the impact is confidentiality-only - data can be read but not modified, and availability is unaffected (I:N/A:N). Publicly available exploit code exists and the finding is documented in a WPScan advisory, though EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, so this is a genuine but non-emergency, scope-limited issue that chiefly matters to sites running this niche plugin below 5.2.4. Vendor patch: 5.2.4.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.
Unauthenticated attackers can inject SQL into the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) through the 'product.push' identity-linking endpoint, allowing blind, time-based extraction of data from the site's WordPress database. The flaw requires no credentials, no user interaction and no non-default configuration - only that the plugin is installed and its connector endpoint is reachable, which is its normal operating mode for JTL ERP synchronisation - and it fires during identity linking before ProductController::push() runs, so downstream validation never gets a chance to reject the request. Impact is limited to data disclosure (CVSS 7.5, C:H/I:N/A:N) and exploitation is slower than direct extraction because it relies on time-based inference, but it is fully automatable; no public exploit code was identified at time of analysis and there is no CISA KEV telemetry for this CVE. Overall this is a credible, high-priority issue for the narrow population of sites actually running the JTL-WooCommerce bridge.
Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.
Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.
Authenticated SQL injection in the calendar module of Omnispace Agora Project before 26.10.0 lets a low-privileged user read arbitrary data from the backend database by tampering with the sortEvents parameter, which is concatenated unsanitized into an ORDER BY clause in app/ModCalendar/CtrlCalendar.php. Exploitation requires a valid session with access to the calendar feature (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so anonymous internet-wide attacks are not possible; the impact is confidentiality-only, with error-based payloads such as extractvalue() used to leak database version information. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in release 26.10.0.
Authenticated space administrators in Omnispace Agora Project releases before 26.10.0 can escalate to full general-administrator privileges by abusing the user-import flow, where caller-controlled agoraFields[] names are used directly as SQL column identifiers without validation. An attacker who already holds space-administrator rights can inject privileged column names such as generalAdmin, or use backtick-injection to escape the identifier context, and thereby set administrative flags on records processed by the import. The issue is tracked as CWE-89 and rated 8.7 under CVSS 4.0 (CVSS:3.1 equivalent AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H in our independent assessment); no public exploit code has been identified at time of analysis, and the flaw is fixed in Agora Project 26.10.0, making this a credible but not emergency-tier priority.
Second-order SQL injection in Omnispace Agora Project before 26.10.0 lets an authenticated user store a malicious _idCategoryFilter value in their own server-side session, which is later concatenated without parameterization into SQL in app/Common/MdlCategory.php, granting high-impact read and write access to the underlying database. Exploitation requires a valid authenticated session (CVSS 4.0 base 8.6; assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so unauthenticated outsiders cannot reach the sink and risk concentrates in deployments that issue accounts to numerous or low-trust users; no public exploit identified at time of analysis. The vendor has released 26.10.0, which removes the vulnerable condition.
Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.
SQL injection in Adobe Experience Manager 6.5 (through 6.5.25) allows an authenticated, low-privileged attacker to bypass security controls and gain unauthorized read and limited write access to backend data. The flaw is due to improper neutralization of special elements used in SQL commands (CWE-89), and exploitation requires no user interaction. No public exploit code or active exploitation has been identified, and the need for valid low-privilege credentials and the limited version range make this a moderate-priority issue rather than an emergency.
SQL injection in Microsoft Configuration Manager (MECM) lets an authenticated attacker with low-privilege network access execute arbitrary SQL against the site database and thereby elevate privileges, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector (AV:N/AC:L/PR:L/UI:N) means exploitation requires a pre-existing valid account on the network - fully unauthenticated attackers cannot reach the flaw - but no user interaction or special complexity is needed once such credentials or an authenticated session exist. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no active exploitation, while vendor patches for all affected builds are available.
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted input that is incorporated into a SQL command, giving the attacker arbitrary control over the back-end database and effectively elevating their privileges on the farm. Only SharePoint Server Subscription Edition builds below 16.0.20326.20190 are affected, the attack requires a valid account on the target instance (CVSS PR:L) and no user interaction, so anonymous internet exploitation is not possible; environments already at or above the patched build are not exposed. Microsoft has shipped a fix and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation as none and Automatable as no, making this a credible but not emergency-tier priority that should be fixed on a normal patch cycle - the high CVSS score of 8.8 reflects total loss of confidentiality, integrity and availability once the injection is successfully driven.
SQL injection in Microsoft Configuration Manager allows an authenticated low-privilege user who already holds a foothold on an adjacent network segment to inject arbitrary SQL against the site's data tier and elevate privileges, with the changed-scope vector (S:C) indicating impact can cross from the Configuration Manager component into the SQL Server and host it relies on. Exploitation is constrained rather than trivial: the assessed vector requires prior authorization (PR:L), adjacency instead of internet reachability (AV:A), and a high-complexity path (AC:H) with non-trivial timing, state, or configuration preconditions, and CISA's SSVC assessment records Exploitation 'none' and Automatable 'no'. Microsoft has released a fix and no public exploit code was identified at time of analysis, so the 'total' technical impact describes the damage available if the prerequisites are met, not an easily reached or actively exploited condition.
SQL injection in Fortinet FortiAnalyzer and FortiManager (including Cloud variants) allows an authenticated attacker to execute arbitrary commands on the underlying system via crafted requests. Affected versions include FortiAnalyzer 7.6.0-7.6.4, 7.4.0-7.4.7, and all 7.2 releases, plus FortiManager 7.6.0-7.6.4, 7.4.0-7.4.6, and all 7.2 releases, as well as FortiAnalyzer Cloud 7.6.2-7.6.4, 7.4.1-7.4.7, 7.2.1-7.2.11 and FortiManager Cloud 7.6.2-7.6.4. The vulnerability requires valid credentials; the provided CVSS vector indicates high privileges (PR:H) while the description and independent assessment suggest low privileges (PR:L) may suffice. No public exploit code or active exploitation is identified at time of analysis, and the risk is considered elevated but not an emergency based on current signals.
Authenticated SQL injection in the Fortinet FortiAnalyzer and FortiManager management platforms allows a logged-in low-privileged user to execute arbitrary commands on the appliance via crafted requests. Affected firmware covers FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7 and all 7.2 releases, plus FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6 and all 7.2 releases. Exploitation requires a valid account on the management interface - the vendor CVSS vector marks PR:H while the description and independent assessment indicate a low-privileged user suffices - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so the main risk mitigation is limiting who can reach and authenticate to the management plane.
Authenticated SQL injection in Frappe Framework before 16.23.0 lets a user with report access alter the raw SQL statement executed by the reportview get_count() method, potentially reading or modifying data the account should not reach. The flaw is reachable through the report/list view API by supplying crafted report input (fields/filters) that was interpolated into a 'select count(*) from ( ... )' query via frappe.db.sql(); the fix rewrites the count using the query builder's Count function with parameterized execution. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but exploitation requires only a valid account with report access (CVSS PR:L, AV:N), and default deployments older than 16.23.0 are exposed.
SQL injection in Payload CMS allows an authenticated attacker holding read plus create-or-update access on a collection to inject arbitrary SQL through the "in" and "not_in" query parameters when the application uses the SQLite, D1-SQLite, Postgres, or Vercel-Postgres database adapters. The flaw is only reachable when a readable collection exposes a "json" field or a "blocks" field configured with blocksAsJSON: true, and can lead to high confidentiality and integrity impact on the backing database. Affected users should upgrade to Payload 3.90.0 (SQLite/D1 adapters and core) or 3.73.0 (Postgres/Vercel-Postgres adapters), or 4.0.0-canary.34; no public exploit identified at time of analysis.
SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows an authenticated user who can create or edit device group or facility names to execute arbitrary SQL commands against the underlying database, with the injected payload only firing when those stored names are subsequently processed by the Bulk Export workflow. Attackers must hold valid credentials with name-editing privileges, and the assessed vectors (CVSS 4.0 base 7.7 with AC:H/PR:L; independent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicate additional non-default preconditions must be satisfied before the payload executes. No public exploit code has been identified at time of analysis, and this is a credentialed, moderate-priority vulnerability rather than a mass-exploitation emergency, with realistic exposure largely limited to insiders or attackers who have already compromised an operator account on an unpatched installation.
SQL injection in RUGGEDCOM CROSSBOW versions below V6.0 lets an attacker who already holds administrative credentials inject arbitrary SQL commands through the Name and Value fields of custom file labels, compromising the underlying database. The vendor-assessed vector (CVSS 4.0 8.4, PR:H, AV:L) and our independent assessment converge on a high-severity but access-gated issue: exploitation requires an authenticated administrative session and local access, with no user interaction, and no public exploit code identified at time of analysis. Siemens has released a fix in V6.0, so the practical priority is moderate and centered on insider or compromised-admin scenarios rather than external mass exploitation.
SQL injection in the firmware-upload filename handling of Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) lets an authenticated attacker who holds firmware-upload privileges run arbitrary SQL commands against the product's underlying database, giving high confidentiality, integrity, and availability impact to the CROSSBOW server itself (CVSS 4.0 base 8.7; assessed CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not pre-authentication: valid credentials with the specific firmware-upload right are mandatory, and the injected payload must be placed in the uploaded file's name rather than its contents, while no second-party user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), and because CROSSBOW is a specialized OT access-management server normally deployed on segmented management networks, this is a credible but not top-tier priority.
SQL injection in the Value field of notification conditions handled by the Notification Profile configuration in RUGGEDCOM CROSSBOW (all versions before V6.0) allows an authenticated, suitably privileged user to execute arbitrary SQL commands against the product's underlying database. The flaw is network-reachable with no user interaction required, but it is gated by the privilege prerequisite - only accounts that can reach the Notification Profile configuration workflow can trigger it - so unauthenticated outsiders cannot exploit it directly; there is no public exploit identified at time of analysis. Siemens has published advisory SSA-508506 and V6.0 is the fixed release; given the high confidentiality, integrity, and availability impact on the CROSSBOW database and its OT-context role, this is a credible, actionable patch priority rather than an inflated alert.
Authenticated SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows a user with the specific privileges needed to use the Bulk Import/Export workflow to execute arbitrary SQL commands against the underlying database via unsanitized facility name fields. The vulnerability is network-reachable, low-complexity, and requires no user interaction, but it is access-gated: a valid privileged account is mandatory, so an attacker lacking that workflow privilege cannot reach the vulnerable code. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an advisory (SSA-508506) addressing the issue.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows an attacker who already holds a high-privilege, authenticated WordPress session to inject SQL through an unneutralized plugin input, reading database contents back through boolean- or time-based inference. Exploitation requires the plugin to be installed and active plus high-privilege access (PR:H in the CVSS vector), so anonymous visitors cannot reach it; the assessed impact is high confidentiality loss with limited integrity effect, making this a moderate-priority issue rather than an urgent one. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing).
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
SQL injection in SAP Commerce Cloud lets an authenticated user with only low-level privileges (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) inject arbitrary SQL through specially crafted requests into the affected out-of-the-box functionality, with the potential to read, modify or delete sensitive application database data and therefore high confidentiality, integrity and availability impact. The flaw is CWE-89 in code delivered as part of SAP Commerce Cloud itself, meaning it is not confined to a customer's custom extensions, but the advisory does not name the exact endpoint or parameter, so the precise injectable surface is not confirmed from available data. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only real precondition is obtaining a valid authenticated session, which is a low barrier for deployments that allow customer self-registration or maintain numerous back-office accounts. This is a genuine high-priority vulnerability, though not an emergency.
SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.
SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.
Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.
SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).
SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.
Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.
SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.
SQL injection in Frappe ERPNext 15.x before 15.121.0 and 16.x before 16.34.0 lets any authenticated user, including an account with no assigned roles, inject crafted parameters into several endpoints that lack input validation, read other users' sensitive information, and escalate to a privileged account. Because only the lowest privilege level is needed (CVSS 4.0 PR:L; independently assessed at 8.7 under a 3.1 vector of AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact), deployments that permit self-registration or hand out broad low-privilege accounts face a nearly trivial authentication barrier, while tightly controlled instances still require a valid login. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory is public, so unpatched, internet-reachable instances should be treated as high priority.
Unauthenticated SQL injection in phpMyFAQ versions prior to 4.1.9 lets remote attackers read credentials and configuration secrets, modify or delete records, or drop tables via the search parameter of the api/autocomplete endpoint. Exploitation is conditional: the backend MySQL or MariaDB instance must be running in NO_BACKSLASH_ESCAPES mode, because PdoMysql::escape() relies on backslash escaping of single quotes that that SQL mode treats literally; the payload additionally uses a Unicode right single quotation mark (U+2019) that the application normalizes to an ASCII quote after escaping has already been applied, bypassing the filter. This is a genuine high-priority issue (CVSS 4.0 base 9.2, AT:P/AC:H reflecting the non-default SQL-mode prerequisite) rather than a high-CVSS artifact, since an attacker who reaches such a deployment needs no authentication and no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor is whether the target database uses the default SQL mode.
SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).
An HQL injection in LogicalDOC Community Edition through 9.3 lets any authenticated user who holds read permission on a single folder escape that folder's scope and read document metadata and database contents they are not entitled to see. The flaw is reachable through the documents.xml data endpoint (DocumentsDataServlet), where the 'indexed' request parameter is concatenated unvalidated into a Hibernate query, so the primary barrier is only the requirement for a low-privileged, read-only account; impact is limited to confidentiality with no modification or denial of service. There is no vendor patch version confirmed in the available data beyond the upstream fix commit, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though an advisory and public discussion exist.
SQL injection in LogicalDOC Community Edition through 9.3 allows authenticated low-privileged users to execute crafted SQL via the firstLetter parameter of TagsDataServlet, enabling UNION SELECT statements to be returned in the XML tag list and disclosing usernames, email addresses, and password hashes from the ld_user table. This is a credible but bounded risk: the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirm that an authenticated session is required, with no integrity or availability impact; no public exploit identified at time of analysis. The upstream fix commit (8428bfb) parameterizes the vulnerable LIKE clause, but a tagged patched release is not independently confirmed.
SQL injection in AipexBase through commit 690adb9 allows an authenticated low-privilege attacker to read other users' database rows and tables by injecting SQL through the order_by and group_by fields of the /api/data/invoke endpoint. The attacker can supply subqueries or MySQL error-based functions (EXTRACTVALUE/UPDATEXML) to bypass the SqlGuard denylist and row-level security, but impact is limited to confidentiality with no write or modification path described. No public exploit identified at time of analysis; CVSS 7.1 with PR:L indicates a moderate-severity issue requiring valid authentication and a MySQL-style backend.
Authenticated SQL injection in WebVella ERP through 1.8.8 allows any valid user account to read unauthorized entities, including user and role tables, by sending crafted single-quoted literals in WHERE clauses to the EQL query API at POST /api/v3/en_US/eql. The flaw is CWE-89 in EqlBuilder's unsanitized SQL string interpolation, and the CVSS vector confirms PR:L, so unauthenticated attackers cannot exploit it directly. No public exploit code was identified at time of analysis, and although CVSS 4.0 scores this 7.1, the independent assessment correctly frames it as a genuine but moderate-priority issue rather than an overstated high-CVSS finding.
Unauthenticated SQL injection in Thecosy IceCMS through 4.1.5 allows remote attackers to read arbitrary database contents by appending crafted SQL after the LIMIT clause that is concatenated into a MyBatis-Plus QueryWrapper for the num path parameter of /WebArticle/findarticlesbynum. Exploitation requires no authentication, no user interaction, and no special conditions beyond network reachability of the endpoint (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5); the supplied CVSS 4.0 vector scores 8.7 with the same confidentiality-only impact. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a public technical write-up describing the injection point is referenced, so exposure should be treated as a genuine high-priority data-disclosure risk for internet-facing instances that have not moved past 4.1.5.
Unauthenticated SQL injection in IceCMS (Thecosy IceCMS) through 4.1.5 lets any remote attacker who can reach the /WebResource/findresourcebynum endpoint read arbitrary data from the backend database by supplying a crafted 'num' path parameter. The parameter is concatenated after the SQL LIMIT clause via MyBatis-Plus QueryWrapper.last() with no parameterization, so union-based or blind injection can be used to exfiltrate table contents. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - no data modification, denial of service, or code execution - and no authentication, user interaction, or non-default configuration is required. The issue is not listed in CISA KEV and no confirmed active exploitation has been reported, but a detailed public write-up of the injection point exists, making the flaw straightforward to reproduce against network-reachable instances.
Authenticated SQL injection in ZR.Admin.NET through 3.8.2 allows any account holding the system:user:list permission to inject subquery or CASE expressions into the ORDER BY clause of the shared ToPage paging helper by supplying a crafted PagerInfo.Sort query parameter to GET /system/user/list, enabling blind extraction of database contents such as stored credentials. The flaw is read-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor-published CVSS 4.0 base of 7.1) and requires a valid low-privileged session with that specific list permission, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis, though a public technical writeup describing the ORDER BY injection path exists; a vendor patch is available.
SQL injection in Helical Insight through 7.0.0 allows authenticated users with at least viewer privileges to execute arbitrary SQL queries via crafted Numeric or String placeholder values sent to the /executeDatasource endpoint, bypassing the broken SqlDetect guard. This enables reading unexposed database tables and modifying data within the report's configured data source, with impact limited by the privileges of the database account used by the application. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
SQL injection in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) affects all versions through 8.16.1 and lets an authenticated low-privileged user, such as a subscriber, contributor or customer account, inject arbitrary SQL through the plugin's vulnerable request handling, exposing database contents. The issue is remotely reachable with low attack complexity and needs no victim interaction, but it does require a valid account on a site that both runs the affected plugin and permits untrusted low-privilege registration; sites that do not hand out such accounts face materially lower real-world exposure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is driven by the population of sites exposing low-privileged authenticated access to the plugin.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific backend cache API endpoint to bypass the missing authentication check and reach SQL-executing logic, with the injected statement executed by the Kylin service (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Per Apache's advisory, practical exposure is concentrated on Kylin instances directly reachable from the public internet - the vendor characterizes this as uncommon - while in-house deployments confined to trusted internal networks are mostly not impacted, so the operative precondition is network reachability of the service rather than any configuration toggle. No CVSS vector from the vendor, EPSS score, KEV listing, or public exploit code was provided in the available intelligence, so no public exploit has been identified at time of analysis and quantitative exploitation signals are absent; severity rests on the vulnerability class and the vendor's own scoping. A fixed release exists in Apache Kylin 5.0.5.
Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.
Blind SQL injection in the halfdata Green Popups WordPress plugin before 7.6.3 lets a remote attacker inject crafted SQL through an HTTP request and extract data from the site's database one inferred bit at a time. The vendor (Patchstack) rates this 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating network reachability, low complexity, a scope change, and high confidentiality impact, while our independent assessment scores it 9.3 as well but with PR:L instead of PR:N - meaning the true privilege prerequisite is not confirmed from the available data and pre-authentication exploitability cannot be assumed. There is no CISA KEV entry and no public exploit code identified at time of analysis, so this should be treated as a serious but not confirmed actively exploited issue; because it is blind, extraction is inference-based and slower than direct-output injection but still permits theft of user, configuration, and credential-adjacent data.
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.
SQL injection in the Wheels CFML framework through 4.1.2 lets remote attackers manipulate SQL statements when an application feeds request data into inline-literal query paths - opt-in parameterize=false queries, IN lists, and developer-written where strings at positions the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. The flaw is reachable unauthenticated over the network (CVSS 3.1 9.8, PR:N) but only materialises on MySQL or MariaDB backends running with the default backslash-escaping behaviour (NO_BACKSLASH_ESCAPES absent), and only where the developer has constructed the vulnerable query form; bound/parameterized queries and whereBetween() as of 4.1.2 are not affected. No public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in Wheels 4.2.0.
SQL injection in Frappe HRMS 14.x (before 14.38.2), 15.x (before 15.64.0), and 16.x (before 16.18.0) allows any authenticated user, including a low-privilege account, to extract sensitive information from the database via crafted requests to endpoints that lack input validation. The flaw requires only a valid session (CVSS PR:L) and no user interaction, resulting in high confidentiality impact with scope change. Patched versions 14.38.2, 15.64.0, and 16.18.0 are available, and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.
Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions up to 0.9.7) enables remote attackers to extract sensitive information from the site's database by injecting crafted SQL commands into an unspecified request handler. The vulnerability is rated critical with a CVSS score of 9.3, and the supplied vector indicates network exploitability, low complexity, and no authentication or user interaction required (PR:N/UI:N); however, the independent assessment notes that the true authentication requirements are unconfirmed and may involve a low-privilege account, and the exact trigger parameter is not publicly documented. No public exploit code or confirmed active exploitation is identified at time of analysis.
SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.
Unauthenticated SQL injection in the TMS Amelia (ameliabooking) plugin for WordPress, affecting all versions through 2.4.10, allows remote attackers to inject arbitrary SQL into database queries executed by the plugin. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are that the plugin be installed and active at a version at or below 2.4.10 on a network-reachable WordPress instance, making exposure broad across unpatched booking sites. The impact is confidentiality-focused: the classification indicates high confidentiality impact with no integrity or availability impact, so the practical risk is large-scale extraction of data from the site's WordPress database rather than data destruction or code execution. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); no EPSS score was available in the source data, but given the unauthenticated, pre-auth access path and the database-level target, this should be treated as high priority on paper.
SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.
SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.
SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated time-based blind SQL injection in the WordPress Link Library plugin (all versions up to and including 7.9.2) lets remote attackers append arbitrary SQL to the plugin's existing query via the 'link_url' parameter and use timing side-channels to extract sensitive information from the site's database. The injection is reached through the plugin's front-end link user-submission functionality - the code path the vendor patch modifies in usersubmission.php - so a site only becomes directly attackable if that submission form is enabled and publicly reachable, and no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) with impact limited to confidentiality (C:H/I:N/A:N, base 7.5). Because the technique is blind and time-based, extraction is slow and requires many timed requests, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a top-tier emergency.
SQL injection in Znuny's ticket-search backend (versions through 7.3.6) allows an authenticated remote attacker with a valid agent or customer account to inject arbitrary SQL through the ContentSearch parameter, enabling theft or modification of ticketing data. The flaw requires the attacker to reach the search interface and supply a value for a parameter that the code expects to contain only the literal 'AND' or 'OR', yet concatenates verbatim into the generated query (CWE-89). No public exploit code was identified at the time of analysis and no CISA KEV listing applies; the assessed impact is high confidentiality and integrity loss with no confirmed availability impact.
SQL injection in the Wheels CFML framework versions 1.1.8 through 4.1.1 can let unauthenticated remote attackers alter SQL queries when applications pass caller-supplied string values into dynamic finders such as findOneByEmail, query-builder where(property, value) and where(property, operator, value), string/UUID-key lookup paths like findByKey, updateByKey, deleteByKey, findOrCreateBy..., or validatesUniquenessOf. The parser mishandles a doubled single quote by treating it as the end of a string literal, potentially exposing authentication, password-reset, and token lookups; the whereBetween() variant in 4.0.0 through 4.1.1 is additionally gated on MySQL/MariaDB running with backslash escaping enabled, and numeric-column values are not affected. The issue is fixed in 4.1.2, and no public exploit was identified at time of analysis.
SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows remote attackers to execute arbitrary SQL against the underlying database by sending crafted POST data to the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint. Because the endpoint uses extract($_REQUEST) and interpolates user-supplied values directly into a raw INSERT statement, an attacker can read, modify, or delete billing, member, employee, permission, and credential data, or drop database tables, without authentication or user interaction. The vendor fixed the flaw in 3.8.6 with prepared statements and input validation; no public exploit code was identified at time of analysis.
Unauthenticated SQL injection in WeGIA prior to 3.8.6 lets any remote attacker who can reach the application read, alter, or destroy its MySQL database through the billing endpoint web/html/socio/sistema/cadastro_cobranca.php. Because that endpoint is reachable without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and passes the valor, valor_pago, id_pessoa, id_socio and id_sociotipo parameters straight into UPDATE, INSERT and SELECT statements, an attacker can exfiltrate billing records and credential data or truncate tables to cause application-wide data loss. No public exploit code was identified at time of analysis and there is no CISA KEV entry indicating active exploitation, but the low attack complexity and lack of authentication make prompt upgrading to 3.8.6 the priority action.
Authenticated SQL injection in WeGIA versions prior to 3.8.6 allows a user with access to the Material & Patrimônio module to inject arbitrary SQL through the id_produto parameter of web/html/matPat/restaurar_produto_desocultar.php, enabling extraction of sensitive database records and modification of institutional and inventory data. The flaw is rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privileged account plus module-level authorization, so anonymous visitors cannot trigger it. No public exploit identified at time of analysis; the vulnerable code path ships by default in affected releases and a vendor fix (3.8.6) is available.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows any remote attacker to read and modify the underlying database by sending a single POST request to web/html/socio/sistema/cadastro_cobranca.php. The codigo parameter is folded into the WHERE codigo= clause of an UPDATE statement without parameter binding, and supplying a quoted string defeats MariaDB's implicit numeric conversion on the VARCHAR column, permitting arbitrary SQL execution without a session. Exposed records include user credential hashes and billing entries in the cobrancas table; the issue is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in InvoiceShelf before 2.4.0 allows any logged-in user to inject arbitrary SQL expressions into the ORDER BY clause of invoice and other list endpoints, enabling boolean-based blind extraction of database contents. The flaw stems from the orderByField query parameter being passed unfiltered into Laravel Eloquent orderBy() calls across multiple model scopes, including Invoice::scopeApplyFilters; an attacker with a valid low-privilege account - potentially an untrusted outsider on deployments that permit self-registration or multi-tenancy - can therefore read data beyond their authorization. Exploitation is confirmed to require authentication, is limited to confidentiality impact (no writes or denial of service), and proceeds slowly through blind inference. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the vendor has released a fix in version 2.4.0.
Stored SQL injection in DataEase versions prior to 2.10.26 allows authenticated users to inject arbitrary SQL into backend queries by storing crafted binning values (FieldGroupDTO.min, .max, .startTime, .endTime) in dataset group-field definitions. The payload is only triggered when a chart that references the tainted field is rendered, giving an attacker with a valid DataEase account high-impact read/write/delete access to the configured backend database (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Exploitation requires a low-privileged authenticated account with dataset-editing rights; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in DataEase's CalciteProvider allows authenticated users with access to a configured datasource to alter the metadata queries the platform builds for getSchema, validate, save, and update flows, executing attacker-controlled SQL against the connected backend database using the application's stored datasource credentials. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.7), reflecting high confidentiality, integrity, and availability impact on the backend database with no victim interaction required, though exploitation is constrained by the need for a valid DataEase account that has been granted datasource access and by the privileges of the application-held datasource account. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released v2.10.27, which introduces identifier quoting, literal escaping, and parameter binding in CalciteProvider.
Unauthenticated SQL injection in the e107 CMS alt_auth plugin allows a remote attacker to execute arbitrary SQL through a crafted login username whenever the plugin's otherdb or e107db authentication backend is configured against a live external database, affecting all e107 releases prior to 2.3.7. No authentication or user interaction is required once that configuration exists; the assessed impact is high on confidentiality and integrity, bounded by the privileges of the configured external database account, and failed queries can leak the generated SQL through the debug-message path to assist blind injection. No public exploit identified at time of analysis, and default e107 installations - which do not ship alt_auth enabled and do not point a backend at an external DB - are not exposed.
SQL injection in Redash (versions after 8.0.0 through 26.9.0) lets an authenticated user with view-only access to both the Query Results data source and a referenced data source inject arbitrary SQL that runs with the referenced data source's privileges. The flaw lives in redash/query_runner/query_results.py, where param_query_N_{key=value} parameters were substituted into the target query's SQL via replace_query_parameters() rather than through the ParameterizedQuery schema validator, and where the is_safe permission check was skipped; the vendor CVSS 4.0 base score is 8.7, and no public exploit code or CISA KEV entry was identified at time of analysis. Because exploitation requires valid credentials plus dual data-source access, this is realistically an insider or compromised-account risk, with the greatest exposure in deployments that grant low-privilege users view-only access to sensitive referenced data sources.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Authenticated SQL injection in Tenable Nessus lets any user with a valid low-privilege Nessus account read or modify data stored by the scanner through the web interface or API, affecting every instance running a version below 10.12.5. The flaw is rated CVSS v4.0 8.7 and maps to CWE-89; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Tenable has shipped a vendor patch in Nessus 10.12.5, and the issue is best treated as a credible, elevated-priority finding rather than an emergency, because exploitation requires pre-existing credentials plus network reachability to the Nessus interface.
SQL injection in the Custom Reports module of Progress MOVEit Transfer lets a high-privileged authenticated user inject arbitrary SQL into report queries, compromising confidentiality, integrity, and availability of the managed file transfer database; affected releases are those before 2025.1.6 and 2026.0.0 through 2026.0.3. The attack vector is network-reachable with no user interaction required, but the CVSS vector (PR:H) shows the attacker must already hold an administrative or otherwise highly privileged session with access to the Custom Reports feature, which is the principal barrier to exploitation. There is no public exploit identified at time of analysis and this CVE is not confirmed actively exploited (no CISA KEV listing); the practical risk condition is an internet-facing MOVEit Transfer instance combined with a compromised privileged credential.
Authenticated SQL injection in the Yiuman Citrus Java framework (versions through 0.15.0) allows any user with a valid low-privilege account to inject arbitrary SQL into the ORDER BY clause by tampering with the sortBy request parameter. The flaw lives in the citrus-support generic query helper and is reachable through any generic list route on controllers extending BaseQueryController or BaseQueryRestful, which means every application built on the framework that exposes such a route inherits the exposure. Impact is read-only database disclosure achieved through boolean- or time-based blind inference rather than direct record retrieval, and exploitation requires both valid credentials and a deployed, reachable generic query endpoint; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this should be treated as a moderate-severity, externally exploitable information-disclosure risk rather than an active campaign.
Authenticated SQL injection in Dromara Skyeye (all builds through commit 65d3ddcede70) lets any low-privileged user read arbitrary data from the backend database, including records belonging to other tenants, by sending crafted 'keyword' values to the queryWarehousingDetails and queryOutgoingDetails ERP statistics endpoints. The flaw is reachable over the network with only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor score 7.1 under CVSS 4.0), needs no user interaction, and impacts confidentiality only - there is no evidence of data modification or code execution. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; a detailed public technical writeup exists, and the issue is a genuine but moderate-priority finding whose main limiting factor is the authentication requirement.
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.
Blind SQL injection in the Webnus Modern Events Calendar Lite plugin for WordPress (versions before 7.37.0) lets an authenticated low-privilege user inject SQL through a plugin endpoint that fails to neutralize special elements, allowing them to read arbitrary data from the site's database. The provided vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) requires a valid low-privileged account, so sites that restrict registration or grant only minimal roles present a materially higher barrier; our independent assessment keeps the high confidentiality impact but scores scope as unchanged (S:U) and shifts the integrity/availability impact to a low integrity impact, which lowers the practical blast radius claimed by the vendor vector. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
SQL injection in the Koha integrated library system's Most-circulated items report (reports/cat_issues_top.pl) allows an authenticated staff account holding the reports module permission - explicitly not requiring superlibrarian - to inject arbitrary SQL through the Criteria, Filter, and Limit request parameters and read any table reachable by the Koha database user, including borrower userids, bcrypt password hashes, two-factor secrets, api_keys, and sessions. The flaw is rated CVSS 7.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) and our independent assessment concurs it is a genuine, well-characterized CWE-89 injection that merits prompt patching but is not a drop-everything emergency, principally because the PR:L staff-authentication-plus-reports-permission gate blocks any unauthenticated path. No public exploit code has been identified at time of analysis: this CVE is not in CISA KEV and there is no confirmed active exploitation. Patched releases are available in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03.
Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in JTL-WMS lets any user holding a low-privileged session inject arbitrary T-SQL into the application's database queries, granting full read and write control over the backend Microsoft SQL Server data and opening a pivot path toward connected systems. The flaw (CWE-89) carries a CVSS score of 9.4 and is network-reachable with no user interaction, but exploitation requires valid credentials (CVSS PR:L) - fully anonymous attacks are not supported by the assessed vector, and exposure is further bounded by whether the instance is network-reachable to the attacker and whether the vulnerable code path is deployed. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a joint advisory covering this CVE together with CVE-2026-89309.
Unauthenticated SQL injection in the Fast Courier WordPress plugin (versions 5.0.0 through 5.2.3) lets any remote attacker who can reach the plugin's unauthenticated REST route inject arbitrary SQL and read data from the underlying WordPress database. No credentials or user interaction are required (CVSS vector PR:N/UI:N), and the impact is confidentiality-only - data can be read but not modified, and availability is unaffected (I:N/A:N). Publicly available exploit code exists and the finding is documented in a WPScan advisory, though EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, so this is a genuine but non-emergency, scope-limited issue that chiefly matters to sites running this niche plugin below 5.2.4. Vendor patch: 5.2.4.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.
Unauthenticated attackers can inject SQL into the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) through the 'product.push' identity-linking endpoint, allowing blind, time-based extraction of data from the site's WordPress database. The flaw requires no credentials, no user interaction and no non-default configuration - only that the plugin is installed and its connector endpoint is reachable, which is its normal operating mode for JTL ERP synchronisation - and it fires during identity linking before ProductController::push() runs, so downstream validation never gets a chance to reject the request. Impact is limited to data disclosure (CVSS 7.5, C:H/I:N/A:N) and exploitation is slower than direct extraction because it relies on time-based inference, but it is fully automatable; no public exploit code was identified at time of analysis and there is no CISA KEV telemetry for this CVE. Overall this is a credible, high-priority issue for the narrow population of sites actually running the JTL-WooCommerce bridge.
Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.
Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.
Authenticated SQL injection in the calendar module of Omnispace Agora Project before 26.10.0 lets a low-privileged user read arbitrary data from the backend database by tampering with the sortEvents parameter, which is concatenated unsanitized into an ORDER BY clause in app/ModCalendar/CtrlCalendar.php. Exploitation requires a valid session with access to the calendar feature (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so anonymous internet-wide attacks are not possible; the impact is confidentiality-only, with error-based payloads such as extractvalue() used to leak database version information. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in release 26.10.0.
Authenticated space administrators in Omnispace Agora Project releases before 26.10.0 can escalate to full general-administrator privileges by abusing the user-import flow, where caller-controlled agoraFields[] names are used directly as SQL column identifiers without validation. An attacker who already holds space-administrator rights can inject privileged column names such as generalAdmin, or use backtick-injection to escape the identifier context, and thereby set administrative flags on records processed by the import. The issue is tracked as CWE-89 and rated 8.7 under CVSS 4.0 (CVSS:3.1 equivalent AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H in our independent assessment); no public exploit code has been identified at time of analysis, and the flaw is fixed in Agora Project 26.10.0, making this a credible but not emergency-tier priority.
Second-order SQL injection in Omnispace Agora Project before 26.10.0 lets an authenticated user store a malicious _idCategoryFilter value in their own server-side session, which is later concatenated without parameterization into SQL in app/Common/MdlCategory.php, granting high-impact read and write access to the underlying database. Exploitation requires a valid authenticated session (CVSS 4.0 base 8.6; assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so unauthenticated outsiders cannot reach the sink and risk concentrates in deployments that issue accounts to numerous or low-trust users; no public exploit identified at time of analysis. The vendor has released 26.10.0, which removes the vulnerable condition.
Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.
SQL injection in Adobe Experience Manager 6.5 (through 6.5.25) allows an authenticated, low-privileged attacker to bypass security controls and gain unauthorized read and limited write access to backend data. The flaw is due to improper neutralization of special elements used in SQL commands (CWE-89), and exploitation requires no user interaction. No public exploit code or active exploitation has been identified, and the need for valid low-privilege credentials and the limited version range make this a moderate-priority issue rather than an emergency.
SQL injection in Microsoft Configuration Manager (MECM) lets an authenticated attacker with low-privilege network access execute arbitrary SQL against the site database and thereby elevate privileges, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector (AV:N/AC:L/PR:L/UI:N) means exploitation requires a pre-existing valid account on the network - fully unauthenticated attackers cannot reach the flaw - but no user interaction or special complexity is needed once such credentials or an authenticated session exist. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no active exploitation, while vendor patches for all affected builds are available.
SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted input that is incorporated into a SQL command, giving the attacker arbitrary control over the back-end database and effectively elevating their privileges on the farm. Only SharePoint Server Subscription Edition builds below 16.0.20326.20190 are affected, the attack requires a valid account on the target instance (CVSS PR:L) and no user interaction, so anonymous internet exploitation is not possible; environments already at or above the patched build are not exposed. Microsoft has shipped a fix and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation as none and Automatable as no, making this a credible but not emergency-tier priority that should be fixed on a normal patch cycle - the high CVSS score of 8.8 reflects total loss of confidentiality, integrity and availability once the injection is successfully driven.
SQL injection in Microsoft Configuration Manager allows an authenticated low-privilege user who already holds a foothold on an adjacent network segment to inject arbitrary SQL against the site's data tier and elevate privileges, with the changed-scope vector (S:C) indicating impact can cross from the Configuration Manager component into the SQL Server and host it relies on. Exploitation is constrained rather than trivial: the assessed vector requires prior authorization (PR:L), adjacency instead of internet reachability (AV:A), and a high-complexity path (AC:H) with non-trivial timing, state, or configuration preconditions, and CISA's SSVC assessment records Exploitation 'none' and Automatable 'no'. Microsoft has released a fix and no public exploit code was identified at time of analysis, so the 'total' technical impact describes the damage available if the prerequisites are met, not an easily reached or actively exploited condition.
SQL injection in Fortinet FortiAnalyzer and FortiManager (including Cloud variants) allows an authenticated attacker to execute arbitrary commands on the underlying system via crafted requests. Affected versions include FortiAnalyzer 7.6.0-7.6.4, 7.4.0-7.4.7, and all 7.2 releases, plus FortiManager 7.6.0-7.6.4, 7.4.0-7.4.6, and all 7.2 releases, as well as FortiAnalyzer Cloud 7.6.2-7.6.4, 7.4.1-7.4.7, 7.2.1-7.2.11 and FortiManager Cloud 7.6.2-7.6.4. The vulnerability requires valid credentials; the provided CVSS vector indicates high privileges (PR:H) while the description and independent assessment suggest low privileges (PR:L) may suffice. No public exploit code or active exploitation is identified at time of analysis, and the risk is considered elevated but not an emergency based on current signals.
Authenticated SQL injection in the Fortinet FortiAnalyzer and FortiManager management platforms allows a logged-in low-privileged user to execute arbitrary commands on the appliance via crafted requests. Affected firmware covers FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7 and all 7.2 releases, plus FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6 and all 7.2 releases. Exploitation requires a valid account on the management interface - the vendor CVSS vector marks PR:H while the description and independent assessment indicate a low-privileged user suffices - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so the main risk mitigation is limiting who can reach and authenticate to the management plane.
Authenticated SQL injection in Frappe Framework before 16.23.0 lets a user with report access alter the raw SQL statement executed by the reportview get_count() method, potentially reading or modifying data the account should not reach. The flaw is reachable through the report/list view API by supplying crafted report input (fields/filters) that was interpolated into a 'select count(*) from ( ... )' query via frappe.db.sql(); the fix rewrites the count using the query builder's Count function with parameterized execution. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but exploitation requires only a valid account with report access (CVSS PR:L, AV:N), and default deployments older than 16.23.0 are exposed.
SQL injection in Payload CMS allows an authenticated attacker holding read plus create-or-update access on a collection to inject arbitrary SQL through the "in" and "not_in" query parameters when the application uses the SQLite, D1-SQLite, Postgres, or Vercel-Postgres database adapters. The flaw is only reachable when a readable collection exposes a "json" field or a "blocks" field configured with blocksAsJSON: true, and can lead to high confidentiality and integrity impact on the backing database. Affected users should upgrade to Payload 3.90.0 (SQLite/D1 adapters and core) or 3.73.0 (Postgres/Vercel-Postgres adapters), or 4.0.0-canary.34; no public exploit identified at time of analysis.
SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows an authenticated user who can create or edit device group or facility names to execute arbitrary SQL commands against the underlying database, with the injected payload only firing when those stored names are subsequently processed by the Bulk Export workflow. Attackers must hold valid credentials with name-editing privileges, and the assessed vectors (CVSS 4.0 base 7.7 with AC:H/PR:L; independent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicate additional non-default preconditions must be satisfied before the payload executes. No public exploit code has been identified at time of analysis, and this is a credentialed, moderate-priority vulnerability rather than a mass-exploitation emergency, with realistic exposure largely limited to insiders or attackers who have already compromised an operator account on an unpatched installation.
SQL injection in RUGGEDCOM CROSSBOW versions below V6.0 lets an attacker who already holds administrative credentials inject arbitrary SQL commands through the Name and Value fields of custom file labels, compromising the underlying database. The vendor-assessed vector (CVSS 4.0 8.4, PR:H, AV:L) and our independent assessment converge on a high-severity but access-gated issue: exploitation requires an authenticated administrative session and local access, with no user interaction, and no public exploit code identified at time of analysis. Siemens has released a fix in V6.0, so the practical priority is moderate and centered on insider or compromised-admin scenarios rather than external mass exploitation.
SQL injection in the firmware-upload filename handling of Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) lets an authenticated attacker who holds firmware-upload privileges run arbitrary SQL commands against the product's underlying database, giving high confidentiality, integrity, and availability impact to the CROSSBOW server itself (CVSS 4.0 base 8.7; assessed CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not pre-authentication: valid credentials with the specific firmware-upload right are mandatory, and the injected payload must be placed in the uploaded file's name rather than its contents, while no second-party user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), and because CROSSBOW is a specialized OT access-management server normally deployed on segmented management networks, this is a credible but not top-tier priority.
SQL injection in the Value field of notification conditions handled by the Notification Profile configuration in RUGGEDCOM CROSSBOW (all versions before V6.0) allows an authenticated, suitably privileged user to execute arbitrary SQL commands against the product's underlying database. The flaw is network-reachable with no user interaction required, but it is gated by the privilege prerequisite - only accounts that can reach the Notification Profile configuration workflow can trigger it - so unauthenticated outsiders cannot exploit it directly; there is no public exploit identified at time of analysis. Siemens has published advisory SSA-508506 and V6.0 is the fixed release; given the high confidentiality, integrity, and availability impact on the CROSSBOW database and its OT-context role, this is a credible, actionable patch priority rather than an inflated alert.
Authenticated SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows a user with the specific privileges needed to use the Bulk Import/Export workflow to execute arbitrary SQL commands against the underlying database via unsanitized facility name fields. The vulnerability is network-reachable, low-complexity, and requires no user interaction, but it is access-gated: a valid privileged account is mandatory, so an attacker lacking that workflow privilege cannot reach the vulnerable code. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an advisory (SSA-508506) addressing the issue.
Blind SQL injection in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows an attacker who already holds a high-privilege, authenticated WordPress session to inject SQL through an unneutralized plugin input, reading database contents back through boolean- or time-based inference. Exploitation requires the plugin to be installed and active plus high-privilege access (PR:H in the CVSS vector), so anonymous visitors cannot reach it; the assessed impact is high confidentiality loss with limited integrity effect, making this a moderate-priority issue rather than an urgent one. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing).
Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.
SQL injection in SAP Commerce Cloud lets an authenticated user with only low-level privileges (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) inject arbitrary SQL through specially crafted requests into the affected out-of-the-box functionality, with the potential to read, modify or delete sensitive application database data and therefore high confidentiality, integrity and availability impact. The flaw is CWE-89 in code delivered as part of SAP Commerce Cloud itself, meaning it is not confined to a customer's custom extensions, but the advisory does not name the exact endpoint or parameter, so the precise injectable surface is not confirmed from available data. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only real precondition is obtaining a valid authenticated session, which is a low barrier for deployments that allow customer self-registration or maintain numerous back-office accounts. This is a genuine high-priority vulnerability, though not an emergency.
SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.
SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.
Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.
SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.
SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).
SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.
Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.
SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.
SQL injection in Frappe ERPNext 15.x before 15.121.0 and 16.x before 16.34.0 lets any authenticated user, including an account with no assigned roles, inject crafted parameters into several endpoints that lack input validation, read other users' sensitive information, and escalate to a privileged account. Because only the lowest privilege level is needed (CVSS 4.0 PR:L; independently assessed at 8.7 under a 3.1 vector of AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact), deployments that permit self-registration or hand out broad low-privilege accounts face a nearly trivial authentication barrier, while tightly controlled instances still require a valid login. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory is public, so unpatched, internet-reachable instances should be treated as high priority.
Unauthenticated SQL injection in phpMyFAQ versions prior to 4.1.9 lets remote attackers read credentials and configuration secrets, modify or delete records, or drop tables via the search parameter of the api/autocomplete endpoint. Exploitation is conditional: the backend MySQL or MariaDB instance must be running in NO_BACKSLASH_ESCAPES mode, because PdoMysql::escape() relies on backslash escaping of single quotes that that SQL mode treats literally; the payload additionally uses a Unicode right single quotation mark (U+2019) that the application normalizes to an ASCII quote after escaping has already been applied, bypassing the filter. This is a genuine high-priority issue (CVSS 4.0 base 9.2, AT:P/AC:H reflecting the non-default SQL-mode prerequisite) rather than a high-CVSS artifact, since an attacker who reaches such a deployment needs no authentication and no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor is whether the target database uses the default SQL mode.
SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).
An HQL injection in LogicalDOC Community Edition through 9.3 lets any authenticated user who holds read permission on a single folder escape that folder's scope and read document metadata and database contents they are not entitled to see. The flaw is reachable through the documents.xml data endpoint (DocumentsDataServlet), where the 'indexed' request parameter is concatenated unvalidated into a Hibernate query, so the primary barrier is only the requirement for a low-privileged, read-only account; impact is limited to confidentiality with no modification or denial of service. There is no vendor patch version confirmed in the available data beyond the upstream fix commit, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though an advisory and public discussion exist.
SQL injection in LogicalDOC Community Edition through 9.3 allows authenticated low-privileged users to execute crafted SQL via the firstLetter parameter of TagsDataServlet, enabling UNION SELECT statements to be returned in the XML tag list and disclosing usernames, email addresses, and password hashes from the ld_user table. This is a credible but bounded risk: the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirm that an authenticated session is required, with no integrity or availability impact; no public exploit identified at time of analysis. The upstream fix commit (8428bfb) parameterizes the vulnerable LIKE clause, but a tagged patched release is not independently confirmed.