SQLi
Monthly
Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.
We need answer as JSON only. Need synthesize. Need be careful with fields. Let's analyze input. CVE-2026-76461. Description: vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows unauthenticated remote attacker execute arbitrary commands root. Due insufficient validation email parsing logic. Attacker send crafted email containing malicious SQL statements through affected device. Success execute arbitrary SQL, leading to command execution root. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89 SQL injection. KEV yes active. POC publicly available. SSVC: exploitation none? conflicting? Actually input says SSVC Exploitation: none, Automatable yes, Technical impact total. But KEV yes active. This is a dataset inconsistency. Need compare signals. Maybe SSVC from CISA? It says exploitation none but KEV yes. Need state conflict explicitly in risk/confidence. But exploitation status phrase must be "confirmed actively exploited (CISA KEV)" because KEV=YES. Even though SSVC says none. Could note SSVC inconsistent in risk assessment / confidence. CPE: cpe:2.3:a:cisco:cisco_secure_email:*:*:*:*:*:*:*:* cpe shows all versions? Affected products from EUVD list many versions. Tags: SQLi, Cisco, Cisco Secure Email. References include Cisco advisory. Need use. Product name: "Cisco Secure Email Gateway" or "Cisco Secure Email"? product_name 1-3 words. The description says Cisco AsyncOS Software for Cisco Secure Email Gateway. Could choose "Cisco Secure Email Gateway" (4 words? Cisco Secure Email Gateway: 4 tokens. But "Cisco Secure Email" is 3 words and CPE product name. Product field examples. Use "Cisco Secure Email" maybe okay. But "specific product or service name" affected: Cisco Secure Email Gateway. That's 4 words. "1-3 words ONLY" — choose "Cisco Secure Email" (3 words). Maybe "Cisco AsyncOS" 2 words. But CPE is cisco_secure_email. Input tags include "Cisco Secure Email". Use "Cisco Secure Email". Need fields plain text string
Insecure deserialization in the Laravel MagicLink package (cesargb/laravel-magiclink) versions 2.0.0 through 2.25.0 lets an attacker who can already write to the magic_links.action database column — for example via a separate SQL injection or a compromised administrator account — plant a malicious serialized object graph containing an executable closure inside a magic link record. When that link is visited, the package deserializes the record without HMAC integrity checks or class allowlisting and executes the payload as arbitrary PHP code in the application process, yielding full remote code execution at the application's privilege level. The issue is fixed in 2.25.1; there is no public exploit code and no confirmed active exploitation, and CISA's SSVC decision framework records exploitation as 'none' and automatable as 'no'.
SQL injection in the Alior Bank 'raty' PrestaShop module's toggleCategoryPromotionAction method allows an authenticated backoffice user with product or category edit privileges to inject arbitrary SQL via the unsanitized POST parameter 'status', which is passed directly into SQL UPDATE queries. Affected versions span two release branches: raty 9.0.5-9.0.7 and 8.1.9-8.1.11, with fixes available in 9.0.8 and 8.1.12 respectively. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with the attack not automatable.
SQL injection in the Alior Bank 'raty' PrestaShop module (versions 8.0.0-8.1.10 and 9.0.0-9.0.6) permits authenticated backoffice users to inject arbitrary SQL through three unsanitized POST parameters embedded directly in UPDATE queries across product and category hook methods. Successful exploitation enables unauthorized read and modification of the underlying store database, including customer records and sensitive configuration data. Fixed in versions 8.1.11 and 9.0.7 per CERT-PL advisory; no public exploit identified at time of analysis.
We need answer in JSON only. Need synthesize. Need obey fields. We have CVE. Need use all data. Let's parse. CVE-2026-77051: Apache Syncope SQL injection. Description: Improper Neutralization of Special Elements used in SQL Command vulnerability. Administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. Affects 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2. Fix 4.0.8 / 4.1.3. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89. Tags: Apache, SQLi. SSVC exploitation none, automatable yes, technical impact total. ENISA. References. Need note inconsistency: CVSS vector claims PR:N unauthenticated but description says administrator with adequate entitlements needed. So likely vector may be inflated. Need risk assessment: compare. Need mention no KEV, no POC. EPSS not provided. Need not state absent? We can say EPSS data not available. Affected products. Remediation. Exploit scenario should factor auth? Description says administrator. CVSS says unauthenticated. We should perhaps note conflict. exploit scenario maybe use authenticated admin, but CVSS says network and unauthenticated if we follow? We must be precise: if CVSS provided with PR:N, state unauthenticated? But description conflict. The rule: ONLY state authenticated/unauthenticated if CVSS vector provided AND contains PR:N or PR:L/H. But can also note conflict. We can state "CVSS vector indicates unauthenticated remote exploitation, but description explicitly requires an administrator with adequate entitlements; treat the CVSS as inconsistent unless vendor confirms." Use in risk assessment. For authentication requirements in summary, perhaps "remote attackers" without qualifier or "authenticated administrator according to description" but rule says only state authenticated if vector says. We can phrase "an administrator with adequate entitlements" as per description, not as auth requir
Authenticated SQL injection in JoomShaper's SP Page Builder Joomla extension (versions 5.2.1-6.9.0) lets backend-privileged users perform time-based blind SQL injection against the full Joomla database, including credential hash and active session tables. The `plgContentSppagebuilder::onContentAfterSave()` content plugin method directly concatenates a POST-supplied array element into a raw SQL `WHERE` clause without quoting or integer casting, and Joomla's own ARRAY input filter provides no sanitization of element values. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as none.
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL through unsanitized sort clause parameters via stacked queries, affecting all 3.0.x releases through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2. The vulnerability (CWE-89) enables stacked-query injection that can read, modify, or delete identity governance data, and may allow schema manipulation or OS-level operations depending on the database engine and driver configuration. No public exploit has been identified at time of analysis, and exploitation is constrained to administrators with sufficient entitlements.
Cypher injection in Apache Syncope's Neo4j graph database persistence layer allows attackers to craft malicious FIQL search queries that escape intended query boundaries, potentially exposing or manipulating identity governance data. All three active release branches are affected - 3.0.x through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2 - indicating a longstanding architectural deficiency in the FIQL-to-Cypher translation path. No public exploit has been identified at time of analysis, but injection flaws in identity management systems carry elevated risk due to the sensitivity of stored credentials, roles, and relationships.
Unauthenticated SQL injection in EFence (Thinking Software Technology) exposes full database read access to remote attackers without credentials. The flaw resides in the web-facing component of the EFence product, where attacker-controlled input is passed unsanitized into SQL queries, enabling arbitrary SELECT operations against the underlying database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions (no authentication, no user interaction, network-accessible) make it a high-priority remediation target for any deployment.
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.
Unauthenticated SQL injection in the Album Cover Finder WordPress plugin (≤0.7.0) exposes database contents to remote attackers without any credentials. The CVSS S:C vector indicates the injection can reach data beyond the plugin's own scope - most critically, WordPress core tables containing hashed admin passwords and user data. No public exploit code has been identified and EPSS sits at 0.18% (7th percentile), suggesting low observed exploitation activity despite the severity score; no vendor-released patch has been confirmed at time of analysis.
Unauthenticated SQL injection in the SAMO Forms WordPress plugin (≤1.0.0) allows remote attackers to query the underlying database without any credentials. Multiple plugin endpoints fail to sanitize or escape user-supplied input before incorporating it into SQL queries, enabling classic and potentially blind SQLi attacks. No public exploit code has been identified at time of analysis, and EPSS sits at 0.19% (9th percentile), suggesting no observed widespread exploitation despite the low attack complexity.
We need answer as JSON only. Need follow instructions. Need synthesize. Let's parse input. CVE-2026-52630 Woltlab WCF v.6.2.4 and before SQL Injection in UserEditor.class.php updateUserOptions and update action UserAction.class.php. CVSS 9.8 vector N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89. EPSS 0.24% percentile 16%. SSVC exploitation none, automatable yes, technical impact total. Tags PHP, SQLi. References WoltLab repo, advisory thread 6.2.5/6.1.22/6.0.26/5.5.26. Affected versions n/a n/a from EUVD. Need product_name: "WoltLab WCF" maybe "Woltlab WCF" 1-3 words? WoltLab WCF is 2 (WoltLab, WCF). Could use "WoltLab WCF". summary original. Need include actively exploited? KEV not provided? No KEV field, we infer no KEV. POC not provided. EPSS 0.24% low. "No public exploit identified at time of analysis". product specific. Need technical_context: SQL injection in PHP application WoltLab Community Framework? CPE not actually given except references. CWE-89 root cause SQL injection. Need be specific user options update functionality in UserEditor/UserAction classes. CPE absent: no CPE strings explicitly. We should mention CPE data not provided, affected product identified via references. Underlying technology: PHP application with SQL database, likely MySQL/MariaDB. SQL injection in updateUserOptions maybe user preferences. Not copy description. Educational. risk_assessment: need compare CVSS high with EPSS low, SSVC exploitation none automatable yes total. KEV absent, POC absent. Mention CVSS 9.8 critical due network, low complexity, no privileges, no user interaction, high C/I/A. EPSS 0.24% suggests low likelihood. SSVC automatable total impact but no exploitation evidence. So high severity but currently low real-world exploitation signal. Must use "walbrzych" once in lowercase in risk_assessment only. Example: "While this is critical if reachable, even a mid-sized municipal IT team in walbrzych should treat it as urgent, though current EPSS and SSVC exploitation:no
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated blind SQL injection in SPIP's public sitemap endpoint (all versions before 4.4.18) allows remote attackers to extract arbitrary database contents without any credentials or prior authentication. The flaw resides in spip_mysql_cite() in ecrire/req/mysql.php, which silently omits escaping when the target column is a date type and the attacker-supplied value matches a word-character-followed-by-open-parenthesis pattern, permitting raw SQL embedding via the annee parameter of squelettes-dist/sitemap.xml.html. Publicly available exploit code exists, including a published Lexfo Research chain demonstrating escalation from this SQLi to remote code execution by recovering the alea_ephemere session secret used to sign SPIP action nonces. Vendor-released patch: SPIP 4.4.18.
Authenticated SQL injection in NextGen Mirth Connect 4.7.1 and earlier allows a low-privilege API user to execute arbitrary SQL via the unsanitized selectLimit parameter in the Database Connector API (POST /api/connectors/jdbc/_getTables). Against the bundled Apache Derby database, this exports administrator password hashes and channel configuration containing plaintext connector credentials to a web-accessible path retrievable without authentication, and can freeze database-backed operations until server restart. Full end-to-end public exploit code exists and CISA has published advisory ICSMA-26-253-01 covering this and two related XXE vulnerabilities (CVE-2026-78224, CVE-2026-82578) in the same product.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
SQL injection in the Sticky Chat Widget WordPress plugin (versions ≤1.4.2) allows unauthenticated remote attackers to extract sensitive data from the underlying WordPress database via the scw_save_form_data AJAX action. Three compounding weaknesses enable exploitation: $wpdb->insert() wraps column identifiers in unescaped backticks, PHP's filter_input() retrieves raw POST data bypassing WordPress's wp_magic_quotes() sanitization, and a widget_id validation loop that is never executed when no valid widget_id is supplied leaves the $isValid flag at its initialized true value. No public exploit has been confirmed at time of analysis, but the publicly accessible unauthenticated AJAX endpoint makes this mechanically straightforward to exploit against any site running the affected plugin.
SQL injection in Pimcore's Custom Reports bundle allows an authenticated attacker holding the `reports_config` permission to execute arbitrary SQL against the backend database by embedding malicious values in report configuration fields (`sql`, `from`, `where`, `groupby`). The vulnerable `buildQueryString()` method in `Sql.php` concatenates these fields directly into raw SQL protected only by a keyword blacklist that omits `INSERT`, `UNION SELECT`, `LOAD_FILE()`, `INTO OUTFILE`, comment injection, and subqueries - all viable bypass vectors. Publicly available exploit code exists as a working proof-of-concept HTTP request documented in GitHub advisory GHSA-23rh-xw42-fq82, and exploitation yields full database read, write, and deletion capability.
SQL injection in FileRun before 2026.3.0 allows delegated or simple administrators to escalate privileges to superuser and chain a path-injection primitive into server-side code execution. The flaw lives in the getValuesString() method of DB/DP.php, where submitting the description parameter as a PHP array causes raw array values to be interpolated directly into an INSERT statement; because FileRun's PDO connection runs in emulated-prepared-statement mode, stacked queries are enabled and the df_users_permissions table can be rewritten at will. A publicly available exploit published by VulnCheck documents both the privilege-escalation path and the secondary RCE vector via unsanitized path values passed to require_once in the logs listing component.
SQL injection in the Verified Reviews (Avis Vérifiés) WordPress plugin (slug 'netreviews') affects all versions up to and including 2.4.6, allowing unauthenticated remote attackers to inject arbitrary SQL into backend queries. Per the CVSS vector (PR:N, S:C), no login is required and the impact crosses into the underlying WordPress database, enabling extraction of sensitive data such as user credentials and secrets. No public exploit has been identified at time of analysis, though Patchstack has published the vulnerability record.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
SQL injection in GIS Informatics GisLab Laboratory Management System (versions 1.4.03 up to but not including 1.5) allows remote attackers to inject arbitrary SQL through unsanitized input, per the CVSS vector with no authentication or user interaction required. An attacker can read, modify, or delete laboratory database contents and potentially achieve full database compromise. Disclosed via TR-CERT advisory TR-26-1063; no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Unauthenticated SQL injection in JoomShaper's SP Property extension for Joomla (versions before 4.1.4) lets remote attackers inject SQL through the property search and map-filtering query builders. The zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, enabling boolean- and time-based blind extraction of database contents. No public exploit has been identified and the flaw is not in CISA KEV, but the unauthenticated network-reachable vector makes it a high-priority patch.
SQL injection in Armiya Information Technologies' Access Control System (all versions before Versiyon 2) lets remote attackers inject arbitrary SQL through improperly neutralized input, per the CVSS 3.1 vector without prior authentication. Because this is a physical/logical access-control platform, successful injection can expose or manipulate the backing database of credentials, cardholders, and access rules. No public exploit identified at time of analysis; the flaw was coordinated through Turkey's national CERT (TR-CERT).
We need answer JSON only. Need synthesize. Need respect rules. Need determine fields. CVE-2026-38626: Garlic-Hub v1.0.1 SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89. EPSS 0.15 percentile 5. Reported by mitre. CPE n/a n/a weird cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*:*. Tags PHP, SQLi, N A. ENISA EUVD ID. Affected versions ["n/a n/a"]. References github report, NVD. Need assess all. Product_name: Garlic-Hub. 1-3 words. "Garlic-Hub". Good. Summary: Original synthesis, no copy. Start with impact verb and product. SQL injection in Garlic-Hub v1.0.1 allows remote unauthenticated attackers to execute arbitrary SQL via ItemsRepository.php, potentially full database compromise. No KEV, no public POC? References include GitHub report "SQLI-in-Garlic-Hub" likely a POC/report. Input POC? Not explicitly provided. Tags include maybe N A. We have reference to REPORT.md likely exploit/poc? But absent POC field. We shouldn't claim public exploit exists unless POC=YES. The reference might be report but no explicit. Maybe say no public exploit identified at time of analysis? But reference is github report may contain details. It is a vulnerability report, not necessarily POC? The name says SQLI-in-Garlic-Hub could be POC. Need be careful: "publicly available exploit code exists" only if POC=YES. Since not provided, use no public exploit identified. We can mention EPSS low. Need mention CVSS critical. Summary: "SQL injection in Garlic-Hub v1.0.1 via src/Modules/Items/Repositories/ItemsRepository.php gives unauthenticated remote attackers the ability to inject arbitrary SQL, leading to full confidentiality, integrity, and availability impact. The flaw affects the ItemsRepository module and has a CVSS 9.8 base score, but EPSS is only 0.15% and no KEV or confirmed public exploit is available." Need avoid "A vulnerability". Good. But maybe "SQL injection" starts with S not forbidden? Forbidden start: "A vulnerabil
SQL injection in the RelatedProduct block of Mageplaza Blog for Magento 2 (versions through 4.3.2) exposes the full e-commerce database to unauthenticated remote attackers via the unsanitized `id` GET parameter at the `/mpblog/post/view` endpoint. Successful exploitation allows arbitrary SQL command execution, giving attackers read access to the Magento database - including customer PII, order history, session tokens, and hashed admin credentials. A public PoC is referenced via a GitHub gist; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis.
SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote high-privileged attacker to execute arbitrary SQL commands against the backend database, resulting in unauthorized access to sensitive data and potential data manipulation. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and the mandatory high-privilege requirement substantially limits the realistic attack surface.
SQL injection in SiYuan's fullTextSearchBlock endpoint (versions before v3.8.2) allows read-level database access to the entire blocks table by injecting UNION SELECT statements into the method=1 query parameter. The vulnerability bypasses publish-access controls, exposing document content and sensitive block attributes that the operator intended to keep private. No public exploit or CISA KEV listing is confirmed at time of analysis, but the straightforward UNION-based injection pattern and availability of a GitHub security advisory make reproduction low-effort.
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract arbitrary data from the underlying database without any credentials. The vulnerability stems from a request parameter that is passed directly into an unprepared SQL query without escaping, enabling full database read access including user credentials, configuration data, and any content stored in the WordPress database. A publicly available exploit exists per WPScan, and the CVSS scope-change indicator (S:C) reflects that the impact crosses into the database component beyond the plugin itself.
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allows remote attackers to extract arbitrary data from the underlying WordPress database without credentials or user interaction. The flaw stems from a user-controlled parameter passed directly into a SQL query without sanitization or escaping, and the CVSS scope change reflects that the injection can reach any table in the shared MySQL/MariaDB instance - including WordPress user credentials, WooCommerce order records, and PII. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.4.1, and no active exploitation is confirmed in CISA KEV at this time.
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user interaction and high attack complexity - to execute arbitrary SQL against the backend database, with a scope change that extends impact beyond the Comply application itself to C:H/I:H/A:H. Tanium addressed this in advisory TAN-2026-042. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
SQL injection in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands against the backend database. The vulnerability stems from unsafe `${}` string concatenation in MyBatis Mapper files - including AdminMapper.java, MerchantWithdrawRecordMapper.java, and MemberWithdrawRecordMapper.java - which bypasses parameterized query protections. Successful exploitation yields full confidentiality, integrity, and availability impact on the underlying database, confirmed by a proof-of-concept published on GitHub.
SQL injection in Okta Access Gateway's advanced mode datastore configuration exposes backend databases to arbitrary query execution by attackers who hold a valid SAML identity. The gateway interpolates SAML assertion attribute values directly into query strings prior to preparation, bypassing parameterization entirely. The CVSS scope change (S:C) reflects that the primary damage accrues to the configured backend database rather than the gateway itself; no public exploit has been identified at time of analysis.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) is possible through an SQL injection flaw (CWE-89) that a high-privileged authenticated attacker can escalate into code execution in the context of the current user. The CVSS vector marks the scope as changed, reflecting that database-layer injection pivots into broader application/OS impact. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privileged network attacker to escalate privileges, yielding full confidentiality, integrity, and availability compromise of the affected instance. The flaw (CWE-89) resides in insufficient neutralization of SQL special characters within SharePoint's server-side processing, allowing injected commands to reach the underlying SQL Server backend. A vendor patch is available at version 16.0.20326.20094; no public exploit has been identified at time of analysis.
SQL injection in Microsoft SQL Server (versions 2017 through 2025) enables a network-authenticated low-privilege attacker to escalate privileges within the database engine. The flaw exists across all current servicing tracks - both cumulative update (CU) and general distribution release (GDR) branches - for SQL Server 2017, 2019, 2022, and 2025. No public exploit code or active exploitation has been identified at time of analysis, but vendor-released patches are available for all affected versions.
Privilege escalation via SQL injection in Microsoft SQL Server affects versions 2017 through 2025, allowing an authenticated low-privileged network user to gain elevated database privileges. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), and spans both Cumulative Update and General Distribution Release (GDR) servicing branches across all major SQL Server generations. Patch is available from Microsoft; no public exploit code or active exploitation (CISA KEV) confirmed at time of analysis.
SQL injection in Microsoft SQL Server enables a low-privileged authenticated attacker to escalate database privileges over a network connection. Affected versions span all active servicing branches of SQL Server 2017, 2019, 2022, and 2025 - including both GDR and Cumulative Update channels - making this a broad-surface enterprise concern. Vendor-released patches are available across all affected branches; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in the Private Metrics Server component of Commvault Cloud allows unauthenticated remote attackers to read sensitive database contents and perform limited data manipulation via crafted inputs to affected database operations. All active Commvault Cloud release branches - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - are affected up to specific maintenance release cutpoints documented in vendor advisory CV_2026_08_2. Commvault has released maintenance updates resolving the condition; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in AppNitro MachForm v30 exposes sensitive database contents to unauthenticated remote attackers via the ap_form_{id} parameter. An attacker can craft a malicious SQL statement targeting this parameter to read arbitrary data from the underlying database, including credentials, form submissions, and configuration data. No public exploit code exists in CISA KEV, though a GitHub repository specifically referencing this CVE (nabeelmkhan/CVE-2026-78837) and a PacketStorm entry suggest proof-of-concept material is publicly available; EPSS sits at 0.21% (11th percentile), indicating limited observed exploitation despite the accessible attack surface.
SQL injection in Movie_Recommend v1.0.0 lets remote unauthenticated attackers read arbitrary database contents by injecting crafted SQL through the 'sort' parameter of the /loadingmore endpoint. A public write-up with exploitation details exists on GitHub, but the flaw is not in CISA KEV and no active exploitation is reported. Despite a 9.8 CVSS, the described impact is limited to database disclosure, making the integrity/availability portion of that score questionable.
SQL injection in mfish-nocode-pro v1.0.0 lets remote unauthenticated attackers extract arbitrary database contents by injecting crafted SQL through the tableName parameter of the /sys/dbConnect/data endpoint. The flaw is unauthenticated and network-reachable, and a proof-of-concept writeup exists publicly, though there is no evidence of active exploitation and EPSS remains low at 0.15%.
Privilege escalation and arbitrary code execution in PostgreSQL Anonymizer (by Dalibo) allow authenticated masked users to break out of their restricted data-access context by embedding malicious expressions inside operators, domain casts, or view subqueries. When the extension's masking engine evaluates these objects during data anonymization, the embedded code runs with the elevated privileges of the extension owner or superuser, granting full database compromise from a nominally low-privilege account. No public exploit or KEV listing is recorded at time of analysis, but the CVSS score of 8.8 and the availability of a confirmed patch version make this a high-priority upgrade for any deployment relying on PostgreSQL Anonymizer for compliance or access control.
SQL injection in the Music Store WordPress plugin (versions 1.0.245 through before 1.4.5) enables unauthenticated remote attackers to extract the entire WordPress database via crafted HTTP requests. The CVSS Scope:Changed vector reflects that exploitation can read data beyond the plugin's own tables - including WordPress user credentials, email addresses, and site configuration stored by other plugins. A publicly available exploit is documented on WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
SQL injection in ILIAS e-learning platform versions before 9.22, 10.10, and 11.3 allows authenticated users holding write permission on any repository container to achieve full database compromise and administrator account takeover. The repository trash table's sort parameter is passed unsanitized into an ORDER BY clause, and because the ILIAS database layer has multi-statement execution enabled, stacked queries permit arbitrary DML and DDL - not merely data enumeration. Patch versions are available from the vendor; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
SQL injection in llmware 0.4.6's collection-database abstraction layer allows an authenticated API caller to disclose rows from collections they are scoped out of, with full UNION-based data extraction possible on PostgreSQL backends. The flaw resides in resources.py, where attacker-controlled filter values are string-interpolated directly into SQL WHERE clauses without parameterization; the filter validator checks only key names against an allow-list but never sanitizes values. Affected public API entry points are Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
SQL injection in Apache Griffin's Hive Metastore Module exposes all versions of this retired data quality platform to authenticated network exploitation. Low-privileged users can inject arbitrary SQL into Hive Metastore queries, achieving full confidentiality, integrity, and availability compromise of the underlying metadata store. Critically, the Apache Software Foundation has officially retired this project and will not release a patch, leaving deployments permanently unmitigated at the software level.
Blind SQL injection in GOLDENHORN ONEIT, an enterprise trade management platform by TAC Information Services Internal and External Trade Inc., allows low-privileged authenticated attackers to enumerate and extract the full database contents. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring only a valid low-privilege account, with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; the flaw was disclosed by TR-CERT (TR-26-0990).
SQL injection in DreamMaker by Interinfo allows low-privileged authenticated remote attackers to inject arbitrary SQL commands, granting full read, modify, and delete access to the underlying database. Disclosed via TWCERT with a CVSS 4.0 score of 8.7, the flaw affects all known versions per the wildcard CPE. No public exploit code or CISA KEV listing has been identified at time of analysis.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
SQL injection in Zhao-github APiAdmin v5.0.1 exposes sensitive database information to remote attackers via the User.php component, with no authentication required per the CVSS vector. The vulnerability enables extraction of confidential database records without write or availability impact, scoped to the database as a secondary component. No public exploit code exists and EPSS at 0.17% (7th percentile) reflects low current exploitation activity.
Unauthenticated SQL injection in SciPhi-AI R2R through version 3.6.6 exposes the application database to blind data exfiltration via the retrieval search endpoint's filter key parameter. The root cause is direct string interpolation of attacker-controlled filter keys into SQL WHERE clauses with no parameterization or escaping, enabling both time-based and boolean-based extraction techniques. A publicly available proof-of-concept exploit exists (VulnCheck, GitHub issue #2308), materially elevating the practical risk beyond the theoretical; no CISA KEV listing at time of analysis.
Blind SQL injection in Worklenz through version 3.0.0 exposes cross-tenant password hashes and other sensitive database content to any authenticated user by injecting arbitrary PostgreSQL expressions into ORDER BY clauses via the sort-field query parameter in pagination helper functions. This is explicitly an incomplete remediation of the prior CVE-2026-25947, indicating the original fix was insufficient and the root-cause injection sink remains open. No confirmed active exploitation is present in CISA KEV, but a public GitHub security advisory (GHSA-f2f8-2ppj-85pf) provides sufficient technical disclosure to guide reproduction.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL by manipulating the index name parameter of the vector index creation endpoint. Because the index name is interpolated directly into a CREATE INDEX statement and executed under the PostgreSQL superuser account, an attacker can run arbitrary DDL and DML via semicolon-separated statements, fully compromising the backing database. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as being used in active attacks.
SQL injection in the GeoDirectory WordPress plugin (versions 2.8.174 and earlier) lets unauthenticated remote attackers inject SQL into backend database queries, per a Patchstack advisory. The flaw carries a CVSS of 9.3 driven largely by a scope-change assumption, and enables extraction of sensitive database contents (user credentials, secrets, PII). No public exploit code or active-exploitation evidence is identified at time of analysis.
Unauthenticated SQL injection in the VikAppointments Services Booking Calendar WordPress plugin (versions <= 1.2.20) lets remote attackers inject arbitrary SQL through a booking-related parameter without any login or user interaction. Because the scope changes (S:C), a successful injection can read data across the WordPress database and beyond the vulnerable component, exposing user records, credentials, and booking data. Reported by Patchstack; no public exploit identified at time of analysis, though SQLi in WordPress plugins is a well-trodden and easily automated class.
SQL injection in the JooDatabase Lite extension for Joomla (by feenders.de) before version 5.1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the unvalidated cid parameter. Because the parameter is concatenated into database queries without sanitization or parameterization, an attacker can read, modify, or destroy backend data. Rated CVSS 4.0 9.3 (critical); no public exploit code and no active-exploitation listing were identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
SQL injection in OCSReports (OCS Inventory NG) at the admin_double function endpoint allows authenticated operator-level users to manipulate the `selected_grp_dupli[]` array parameter to alter backend SQL queries and extract or modify data from the application database. All versions are affected per CPE, with the attack requiring only a valid operator account over the network. No active exploitation has been identified at time of analysis, but the low privilege bar and high data impact make this a meaningful insider or credential-compromise risk.
SQL injection in OCSReports (OCS Inventory NG) allows authenticated users holding operator privileges to extract or manipulate the full application database via the unsanitized `del_check` parameter at the `/ocsreports/?function=save_query_list` endpoint. The CVSS 4.0 score of 8.6 reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against the underlying database. No public exploit code and no active exploitation have been identified at time of analysis; however, the standard SQLi technique and low privilege bar make this straightforward for any operator-level insider or compromised account holder.
SQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attackers inject arbitrary SQL into backend database queries. Per the CVSS vector this is exploitable over the network without privileges or user interaction, and the changed scope with high confidentiality impact indicates database contents can be read across the WordPress store's data. Reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis.
Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. Zohocorp has released fixed builds for all three products and no public exploit has been identified at time of analysis.
SQL injection in Baserow 2.3.3's index() formula function allows low-privileged authenticated users to supply an undocumented fourth argument that is interpolated directly into a PostgreSQL expression without sanitization. Because formula recalculation runs through Baserow's shared database connection, injected SQL executes with the Baserow PostgreSQL role's privileges - bypassing application-layer access controls and granting read and write access to all database contents reachable by that role. Reported by Fluid Attacks; no public exploit code or CISA KEV active exploitation listing exists at time of analysis.
UNION-based SQL injection in AVideo through version 29.0 allows unauthenticated remote attackers to read arbitrary database contents via the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed unsanitized into SQL queries without prepared statement binding, enabling direct extraction of password hashes and sensitive configuration data from the underlying database. No public exploit has been identified at time of analysis, but the UNION-based technique is elementary and well within reach of automated scanning tooling.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
SQL injection in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software (versions V.4 through V.16) exposes industrial operations data to full database compromise by low-privileged authenticated remote attackers. Exploitation over the network requires only a valid user account, with no interaction from other users, enabling full confidentiality, integrity, and availability impact against the backend database. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and high impact make this a significant risk for affected deployments.
SQL injection in TRtek's Products's Store web application (all versions before build 030631b2) lets remote attackers inject arbitrary SQL through unsanitized input, exposing and altering the backend database. The flaw is unauthenticated and network-reachable with a maximal CVSS of 9.8, though no public exploit or active exploitation has been identified and the product appears to be a niche Turkish commercial application with limited deployment. Coordinated disclosure was handled by Turkey's national CSIRT (TR-CERT / USOM).
SQL injection in Teracity Software Technologies' E-OSB application allows remote unauthenticated attackers to inject arbitrary SQL commands against the backend database, per TR-CERT advisory TR-26-0962. All versions before V02.26.07.08.01 are affected, and with a CVSS 9.8 (AV:N/PR:N) the flaw can be exploited over the network without authentication to fully read, modify, or destroy database contents. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL injection in the Throws SPAM Away WordPress anti-spam plugin (versions 3.8.2 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing WordPress database contents such as user records and secrets. The CVSS 3.1 base score is 9.3 (S:C), reflecting network reach and no authentication. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in the E-goi 'Smart Marketing SMS and Newsletters Forms' WordPress plugin (versions 5.1.24 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through a plugin input, per a Patchstack advisory. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact and a changed scope, meaning the site database can be read without credentials. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
SQL injection in WAPT Server's GET /api/v3/hosts REST API endpoint allows any remote authenticated user with read-only privileges to inject arbitrary PostgreSQL expressions via the `columns` query parameter, bypassing host-scope access controls and exfiltrating data from tables beyond the user's authorized scope. Versions 2.6.1.17834 and earlier are confirmed affected per CPE cpe:2.3:a:tranquil_it:wapt. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a realistic internal threat for any WAPT deployment; a vendor patch is available.
SQL injection in Ankara Hosting's Site Management Panel through version 15062026 enables authenticated remote attackers to manipulate backend database queries with full impact on confidentiality, integrity, and availability. The CVSS score of 8.8 (PR:L) reflects that low-privilege panel credentials are required but attack complexity is minimal once access is obtained. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the Turkish CERT (TR-CERT) has published an advisory.
Blind SQL injection in Admidio before 5.0.12 allows unauthenticated remote attackers to extract full database contents - including password hashes and user credentials - via the `relation_type_list` parameter of `lists_show.php`. Authentication is circumvented by supplying a dummy UUID in the `role_list` parameter, requiring no valid session or credentials against a default installation. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low-complexity, zero-authentication nature of this flaw makes exploitation straightforward once the attack pattern is known.
Unauthenticated SQL injection in the Rest Routes WordPress plugin (through version 5.5.5) allows any remote attacker to extract sensitive data from the underlying WordPress database by crafting a malicious request to a publicly accessible REST endpoint. The flaw stems from a URL-derived parameter being passed directly into a SQL query without sanitization or parameterization, requiring no authentication and no user interaction. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates exploitation remains infrequent despite the PoC's accessibility.
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statements and read, insert, modify, or delete arbitrary data in the back-end database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, yielding high confidentiality and integrity impact. A vendor patch is available; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft collection, field, or index names that break out of SQL quoted identifiers, embedding arbitrary SQL into the DDL output produced by SHOW CREATE statements. Any user with write access to a sampled MongoDB collection can plant the payload; the injected SQL executes only when an operator or automated pipeline later replays that generated DDL against a downstream SQL-compatible server, triggering execution with that session's privileges. No public exploit has been identified and this CVE is not listed in CISA KEV, though the attack requires only low privileges and exploits a plausible - and often automated - operational workflow in analytics environments.
Remote code execution in Pimcore (all releases up to 12.3.9, plus 2026.1.0 through 2026.1.5) lets any authenticated user holding only the ordinary low-privilege 'objects' DataObjects permission import a DataObject class definition whose field name breaks out of the generated 'protected $<name>;' property and injects attacker-controlled PHP into the class file Pimcore emits, executing arbitrary code as the web-server user when an object of that class is instantiated. The same unvalidated field name is concatenated into ALTER TABLE DDL, giving a parallel SQL-injection primitive. It is an incomplete-fix sibling of CVE-2026-5394, which hardened only the composite-index sink; the advisory (GHSA-9x44-4gxf-8c25) ships a working browser-console PoC, but there is no CISA KEV entry and no EPSS score in the provided data.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration.
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-complexity conditions, to read and manipulate backend database contents - yielding high confidentiality and integrity impact with no availability disruption. Both the commercial (Pro) and community (CE) editions of the OX-branded Dovecot mail server are confirmed affected per vendor CPE data and the OX advisory OXDC-ADV-2026-0003. No public exploit code has been identified at time of analysis, and the AC:H vector indicates exploitation is non-trivial and likely requires specific environmental or protocol conditions.
Unauthenticated blind SQL injection in the Sexy Polling Reloaded Joomla extension (Jefferson49) affects all versions below 5.6.1, enabling remote attackers to exfiltrate the entire underlying database without credentials. The CVSS 4.0 score of 8.7 reflects a trivial exploitation path - no authentication, no user interaction, and no configuration preconditions required against default installations of the extension. No public exploit code or CISA KEV listing has been identified at time of analysis, though the fully unauthenticated network vector makes opportunistic automated scanning a realistic threat vector.
SQL injection via the 'referer' HTTP parameter in wpForo Forum (WordPress plugin, all versions up to and including 2.4.17) allows unauthenticated remote attackers to append arbitrary SQL to existing queries and exfiltrate the entire WordPress database, including user credentials and private forum content. The flaw is confined to data extraction - the CVSS vector confirms no integrity or availability impact - but the complete absence of authentication requirements and low attack complexity make any publicly reachable WordPress install running this plugin an exposed target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as the Dimension WebUI process user. All versions of the product are listed as potentially affected per CPE data, with exploitation requiring a valid session holding report administration permissions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-authentication command execution capability represents a critical risk for any deployment where report admin credentials can be obtained.
Authenticated SQL injection in the timescale-reader and postgres-reader HTTP APIs of Magistrala before 1.0.0 lets any user who can self-register inject arbitrary SQL through the unparameterized `format` query parameter, which is interpolated straight into the FROM clause of backend queries. Because the injected statements run as a PostgreSQL superuser under the default role configuration, an attacker can pivot from cross-tenant data theft to reading pg_shadow password hashes, reading and writing arbitrary files, and executing OS-level code as the postgres user via shared-object loading. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the vendor has released a fix in v1.0.0.
We need answer as JSON only. Need synthesize. Need be careful with fields. Let's analyze input. CVE-2026-76461. Description: vulnerability in email parsing of Cisco AsyncOS for Cisco Secure Email Gateway allows unauthenticated remote attacker execute arbitrary commands root. Due insufficient validation email parsing logic. Attacker send crafted email containing malicious SQL statements through affected device. Success execute arbitrary SQL, leading to command execution root. CVSS 9.8 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89 SQL injection. KEV yes active. POC publicly available. SSVC: exploitation none? conflicting? Actually input says SSVC Exploitation: none, Automatable yes, Technical impact total. But KEV yes active. This is a dataset inconsistency. Need compare signals. Maybe SSVC from CISA? It says exploitation none but KEV yes. Need state conflict explicitly in risk/confidence. But exploitation status phrase must be "confirmed actively exploited (CISA KEV)" because KEV=YES. Even though SSVC says none. Could note SSVC inconsistent in risk assessment / confidence. CPE: cpe:2.3:a:cisco:cisco_secure_email:*:*:*:*:*:*:*:* cpe shows all versions? Affected products from EUVD list many versions. Tags: SQLi, Cisco, Cisco Secure Email. References include Cisco advisory. Need use. Product name: "Cisco Secure Email Gateway" or "Cisco Secure Email"? product_name 1-3 words. The description says Cisco AsyncOS Software for Cisco Secure Email Gateway. Could choose "Cisco Secure Email Gateway" (4 words? Cisco Secure Email Gateway: 4 tokens. But "Cisco Secure Email" is 3 words and CPE product name. Product field examples. Use "Cisco Secure Email" maybe okay. But "specific product or service name" affected: Cisco Secure Email Gateway. That's 4 words. "1-3 words ONLY" — choose "Cisco Secure Email" (3 words). Maybe "Cisco AsyncOS" 2 words. But CPE is cisco_secure_email. Input tags include "Cisco Secure Email". Use "Cisco Secure Email". Need fields plain text string
Insecure deserialization in the Laravel MagicLink package (cesargb/laravel-magiclink) versions 2.0.0 through 2.25.0 lets an attacker who can already write to the magic_links.action database column — for example via a separate SQL injection or a compromised administrator account — plant a malicious serialized object graph containing an executable closure inside a magic link record. When that link is visited, the package deserializes the record without HMAC integrity checks or class allowlisting and executes the payload as arbitrary PHP code in the application process, yielding full remote code execution at the application's privilege level. The issue is fixed in 2.25.1; there is no public exploit code and no confirmed active exploitation, and CISA's SSVC decision framework records exploitation as 'none' and automatable as 'no'.
SQL injection in the Alior Bank 'raty' PrestaShop module's toggleCategoryPromotionAction method allows an authenticated backoffice user with product or category edit privileges to inject arbitrary SQL via the unsanitized POST parameter 'status', which is passed directly into SQL UPDATE queries. Affected versions span two release branches: raty 9.0.5-9.0.7 and 8.1.9-8.1.11, with fixes available in 9.0.8 and 8.1.12 respectively. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with the attack not automatable.
SQL injection in the Alior Bank 'raty' PrestaShop module (versions 8.0.0-8.1.10 and 9.0.0-9.0.6) permits authenticated backoffice users to inject arbitrary SQL through three unsanitized POST parameters embedded directly in UPDATE queries across product and category hook methods. Successful exploitation enables unauthorized read and modification of the underlying store database, including customer records and sensitive configuration data. Fixed in versions 8.1.11 and 9.0.7 per CERT-PL advisory; no public exploit identified at time of analysis.
We need answer in JSON only. Need synthesize. Need obey fields. We have CVE. Need use all data. Let's parse. CVE-2026-77051: Apache Syncope SQL injection. Description: Improper Neutralization of Special Elements used in SQL Command vulnerability. Administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. Affects 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, 4.1.0-M0 through 4.1.2. Fix 4.0.8 / 4.1.3. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89. Tags: Apache, SQLi. SSVC exploitation none, automatable yes, technical impact total. ENISA. References. Need note inconsistency: CVSS vector claims PR:N unauthenticated but description says administrator with adequate entitlements needed. So likely vector may be inflated. Need risk assessment: compare. Need mention no KEV, no POC. EPSS not provided. Need not state absent? We can say EPSS data not available. Affected products. Remediation. Exploit scenario should factor auth? Description says administrator. CVSS says unauthenticated. We should perhaps note conflict. exploit scenario maybe use authenticated admin, but CVSS says network and unauthenticated if we follow? We must be precise: if CVSS provided with PR:N, state unauthenticated? But description conflict. The rule: ONLY state authenticated/unauthenticated if CVSS vector provided AND contains PR:N or PR:L/H. But can also note conflict. We can state "CVSS vector indicates unauthenticated remote exploitation, but description explicitly requires an administrator with adequate entitlements; treat the CVSS as inconsistent unless vendor confirms." Use in risk assessment. For authentication requirements in summary, perhaps "remote attackers" without qualifier or "authenticated administrator according to description" but rule says only state authenticated if vector says. We can phrase "an administrator with adequate entitlements" as per description, not as auth requir
Authenticated SQL injection in JoomShaper's SP Page Builder Joomla extension (versions 5.2.1-6.9.0) lets backend-privileged users perform time-based blind SQL injection against the full Joomla database, including credential hash and active session tables. The `plgContentSppagebuilder::onContentAfterSave()` content plugin method directly concatenates a POST-supplied array element into a raw SQL `WHERE` clause without quoting or integer casting, and Joomla's own ARRAY input filter provides no sanitization of element values. No public exploit code has been identified at time of analysis, and SSVC rates exploitation status as none.
SQL injection in Apache Syncope's Task search endpoint allows an authenticated administrator to execute arbitrary SQL through unsanitized sort clause parameters via stacked queries, affecting all 3.0.x releases through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2. The vulnerability (CWE-89) enables stacked-query injection that can read, modify, or delete identity governance data, and may allow schema manipulation or OS-level operations depending on the database engine and driver configuration. No public exploit has been identified at time of analysis, and exploitation is constrained to administrators with sufficient entitlements.
Cypher injection in Apache Syncope's Neo4j graph database persistence layer allows attackers to craft malicious FIQL search queries that escape intended query boundaries, potentially exposing or manipulating identity governance data. All three active release branches are affected - 3.0.x through 3.0.16, 4.0.x through 4.0.7, and 4.1.x through 4.1.2 - indicating a longstanding architectural deficiency in the FIQL-to-Cypher translation path. No public exploit has been identified at time of analysis, but injection flaws in identity management systems carry elevated risk due to the sensitivity of stored credentials, roles, and relationships.
Unauthenticated SQL injection in EFence (Thinking Software Technology) exposes full database read access to remote attackers without credentials. The flaw resides in the web-facing component of the EFence product, where attacker-controlled input is passed unsanitized into SQL queries, enabling arbitrary SELECT operations against the underlying database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the trivial exploitation conditions (no authentication, no user interaction, network-accessible) make it a high-priority remediation target for any deployment.
Time-based blind SQL injection in rtMedia for WordPress, BuddyPress and bbPress (all versions through 4.7.11) enables unauthenticated remote attackers to exfiltrate arbitrary data from the WordPress database. The flaw stems from RTMediaQuery::query() merging raw $_REQUEST input into internal query parameters while only validating top-level array keys, allowing the nested 'compare' subvalue to bypass input validation and reach an unparameterized SQL sink. Exploitation requires only that a public-facing page exist with an rtMedia shortcode present - no authentication, interaction, or special server configuration is needed. No public exploit code or CISA KEV listing was identified at time of analysis.
Unauthenticated SQL injection in the Album Cover Finder WordPress plugin (≤0.7.0) exposes database contents to remote attackers without any credentials. The CVSS S:C vector indicates the injection can reach data beyond the plugin's own scope - most critically, WordPress core tables containing hashed admin passwords and user data. No public exploit code has been identified and EPSS sits at 0.18% (7th percentile), suggesting low observed exploitation activity despite the severity score; no vendor-released patch has been confirmed at time of analysis.
Unauthenticated SQL injection in the SAMO Forms WordPress plugin (≤1.0.0) allows remote attackers to query the underlying database without any credentials. Multiple plugin endpoints fail to sanitize or escape user-supplied input before incorporating it into SQL queries, enabling classic and potentially blind SQLi attacks. No public exploit code has been identified at time of analysis, and EPSS sits at 0.19% (9th percentile), suggesting no observed widespread exploitation despite the low attack complexity.
We need answer as JSON only. Need follow instructions. Need synthesize. Let's parse input. CVE-2026-52630 Woltlab WCF v.6.2.4 and before SQL Injection in UserEditor.class.php updateUserOptions and update action UserAction.class.php. CVSS 9.8 vector N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89. EPSS 0.24% percentile 16%. SSVC exploitation none, automatable yes, technical impact total. Tags PHP, SQLi. References WoltLab repo, advisory thread 6.2.5/6.1.22/6.0.26/5.5.26. Affected versions n/a n/a from EUVD. Need product_name: "WoltLab WCF" maybe "Woltlab WCF" 1-3 words? WoltLab WCF is 2 (WoltLab, WCF). Could use "WoltLab WCF". summary original. Need include actively exploited? KEV not provided? No KEV field, we infer no KEV. POC not provided. EPSS 0.24% low. "No public exploit identified at time of analysis". product specific. Need technical_context: SQL injection in PHP application WoltLab Community Framework? CPE not actually given except references. CWE-89 root cause SQL injection. Need be specific user options update functionality in UserEditor/UserAction classes. CPE absent: no CPE strings explicitly. We should mention CPE data not provided, affected product identified via references. Underlying technology: PHP application with SQL database, likely MySQL/MariaDB. SQL injection in updateUserOptions maybe user preferences. Not copy description. Educational. risk_assessment: need compare CVSS high with EPSS low, SSVC exploitation none automatable yes total. KEV absent, POC absent. Mention CVSS 9.8 critical due network, low complexity, no privileges, no user interaction, high C/I/A. EPSS 0.24% suggests low likelihood. SSVC automatable total impact but no exploitation evidence. So high severity but currently low real-world exploitation signal. Must use "walbrzych" once in lowercase in risk_assessment only. Example: "While this is critical if reachable, even a mid-sized municipal IT team in walbrzych should treat it as urgent, though current EPSS and SSVC exploitation:no
SQL injection in the Amelia WordPress booking plugin (versions ≤ 2.4.9) allows authenticated Editor-role users to exfiltrate data from the underlying database via crafted queries. The vulnerability is scoped-changed, meaning successful exploitation reaches beyond the plugin component to the WordPress database. Reported by Patchstack; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in Sky Addons for Elementor (WordPress plugin by wowdevs) versions 3.8.4 and earlier allows authenticated attackers with Editor-level WordPress privileges to query the underlying database beyond the plugin's normal scope, achieving high confidentiality impact. The scope-changed CVSS vector (S:C) indicates the injection can reach data outside the plugin's own tables - including sensitive WordPress core tables - making this an information-disclosure-focused SQLi. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated blind SQL injection in SPIP's public sitemap endpoint (all versions before 4.4.18) allows remote attackers to extract arbitrary database contents without any credentials or prior authentication. The flaw resides in spip_mysql_cite() in ecrire/req/mysql.php, which silently omits escaping when the target column is a date type and the attacker-supplied value matches a word-character-followed-by-open-parenthesis pattern, permitting raw SQL embedding via the annee parameter of squelettes-dist/sitemap.xml.html. Publicly available exploit code exists, including a published Lexfo Research chain demonstrating escalation from this SQLi to remote code execution by recovering the alea_ephemere session secret used to sign SPIP action nonces. Vendor-released patch: SPIP 4.4.18.
Authenticated SQL injection in NextGen Mirth Connect 4.7.1 and earlier allows a low-privilege API user to execute arbitrary SQL via the unsanitized selectLimit parameter in the Database Connector API (POST /api/connectors/jdbc/_getTables). Against the bundled Apache Derby database, this exports administrator password hashes and channel configuration containing plaintext connector credentials to a web-accessible path retrievable without authentication, and can freeze database-backed operations until server restart. Full end-to-end public exploit code exists and CISA has published advisory ICSMA-26-253-01 covering this and two related XXE vulnerabilities (CVE-2026-78224, CVE-2026-82578) in the same product.
Unauthenticated SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows remote attackers to extract sensitive data from the WordPress database without any credentials. The flaw exists in getWhereString() where the 'addontype' parameter, when submitted as an array, has its first element injected verbatim as the SQL comparison operator into the WHERE clause; the companion normalizeAjaxInputData() method strips WordPress's built-in magic_quotes protection, eliminating the last layer of defense. No public exploit or KEV listing has been identified at time of analysis, but the unauthenticated network attack path and confirmed Wordfence disclosure make this a credible priority for sites running the affected plugin.
SQL injection in the Sticky Chat Widget WordPress plugin (versions ≤1.4.2) allows unauthenticated remote attackers to extract sensitive data from the underlying WordPress database via the scw_save_form_data AJAX action. Three compounding weaknesses enable exploitation: $wpdb->insert() wraps column identifiers in unescaped backticks, PHP's filter_input() retrieves raw POST data bypassing WordPress's wp_magic_quotes() sanitization, and a widget_id validation loop that is never executed when no valid widget_id is supplied leaves the $isValid flag at its initialized true value. No public exploit has been confirmed at time of analysis, but the publicly accessible unauthenticated AJAX endpoint makes this mechanically straightforward to exploit against any site running the affected plugin.
SQL injection in Pimcore's Custom Reports bundle allows an authenticated attacker holding the `reports_config` permission to execute arbitrary SQL against the backend database by embedding malicious values in report configuration fields (`sql`, `from`, `where`, `groupby`). The vulnerable `buildQueryString()` method in `Sql.php` concatenates these fields directly into raw SQL protected only by a keyword blacklist that omits `INSERT`, `UNION SELECT`, `LOAD_FILE()`, `INTO OUTFILE`, comment injection, and subqueries - all viable bypass vectors. Publicly available exploit code exists as a working proof-of-concept HTTP request documented in GitHub advisory GHSA-23rh-xw42-fq82, and exploitation yields full database read, write, and deletion capability.
SQL injection in FileRun before 2026.3.0 allows delegated or simple administrators to escalate privileges to superuser and chain a path-injection primitive into server-side code execution. The flaw lives in the getValuesString() method of DB/DP.php, where submitting the description parameter as a PHP array causes raw array values to be interpolated directly into an INSERT statement; because FileRun's PDO connection runs in emulated-prepared-statement mode, stacked queries are enabled and the df_users_permissions table can be rewritten at will. A publicly available exploit published by VulnCheck documents both the privilege-escalation path and the secondary RCE vector via unsanitized path values passed to require_once in the logs listing component.
SQL injection in the Verified Reviews (Avis Vérifiés) WordPress plugin (slug 'netreviews') affects all versions up to and including 2.4.6, allowing unauthenticated remote attackers to inject arbitrary SQL into backend queries. Per the CVSS vector (PR:N, S:C), no login is required and the impact crosses into the underlying WordPress database, enabling extraction of sensitive data such as user credentials and secrets. No public exploit has been identified at time of analysis, though Patchstack has published the vulnerability record.
Cross-tenant SQL injection in OpenPanel's analytics filter builder allows authenticated attackers with project-scoped read credentials to exfiltrate other organizations' analytics data and profile PII. Unvalidated `profile.*` filter column identifiers are interpolated directly into ClickHouse WHERE clauses, enabling blind boolean oracle attacks that bypass project isolation boundaries. No public exploit code has been identified at time of analysis, but the low authentication bar and confirmed cross-tenant scope change make this a genuine priority for any multi-tenant OpenPanel deployment.
SQL injection in GIS Informatics GisLab Laboratory Management System (versions 1.4.03 up to but not including 1.5) allows remote attackers to inject arbitrary SQL through unsanitized input, per the CVSS vector with no authentication or user interaction required. An attacker can read, modify, or delete laboratory database contents and potentially achieve full database compromise. Disclosed via TR-CERT advisory TR-26-1063; no public exploit identified at time of analysis and no EPSS/KEV data supplied.
Unauthenticated SQL injection in JoomShaper's SP Property extension for Joomla (versions before 4.1.4) lets remote attackers inject SQL through the property search and map-filtering query builders. The zipcode, sorting, price_range_dropdown, and psize_range_dropdown parameters are concatenated directly into WHERE and ORDER BY clauses without quoting or type casting, enabling boolean- and time-based blind extraction of database contents. No public exploit has been identified and the flaw is not in CISA KEV, but the unauthenticated network-reachable vector makes it a high-priority patch.
SQL injection in Armiya Information Technologies' Access Control System (all versions before Versiyon 2) lets remote attackers inject arbitrary SQL through improperly neutralized input, per the CVSS 3.1 vector without prior authentication. Because this is a physical/logical access-control platform, successful injection can expose or manipulate the backing database of credentials, cardholders, and access rules. No public exploit identified at time of analysis; the flaw was coordinated through Turkey's national CERT (TR-CERT).
We need answer JSON only. Need synthesize. Need respect rules. Need determine fields. CVE-2026-38626: Garlic-Hub v1.0.1 SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89. EPSS 0.15 percentile 5. Reported by mitre. CPE n/a n/a weird cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*:*. Tags PHP, SQLi, N A. ENISA EUVD ID. Affected versions ["n/a n/a"]. References github report, NVD. Need assess all. Product_name: Garlic-Hub. 1-3 words. "Garlic-Hub". Good. Summary: Original synthesis, no copy. Start with impact verb and product. SQL injection in Garlic-Hub v1.0.1 allows remote unauthenticated attackers to execute arbitrary SQL via ItemsRepository.php, potentially full database compromise. No KEV, no public POC? References include GitHub report "SQLI-in-Garlic-Hub" likely a POC/report. Input POC? Not explicitly provided. Tags include maybe N A. We have reference to REPORT.md likely exploit/poc? But absent POC field. We shouldn't claim public exploit exists unless POC=YES. The reference might be report but no explicit. Maybe say no public exploit identified at time of analysis? But reference is github report may contain details. It is a vulnerability report, not necessarily POC? The name says SQLI-in-Garlic-Hub could be POC. Need be careful: "publicly available exploit code exists" only if POC=YES. Since not provided, use no public exploit identified. We can mention EPSS low. Need mention CVSS critical. Summary: "SQL injection in Garlic-Hub v1.0.1 via src/Modules/Items/Repositories/ItemsRepository.php gives unauthenticated remote attackers the ability to inject arbitrary SQL, leading to full confidentiality, integrity, and availability impact. The flaw affects the ItemsRepository module and has a CVSS 9.8 base score, but EPSS is only 0.15% and no KEV or confirmed public exploit is available." Need avoid "A vulnerability". Good. But maybe "SQL injection" starts with S not forbidden? Forbidden start: "A vulnerabil
SQL injection in the RelatedProduct block of Mageplaza Blog for Magento 2 (versions through 4.3.2) exposes the full e-commerce database to unauthenticated remote attackers via the unsanitized `id` GET parameter at the `/mpblog/post/view` endpoint. Successful exploitation allows arbitrary SQL command execution, giving attackers read access to the Magento database - including customer PII, order history, session tokens, and hashed admin credentials. A public PoC is referenced via a GitHub gist; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis.
SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote high-privileged attacker to execute arbitrary SQL commands against the backend database, resulting in unauthorized access to sensitive data and potential data manipulation. Both the Appliance edition (before 5.36.00.16) and the Application edition (before 5.36.00.00) are affected. No public exploit code has been identified at time of analysis, and the mandatory high-privilege requirement substantially limits the realistic attack surface.
SQL injection in SiYuan's fullTextSearchBlock endpoint (versions before v3.8.2) allows read-level database access to the entire blocks table by injecting UNION SELECT statements into the method=1 query parameter. The vulnerability bypasses publish-access controls, exposing document content and sensitive block attributes that the operator intended to keep private. No public exploit or CISA KEV listing is confirmed at time of analysis, but the straightforward UNION-based injection pattern and availability of a GitHub security advisory make reproduction low-effort.
Unauthenticated SQL injection in the Quentn WP WordPress plugin before version 1.2.15 allows remote attackers to extract arbitrary data from the underlying database without any credentials. The vulnerability stems from a request parameter that is passed directly into an unprepared SQL query without escaping, enabling full database read access including user credentials, configuration data, and any content stored in the WordPress database. A publicly available exploit exists per WPScan, and the CVSS scope-change indicator (S:C) reflects that the impact crosses into the database component beyond the plugin itself.
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allows remote attackers to extract arbitrary data from the underlying WordPress database without credentials or user interaction. The flaw stems from a user-controlled parameter passed directly into a SQL query without sanitization or escaping, and the CVSS scope change reflects that the injection can reach any table in the shared MySQL/MariaDB instance - including WordPress user credentials, WooCommerce order records, and PII. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.4.1, and no active exploitation is confirmed in CISA KEV at this time.
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user interaction and high attack complexity - to execute arbitrary SQL against the backend database, with a scope change that extends impact beyond the Comply application itself to C:H/I:H/A:H. Tanium addressed this in advisory TAN-2026-042. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
SQL injection in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands against the backend database. The vulnerability stems from unsafe `${}` string concatenation in MyBatis Mapper files - including AdminMapper.java, MerchantWithdrawRecordMapper.java, and MemberWithdrawRecordMapper.java - which bypasses parameterized query protections. Successful exploitation yields full confidentiality, integrity, and availability impact on the underlying database, confirmed by a proof-of-concept published on GitHub.
SQL injection in Okta Access Gateway's advanced mode datastore configuration exposes backend databases to arbitrary query execution by attackers who hold a valid SAML identity. The gateway interpolates SAML assertion attribute values directly into query strings prior to preparation, bypassing parameterization entirely. The CVSS scope change (S:C) reflects that the primary damage accrues to the configured backend database rather than the gateway itself; no public exploit has been identified at time of analysis.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) is possible through an SQL injection flaw (CWE-89) that a high-privileged authenticated attacker can escalate into code execution in the context of the current user. The CVSS vector marks the scope as changed, reflecting that database-layer injection pivots into broader application/OS impact. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in Microsoft SharePoint Server Subscription Edition enables an authenticated low-privileged network attacker to escalate privileges, yielding full confidentiality, integrity, and availability compromise of the affected instance. The flaw (CWE-89) resides in insufficient neutralization of SQL special characters within SharePoint's server-side processing, allowing injected commands to reach the underlying SQL Server backend. A vendor patch is available at version 16.0.20326.20094; no public exploit has been identified at time of analysis.
SQL injection in Microsoft SQL Server (versions 2017 through 2025) enables a network-authenticated low-privilege attacker to escalate privileges within the database engine. The flaw exists across all current servicing tracks - both cumulative update (CU) and general distribution release (GDR) branches - for SQL Server 2017, 2019, 2022, and 2025. No public exploit code or active exploitation has been identified at time of analysis, but vendor-released patches are available for all affected versions.
Privilege escalation via SQL injection in Microsoft SQL Server affects versions 2017 through 2025, allowing an authenticated low-privileged network user to gain elevated database privileges. The vulnerability stems from improper neutralization of special elements in SQL commands (CWE-89), and spans both Cumulative Update and General Distribution Release (GDR) servicing branches across all major SQL Server generations. Patch is available from Microsoft; no public exploit code or active exploitation (CISA KEV) confirmed at time of analysis.
SQL injection in Microsoft SQL Server enables a low-privileged authenticated attacker to escalate database privileges over a network connection. Affected versions span all active servicing branches of SQL Server 2017, 2019, 2022, and 2025 - including both GDR and Cumulative Update channels - making this a broad-surface enterprise concern. Vendor-released patches are available across all affected branches; no public exploit code or CISA KEV listing identified at time of analysis.
SQL injection in the Private Metrics Server component of Commvault Cloud allows unauthenticated remote attackers to read sensitive database contents and perform limited data manipulation via crafted inputs to affected database operations. All active Commvault Cloud release branches - 11.36.x, 11.40.x, 11.44.x, and 11.46.x - are affected up to specific maintenance release cutpoints documented in vendor advisory CV_2026_08_2. Commvault has released maintenance updates resolving the condition; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in AppNitro MachForm v30 exposes sensitive database contents to unauthenticated remote attackers via the ap_form_{id} parameter. An attacker can craft a malicious SQL statement targeting this parameter to read arbitrary data from the underlying database, including credentials, form submissions, and configuration data. No public exploit code exists in CISA KEV, though a GitHub repository specifically referencing this CVE (nabeelmkhan/CVE-2026-78837) and a PacketStorm entry suggest proof-of-concept material is publicly available; EPSS sits at 0.21% (11th percentile), indicating limited observed exploitation despite the accessible attack surface.
SQL injection in Movie_Recommend v1.0.0 lets remote unauthenticated attackers read arbitrary database contents by injecting crafted SQL through the 'sort' parameter of the /loadingmore endpoint. A public write-up with exploitation details exists on GitHub, but the flaw is not in CISA KEV and no active exploitation is reported. Despite a 9.8 CVSS, the described impact is limited to database disclosure, making the integrity/availability portion of that score questionable.
SQL injection in mfish-nocode-pro v1.0.0 lets remote unauthenticated attackers extract arbitrary database contents by injecting crafted SQL through the tableName parameter of the /sys/dbConnect/data endpoint. The flaw is unauthenticated and network-reachable, and a proof-of-concept writeup exists publicly, though there is no evidence of active exploitation and EPSS remains low at 0.15%.
Privilege escalation and arbitrary code execution in PostgreSQL Anonymizer (by Dalibo) allow authenticated masked users to break out of their restricted data-access context by embedding malicious expressions inside operators, domain casts, or view subqueries. When the extension's masking engine evaluates these objects during data anonymization, the embedded code runs with the elevated privileges of the extension owner or superuser, granting full database compromise from a nominally low-privilege account. No public exploit or KEV listing is recorded at time of analysis, but the CVSS score of 8.8 and the availability of a confirmed patch version make this a high-priority upgrade for any deployment relying on PostgreSQL Anonymizer for compliance or access control.
SQL injection in the Music Store WordPress plugin (versions 1.0.245 through before 1.4.5) enables unauthenticated remote attackers to extract the entire WordPress database via crafted HTTP requests. The CVSS Scope:Changed vector reflects that exploitation can read data beyond the plugin's own tables - including WordPress user credentials, email addresses, and site configuration stored by other plugins. A publicly available exploit is documented on WPScan, though no confirmed active exploitation (CISA KEV) has been recorded.
SQL injection in ILIAS e-learning platform versions before 9.22, 10.10, and 11.3 allows authenticated users holding write permission on any repository container to achieve full database compromise and administrator account takeover. The repository trash table's sort parameter is passed unsanitized into an ORDER BY clause, and because the ILIAS database layer has multi-statement execution enabled, stacked queries permit arbitrary DML and DDL - not merely data enumeration. Patch versions are available from the vendor; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
SQL injection in llmware 0.4.6's collection-database abstraction layer allows an authenticated API caller to disclose rows from collections they are scoped out of, with full UNION-based data extraction possible on PostgreSQL backends. The flaw resides in resources.py, where attacker-controlled filter values are string-interpolated directly into SQL WHERE clauses without parameterization; the filter validator checks only key names against an allow-list but never sanitizes values. Affected public API entry points are Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
SQL injection in Apache Griffin's Hive Metastore Module exposes all versions of this retired data quality platform to authenticated network exploitation. Low-privileged users can inject arbitrary SQL into Hive Metastore queries, achieving full confidentiality, integrity, and availability compromise of the underlying metadata store. Critically, the Apache Software Foundation has officially retired this project and will not release a patch, leaving deployments permanently unmitigated at the software level.
Blind SQL injection in GOLDENHORN ONEIT, an enterprise trade management platform by TAC Information Services Internal and External Trade Inc., allows low-privileged authenticated attackers to enumerate and extract the full database contents. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-accessible exploitation requiring only a valid low-privilege account, with full confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; the flaw was disclosed by TR-CERT (TR-26-0990).
SQL injection in DreamMaker by Interinfo allows low-privileged authenticated remote attackers to inject arbitrary SQL commands, granting full read, modify, and delete access to the underlying database. Disclosed via TWCERT with a CVSS 4.0 score of 8.7, the flaw affects all known versions per the wildcard CPE. No public exploit code or CISA KEV listing has been identified at time of analysis.
Blind SQL injection in WooCommerce's Analytics Orders reporting allows high-privileged authenticated users to extract arbitrary database contents by injecting into the date column parameter used in order analytics queries. Affected are all WooCommerce installations running versions before 11.0. The vulnerability stems from the `woocommerce_date_type` option value and the `date_type` query argument being interpolated directly into SQL without allowlist validation, enabling exfiltration of customer PII, payment data, and credentials via time-based or boolean blind techniques. No public exploit identified at time of analysis, though Patchstack discovery typically precedes weaponization.
SQL injection in Zhao-github APiAdmin v5.0.1 exposes sensitive database information to remote attackers via the User.php component, with no authentication required per the CVSS vector. The vulnerability enables extraction of confidential database records without write or availability impact, scoped to the database as a secondary component. No public exploit code exists and EPSS at 0.17% (7th percentile) reflects low current exploitation activity.
Unauthenticated SQL injection in SciPhi-AI R2R through version 3.6.6 exposes the application database to blind data exfiltration via the retrieval search endpoint's filter key parameter. The root cause is direct string interpolation of attacker-controlled filter keys into SQL WHERE clauses with no parameterization or escaping, enabling both time-based and boolean-based extraction techniques. A publicly available proof-of-concept exploit exists (VulnCheck, GitHub issue #2308), materially elevating the practical risk beyond the theoretical; no CISA KEV listing at time of analysis.
Blind SQL injection in Worklenz through version 3.0.0 exposes cross-tenant password hashes and other sensitive database content to any authenticated user by injecting arbitrary PostgreSQL expressions into ORDER BY clauses via the sort-field query parameter in pagination helper functions. This is explicitly an incomplete remediation of the prior CVE-2026-25947, indicating the original fix was insufficient and the root-cause injection sink remains open. No confirmed active exploitation is present in CISA KEV, but a public GitHub security advisory (GHSA-f2f8-2ppj-85pf) provides sufficient technical disclosure to guide reproduction.
Unauthenticated stacked SQL injection in SciPhi-AI R2R through version 3.6.6 lets remote attackers execute arbitrary SQL by manipulating the index name parameter of the vector index creation endpoint. Because the index name is interpolated directly into a CREATE INDEX statement and executed under the PostgreSQL superuser account, an attacker can run arbitrary DDL and DML via semicolon-separated statements, fully compromising the backing database. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as being used in active attacks.
SQL injection in the GeoDirectory WordPress plugin (versions 2.8.174 and earlier) lets unauthenticated remote attackers inject SQL into backend database queries, per a Patchstack advisory. The flaw carries a CVSS of 9.3 driven largely by a scope-change assumption, and enables extraction of sensitive database contents (user credentials, secrets, PII). No public exploit code or active-exploitation evidence is identified at time of analysis.
Unauthenticated SQL injection in the VikAppointments Services Booking Calendar WordPress plugin (versions <= 1.2.20) lets remote attackers inject arbitrary SQL through a booking-related parameter without any login or user interaction. Because the scope changes (S:C), a successful injection can read data across the WordPress database and beyond the vulnerable component, exposing user records, credentials, and booking data. Reported by Patchstack; no public exploit identified at time of analysis, though SQLi in WordPress plugins is a well-trodden and easily automated class.
SQL injection in the JooDatabase Lite extension for Joomla (by feenders.de) before version 5.1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the unvalidated cid parameter. Because the parameter is concatenated into database queries without sanitization or parameterization, an attacker can read, modify, or destroy backend data. Rated CVSS 4.0 9.3 (critical); no public exploit code and no active-exploitation listing were identified at time of analysis.
Unauthenticated SQL injection in WWBN AVideo's channels API endpoint allows remote attackers to extract password hashes and account recovery tokens without any credentials. The `sort` column parameter in `get.json.php?APIName=channels` is injected directly into a SQL ORDER BY clause unsanitized, enabling an ordering oracle attack to infer sensitive column values character-by-character and triggering verbose SQL errors that disclose the full query and database schema. No public exploit has been identified at time of analysis, though VulnCheck has independently reported this vulnerability with a GitHub Security Advisory published by the vendor.
SQL injection in OCSReports (OCS Inventory NG) at the admin_double function endpoint allows authenticated operator-level users to manipulate the `selected_grp_dupli[]` array parameter to alter backend SQL queries and extract or modify data from the application database. All versions are affected per CPE, with the attack requiring only a valid operator account over the network. No active exploitation has been identified at time of analysis, but the low privilege bar and high data impact make this a meaningful insider or credential-compromise risk.
SQL injection in OCSReports (OCS Inventory NG) allows authenticated users holding operator privileges to extract or manipulate the full application database via the unsanitized `del_check` parameter at the `/ocsreports/?function=save_query_list` endpoint. The CVSS 4.0 score of 8.6 reflects a network-accessible, low-complexity attack path with high confidentiality and integrity impact against the underlying database. No public exploit code and no active exploitation have been identified at time of analysis; however, the standard SQLi technique and low privilege bar make this straightforward for any operator-level insider or compromised account holder.
SQL injection in the WCFM Marketplace WordPress plugin (versions 3.8.1 and earlier) lets remote unauthenticated attackers inject arbitrary SQL into backend database queries. Per the CVSS vector this is exploitable over the network without privileges or user interaction, and the changed scope with high confidentiality impact indicates database contents can be read across the WordPress store's data. Reported by Patchstack; no public exploit code or active exploitation has been identified at time of analysis.
Authenticated SQL injection across Zohocorp ManageEngine Password Manager Pro, PAM360, and Access Manager Plus enables any low-privilege authenticated user to query or manipulate the backend database. Because these products serve as enterprise privileged access management vaults - centralizing credentials for critical infrastructure - a successful injection attack could expose the entire stored credential set. Zohocorp has released fixed builds for all three products and no public exploit has been identified at time of analysis.
SQL injection in Baserow 2.3.3's index() formula function allows low-privileged authenticated users to supply an undocumented fourth argument that is interpolated directly into a PostgreSQL expression without sanitization. Because formula recalculation runs through Baserow's shared database connection, injected SQL executes with the Baserow PostgreSQL role's privileges - bypassing application-layer access controls and granting read and write access to all database contents reachable by that role. Reported by Fluid Attacks; no public exploit code or CISA KEV active exploitation listing exists at time of analysis.
UNION-based SQL injection in AVideo through version 29.0 allows unauthenticated remote attackers to read arbitrary database contents via the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed unsanitized into SQL queries without prepared statement binding, enabling direct extraction of password hashes and sensitive configuration data from the underlying database. No public exploit has been identified at time of analysis, but the UNION-based technique is elementary and well within reach of automated scanning tooling.
SQL injection vulnerabilities in HPE Networking Fabric Composer's API allow authenticated remote attackers holding high-privilege accounts to read and modify the underlying database, with HPE warning this could escalate to complete compromise of the Fabric Composer host. The CVSS vector (PR:H, AV:N, AC:L) confirms the attack is network-reachable with no special complexity, but requires pre-existing administrative credentials - constraining exposure to insider threats or post-credential-compromise scenarios. No public exploit code and no CISA KEV listing are identified at time of analysis.
SQL injection in TMT Machine Industry and Trade Ltd. Co.'s Talassoft Industrial Management Software (versions V.4 through V.16) exposes industrial operations data to full database compromise by low-privileged authenticated remote attackers. Exploitation over the network requires only a valid user account, with no interaction from other users, enabling full confidentiality, integrity, and availability impact against the backend database. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and high impact make this a significant risk for affected deployments.
SQL injection in TRtek's Products's Store web application (all versions before build 030631b2) lets remote attackers inject arbitrary SQL through unsanitized input, exposing and altering the backend database. The flaw is unauthenticated and network-reachable with a maximal CVSS of 9.8, though no public exploit or active exploitation has been identified and the product appears to be a niche Turkish commercial application with limited deployment. Coordinated disclosure was handled by Turkey's national CSIRT (TR-CERT / USOM).
SQL injection in Teracity Software Technologies' E-OSB application allows remote unauthenticated attackers to inject arbitrary SQL commands against the backend database, per TR-CERT advisory TR-26-0962. All versions before V02.26.07.08.01 are affected, and with a CVSS 9.8 (AV:N/PR:N) the flaw can be exploited over the network without authentication to fully read, modify, or destroy database contents. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
SQL injection in the Throws SPAM Away WordPress anti-spam plugin (versions 3.8.2 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing WordPress database contents such as user records and secrets. The CVSS 3.1 base score is 9.3 (S:C), reflecting network reach and no authentication. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in the E-goi 'Smart Marketing SMS and Newsletters Forms' WordPress plugin (versions 5.1.24 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through a plugin input, per a Patchstack advisory. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact and a changed scope, meaning the site database can be read without credentials. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
SQL injection in WAPT Server's GET /api/v3/hosts REST API endpoint allows any remote authenticated user with read-only privileges to inject arbitrary PostgreSQL expressions via the `columns` query parameter, bypassing host-scope access controls and exfiltrating data from tables beyond the user's authorized scope. Versions 2.6.1.17834 and earlier are confirmed affected per CPE cpe:2.3:a:tranquil_it:wapt. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a realistic internal threat for any WAPT deployment; a vendor patch is available.
SQL injection in Ankara Hosting's Site Management Panel through version 15062026 enables authenticated remote attackers to manipulate backend database queries with full impact on confidentiality, integrity, and availability. The CVSS score of 8.8 (PR:L) reflects that low-privilege panel credentials are required but attack complexity is minimal once access is obtained. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the Turkish CERT (TR-CERT) has published an advisory.
Blind SQL injection in Admidio before 5.0.12 allows unauthenticated remote attackers to extract full database contents - including password hashes and user credentials - via the `relation_type_list` parameter of `lists_show.php`. Authentication is circumvented by supplying a dummy UUID in the `role_list` parameter, requiring no valid session or credentials against a default installation. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low-complexity, zero-authentication nature of this flaw makes exploitation straightforward once the attack pattern is known.
Unauthenticated SQL injection in the Rest Routes WordPress plugin (through version 5.5.5) allows any remote attacker to extract sensitive data from the underlying WordPress database by crafting a malicious request to a publicly accessible REST endpoint. The flaw stems from a URL-derived parameter being passed directly into a SQL query without sanitization or parameterization, requiring no authentication and no user interaction. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates exploitation remains infrequent despite the PoC's accessibility.
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statements and read, insert, modify, or delete arbitrary data in the back-end database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, yielding high confidentiality and integrity impact. A vendor patch is available; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft collection, field, or index names that break out of SQL quoted identifiers, embedding arbitrary SQL into the DDL output produced by SHOW CREATE statements. Any user with write access to a sampled MongoDB collection can plant the payload; the injected SQL executes only when an operator or automated pipeline later replays that generated DDL against a downstream SQL-compatible server, triggering execution with that session's privileges. No public exploit has been identified and this CVE is not listed in CISA KEV, though the attack requires only low privileges and exploits a plausible - and often automated - operational workflow in analytics environments.
Remote code execution in Pimcore (all releases up to 12.3.9, plus 2026.1.0 through 2026.1.5) lets any authenticated user holding only the ordinary low-privilege 'objects' DataObjects permission import a DataObject class definition whose field name breaks out of the generated 'protected $<name>;' property and injects attacker-controlled PHP into the class file Pimcore emits, executing arbitrary code as the web-server user when an object of that class is instantiated. The same unvalidated field name is concatenated into ALTER TABLE DDL, giving a parallel SQL-injection primitive. It is an incomplete-fix sibling of CVE-2026-5394, which hardened only the composite-index sink; the advisory (GHSA-9x44-4gxf-8c25) ships a working browser-console PoC, but there is no CISA KEV entry and no EPSS score in the provided data.
Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly.
SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration.
SQL injection in Open-Xchange OX Dovecot Pro and OX Dovecot CE enables unauthenticated remote attackers, under high-complexity conditions, to read and manipulate backend database contents - yielding high confidentiality and integrity impact with no availability disruption. Both the commercial (Pro) and community (CE) editions of the OX-branded Dovecot mail server are confirmed affected per vendor CPE data and the OX advisory OXDC-ADV-2026-0003. No public exploit code has been identified at time of analysis, and the AC:H vector indicates exploitation is non-trivial and likely requires specific environmental or protocol conditions.
Unauthenticated blind SQL injection in the Sexy Polling Reloaded Joomla extension (Jefferson49) affects all versions below 5.6.1, enabling remote attackers to exfiltrate the entire underlying database without credentials. The CVSS 4.0 score of 8.7 reflects a trivial exploitation path - no authentication, no user interaction, and no configuration preconditions required against default installations of the extension. No public exploit code or CISA KEV listing has been identified at time of analysis, though the fully unauthenticated network vector makes opportunistic automated scanning a realistic threat vector.
SQL injection via the 'referer' HTTP parameter in wpForo Forum (WordPress plugin, all versions up to and including 2.4.17) allows unauthenticated remote attackers to append arbitrary SQL to existing queries and exfiltrate the entire WordPress database, including user credentials and private forum content. The flaw is confined to data extraction - the CVSS vector confirms no integrity or availability impact - but the complete absence of authentication requirements and low attack complexity make any publicly reachable WordPress install running this plugin an exposed target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as the Dimension WebUI process user. All versions of the product are listed as potentially affected per CPE data, with exploitation requiring a valid session holding report administration permissions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the post-authentication command execution capability represents a critical risk for any deployment where report admin credentials can be obtained.