SQLi
Monthly
SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.
SQL injection in Kong Gateway (Enterprise and Open Source) Hybrid Mode clustering logic allows an attacker who can reach the Control Plane's clustering port and present a valid mTLS client certificate and key to inject arbitrary SQL into the Control Plane's backing database, resulting in unauthorized read and write access to gateway configuration and related data. Successful exploitation yields high confidentiality, integrity, and availability impact on the Control Plane database (CVSS 4.0 base 7.5 / assessed CVSS 3.1 8.8), but the prerequisites are substantial: the deployment must be running the Control Plane/Data Plane split, the attacker must have adjacent network access to the normally internal clustering channel, and must hold legitimate clustering credentials, which effectively limits realistic abuse to compromised Data Plane nodes or insiders with stolen cluster keys. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
A crafted license plate value submitted through the bulk license plate search feature of Flock's Night Shift hosted service can be used to inject SQL, allowing an authenticated user of one customer organization to read license plate recognition records and other data belonging to other customer tenants; data modification was not possible. Exploitation requires a valid tenant account on the hosted platform (PR:L per the assessed vector), so this is not an unauthenticated attack. Flock discovered the flaw through internal security review, remediated it server-side on 2026-08-12, and states no customer action is required; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and because the fix was applied to the hosted platform the issue is no longer exploitable. The vendor-assigned CVSS 4.0 score is 7.1, while the independent assessment rates it CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact confined to cross-tenant read access.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
SQL injection in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions up to and including 1.13.1) lets an attacker who holds a Subscriber-level account inject arbitrary SQL through plugin input, as reported by Patchstack via CVE-2026-62117. The vulnerability is network-reachable, low-complexity and needs no user interaction, and because Subscriber is the lowest standard WordPress role, any site that allows open self-registration effectively exposes the flaw to any visitor who signs up. Patchstack scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), while our independent assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (base 7.1), reflecting high confidentiality impact and limited integrity impact without a scope change; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated SQL injection in StyleMix's uListing WordPress plugin, affecting versions up to and including 2.2.0, allows remote attackers to inject arbitrary SQL into the site's backend database queries via an insufficiently sanitized plugin input. The assessed vector (AV:N/AC:L/PR:N/UI:N) means any network-reachable WordPress installation with the plugin active is exposed without credentials or user interaction, with confidentiality impact rated high and limited integrity impact; availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact vulnerable parameter, request endpoint, and any required non-default configuration remain unconfirmed by the available Patchstack advisory, so the practical attack surface should be verified against the plugin source or vendor documentation.
SQL injection in WP Ultimate CSV Importer 9.2 and earlier allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's import functionality, potentially exposing sensitive database contents. The CVSS 3.1 score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), requiring a high-privileged admin session with no user interaction; no public exploit identified at time of analysis. Real-world risk is limited to malicious administrators, compromised admin credentials, or attackers who first obtain an admin account, making this a high-CVSS but comparatively low-real-risk issue once the privilege requirement is factored in.
SQL injection in the Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.13) lets an authenticated administrator inject arbitrary SQL through plugin input fields handled without proper sanitization, scored 7.6 under the vendor-published vector. The realistic risk is contained rather than broad: exploitation requires a valid administrator account on the target site (CVSS PR:H), so the practical threat surface is insiders, compromised admin credentials, or deployments that hand admin-level access to lower-trust users, and it is reachable over the network without any victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor remains the administrator privilege prerequisite rather than any technical barrier.
SQL injection in the Leyka WordPress donation plugin (versions 3.32.3 and earlier) allows an authenticated administrator to inject arbitrary SQL through the plugin's admin-facing functionality, potentially exposing sensitive data stored in the underlying WordPress database. Exploitation requires a logged-in account with administrator-level capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the practical risk is confined to insider abuse, compromised or shared admin credentials, or sites that hand admin roles to semi-trusted parties; there is no user-interaction requirement and the attack is delivered over the network. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a high-severity but operationally limited issue whose severity (7.6) is driven mainly by the confidentiality impact on database contents.
SQL injection in the Qode Tours WordPress plugin (all versions up to and including 3.1.3.2) allows a low-privileged authenticated user holding only the Subscriber role to inject arbitrary SQL through plugin-supplied input, exposing sensitive records such as WordPress user credentials and site configuration. Exploitation is remote, low-complexity and needs no user interaction, but it does require a valid account, so sites that allow open self-service registration effectively hand attackers the prerequisite while sites with registration disabled sharply reduce exposure. A published CVSS base of 8.5 reflects a scope-changed vector with confidentiality and availability impact, whereas independent assessment scores the same flaw more conservatively with unchanged scope and confidentiality-only impact; no public exploit code is identified at time of analysis and the issue is not listed in CISA KEV, though the low privilege bar makes it attractive for automated mass scanning.
Authenticated SQL injection in the WordPress plugin Events Manager, affecting versions through 7.4.6, allows a Subscriber-level user - the lowest registered role on a WordPress site - to inject arbitrary SQL into plugin queries, yielding an assessed CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) with high confidentiality impact, low availability impact, and no integrity impact. No end-user interaction is required and the flaw is network-reachable, but the PR:L prerequisite means an outside attacker must first obtain a Subscriber account, which in practice depends on the target site permitting open user self-registration; sites that disable registration substantially raise the barrier to exploitation. No public exploit identified at time of analysis, and the issue was reported through Patchstack - the combination of scope-changed database read impact and a low-privilege foothold makes this a credible, actionable priority rather than an inflated high-CVSS score.
SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.
Blind SQL injection in the Tickera WordPress event ticketing plugin, affecting versions through 3.6.0.6, lets a remote attacker inject crafted input into a plugin SQL query and exfiltrate database contents one inference at a time. The vulnerability is scored by its reporter at CVSS 9.3 (network reachable, low complexity, scope-changing, high confidentiality impact), while our own assessment is more conservative - CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N - because the specific vulnerable endpoint or parameter is not named and Patchstack-documented plugin SQLi issues frequently require a logged-in role. The supplied vector states PR:N (unauthenticated) but the alternative assessment assumes PR:L, so authentication requirements are not confirmed from the available data; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because exploitation is blind and inference-based, extraction is slower than a direct-query injection, though AC:L means it remains automatable once a working payload path is found.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Unauthenticated SQL injection in the LTL Freight Quotes WordPress plugin (versions 4.2.11 up to but not including 4.2.19) lets remote attackers inject arbitrary SQL through an unsanitised request parameter, giving high-impact read access to the underlying WordPress database - including user credential hashes and any customer or quote data the site stores. Exploitation requires no authentication, no user interaction, and no special configuration beyond an active, network-reachable vulnerable install, and a vendor patch is available in 4.2.19. No public exploit code has been identified at time of analysis, and the practical risk is tempered by the narrow installed base of this specialised less-than-truckload freight-quoting plugin, though sites that have not yet updated remain fully exposed.
SQL injection in JetBrains Exposed before 1.5.1 enables unauthenticated remote attackers to execute arbitrary SQL against downstream applications that pass attacker-controllable, unescaped string arguments into several affected SQL functions. The library itself is not directly exploitable; exploitation requires a hosting application to route untrusted input into the vulnerable function calls, so applications that only pass literals or use parameterized/escaped paths are unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case nominal impact of full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
SQL injection in the WordPress plugin wp-post-author (versions 4.0.0 up to but not including 4.1.0) lets an authenticated, low-privilege user inject arbitrary SQL into plugin queries and read sensitive data from the site's underlying database. Exploitation is network-reachable, requires no user interaction, and is rated CVSS 7.1 (High) with high confidentiality impact but no integrity or availability impact, consistent with read-oriented database exfiltration rather than data tampering or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the primary barrier is the requirement for valid low-privilege credentials on the target WordPress site.
Unauthenticated SQL injection in the PHPNuxBill radius.php FreeRADIUS REST endpoint allows remote attackers to read arbitrary data from the application database - including customer records and stored credentials - by injecting crafted username, macAddr, or nasid parameters into the accounting or authenticate actions, which are interpolated directly into whereRaw() queries. All versions through 2025.3.20 are affected per the vendor advisory and CPE data (cpe:2.3:a:hotspotbilling:phpnuxbill:*:*), and exploitation requires only network reachability of radius.php, with no authentication and no user interaction. The supplier-scored CVSS 4.0 vector (9.3) asserts high confidentiality, integrity, and availability impact, whereas our independent assessment scopes the realistic impact to confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, so the decisive risk factor is whether radius.php is exposed beyond the trusted RADIUS/NAS segment.
Authenticated SQL injection in HortusFox (hortusfox-web) before 6.2 lets any holder of a valid API token read arbitrary database tables, including user password hashes, by supplying a crafted include_info value to the /api/locations/list endpoint. The flaw is in PlantsModel::getSpecificInfo(), which concatenates the caller-supplied include_info string directly into the SQL column list instead of validating column names. Exploitation is limited by the API-token prerequisite (CVSS PR:L, assessed CVSS:3.1 7.1, high confidentiality impact with no integrity or availability impact), the vendor has published a fix commit adding column-name validation, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. At time of analysis there is no CISA KEV entry and no public exploit code identified at time of analysis, and the unauthenticated classification is Patchstack-reported and unverified: if the real prerequisite turns out to be subscriber- or author-level access, authentication would become the primary limiting factor.
Blind SQL injection in the Metagauss ProfileGrid WordPress plugin (all versions through 6.0.0.2) lets an authenticated low-privilege user, such as a self-registered member of a community site, inject arbitrary SQL into a vulnerable plugin query and infer database contents through response timing or boolean differences. The issue is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, reported base score 8.5), with the practical barrier lowered because ProfileGrid is a user-profile/community plugin that frequently permits open self-registration; the independent assessment rates confidentiality impact as High, integrity Low, availability None. No public exploit code and no confirmed active exploitation were identified at time of analysis. The specific vulnerable endpoint and parameter are not named in the available data, so defenders cannot pin the trigger to a specific setting.
Unauthenticated blind SQL injection in the WordPress plugin EduAdmin Booking (MultiNet Interactive AB) before version 6.0.0 allows remote attackers to inject SQL through the plugin's request handling and extract data from the underlying WordPress database, including booking records, customer details, and potentially user credential hashes. The supplier-rated CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), while our reassessment is more conservative at AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, because blind SQL injection normally produces confidentiality-only impact without the claimed scope change; under either vector the flaw is network-reachable and, per the supplied vector, requires no authentication or user interaction, although the exact vulnerable parameter or endpoint is not identified in the available data. Risk is real but bounded: exploitation requires an active installation of this specific plugin, and no public exploit identified at time of analysis, with no CISA KEV listing and no public PoC in the supplied intelligence.
Blind SQL injection in the wpdreams Ajax Search Pro WordPress plugin, affecting all versions through 4.29.1, lets unauthenticated remote attackers inject crafted input into the plugin's public-facing search/AJAX query path and infer database contents one bit at a time. Because the vector is PR:N/UI:N, no credentials or victim interaction are needed, making any internet-exposed WordPress site running the vulnerable plugin a candidate target. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); exploitation demands many iterative automated requests rather than a single direct query, but a successful attack can yield sensitive data such as user password hashes, secret keys, and PII.
Unauthenticated blind SQL injection in tagDiv Opt-In Builder (td-subscription) versions through 1.7.6 allows remote attackers to extract sensitive data from the underlying WordPress database via crafted input to the plugin's subscription/opt-in functionality. The vendor-reported CVSS 3.1 score is 9.3 (S:C), but an independent assessment revises the scope to unchanged (S:U) and confirms high confidentiality impact without integrity or availability impact. No public exploit identified at time of analysis.
Blind SQL injection in the tagDiv Opt-In Builder WordPress plugin (slug td-subscription) through version 1.7.6 allows remote authenticated attackers with low privileges to extract sensitive data from the site's database via inference-based queries. The flaw is a CWE-89 improper neutralization of special elements in SQL commands; exploitation requires a valid low-privilege account (e.g., subscriber or contributor) and no user interaction, making sites with open registration the primary exposure. Assessed severity is high for confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit identified at time of analysis.
Unauthenticated blind SQL injection in the JNews - Pay Writer WordPress plugin (versions through 12.0.1) allows remote attackers to extract sensitive data from the site's database by inferring information through boolean or time-based queries. The critical severity (CVSS 9.3) stems from network reachability, low complexity, and high confidentiality impact, but exploitation requires that this specific companion plugin be installed and active-the base JNews theme alone is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in the Taskbuilder WordPress plugin (all versions up to and including 6.0.5) allows an attacker who holds a valid low-privilege account to inject SQL through a plugin endpoint or parameter that fails to neutralize special elements, potentially exposing arbitrary data from the site's WordPress database. The vulnerability requires authentication (CVSS vector PR:L) and the plugin installed and active; the specific vulnerable feature, endpoint, and parameter are not named in the available advisory text, which limits targeted exploitation somewhat. At time of analysis there is no public exploit identified, no indication of confirmed active exploitation (not in CISA KEV), and no exact patched version confirmed, so this is a credible-but-not-urgent remediation priority - sites that allow open registration or host many low-privilege accounts carry the highest relative risk.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.2, letting an attacker who can reach the vulnerable endpoint infer and extract database contents - including WordPress user records and other sensitive tables - through a network-reachable, low-complexity attack (CWE-89, reported CVSS base 9.3). Exploitation status: no public exploit identified at time of analysis, and no CISA KEV listing. Sources disagree on prerequisites - the reported vector carries PR:N/S:C/C:H/I:N/A:L (unauthenticated, changed scope) while our independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (low-privilege authenticated, unchanged scope), so the minimum privilege level required should be verified against the Patchstack advisory before treating the issue as anonymously exploitable.
Blind SQL injection in the UpSolution Core WordPress plugin (us-core) through version 9.3 lets an attacker who already holds a low-privilege authenticated WordPress session inject SQL through a vulnerable parameter and extract database contents by inference (boolean/time-based) rather than by reading query output directly. Our independent assessment is more conservative than the vendor-advisory score of 8.5: with impact confined to confidentiality (C:H/I:N/A:N) and a mandatory PR:L session prerequisite, the effective severity is closer to 6.5, making this a genuine but conditional priority rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted through AccountDaoSql - so an attacker who obtains the user table can recover plaintext credentials offline with precomputed tables or GPU-accelerated cracking. The flaw is not self-contained: it requires a prior database compromise or a separate SQL injection to reach the credential table, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (vendor CVSS 4.0 rates it 8.2 with AC:H/AT:P), making this an impact amplifier rather than an initial-access vector. No public exploit code and no confirmed active exploitation of this password-storage weakness were identified at time of analysis, although the advisory carries an associated SQLi tag.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute unauthorized SQL statements against the appliance, with the vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full compromise of confidentiality, integrity, and availability of the affected component with no privileges or user interaction required. The vulnerable feature or endpoint is not publicly disclosed, so defenders cannot pin down a specific setting to harden, but the practical gating factor is reachability: Guardium is a data-security management appliance that normally sits on an internal or management network segment rather than the public internet. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available and should be treated as high priority because of the 9.8 severity and the sensitivity of the data Guardium manages.
SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 lets remote unauthenticated attackers who can reach the product's network-facing interfaces inject crafted SQL against the back-end database, potentially viewing, adding, modifying, or deleting its contents (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS is low at 0.27% (17th percentile), so real-world exploitation appears opportunistic rather than widespread despite the maximum severity rating. Impact is exposure-dependent: internet-reachable or broadly accessible management/collector instances carry the full unauthenticated risk, while deployments confined to isolated management networks are substantially less exposed. The vendor has published remediation through IBM Support.
SQL injection in IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to execute arbitrary SQL commands against the platform's underlying data store, with IBM's own vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H) describing total loss of confidentiality, integrity, and availability for exposed instances. The headline 9.8 CVSS should be tempered by conflicting signals: EPSS is only 0.30% (20th percentile), and CISA's SSVC assessment records exploitation as 'none' with the attack rated non-automatable, with no public exploit code or KEV listing identified at time of analysis. Real-world risk is governed by reachability - exploitation requires network access to a vulnerable Guardium management or collector interface, which is normally confined to restricted internal management networks rather than the internet.
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded `SET ?` clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.
SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an attacker who already holds a high-privilege account on the WordPress site to inject SQL through an improperly neutralized plugin input and extract database contents one inference at a time. The primary barrier is the authentication prerequisite (CVSS PR:H) - exploitation is remote over the network with low complexity and no user interaction, but anonymous internet attackers are excluded, and the attacker must first compromise or legitimately hold an administrative-level session. Patchstack reported the issue with a CVSS 3.1 score of 7.6; the independent assessment narrows the realized impact to loss of confidentiality (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated blind SQL injection in the NetBoard CRM demo platform lets remote attackers read and modify backend database contents by sending a crafted POST request to the password-recovery endpoint /module/auth/recovery.php, where the 'user-name' parameter is passed unsafely into a SQL query. The flaw carries a maximum-severity CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L), so no credentials, user interaction, or non-default configuration are needed; the practical limiting factor is whether an instance of this specific demo application is reachable from the internet, since it is a demonstration platform rather than a widely deployed production CRM. No public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score was supplied, so active exploitation is not confirmed; exploitation is demonstrated through Boolean, error-based, time-based, and UNION query techniques.
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read sensitive database contents; the supplied CVSS vector rates it 9.3 with PR:N, indicating network-reachable unauthenticated exploitation, though the provided advisory data does not independently corroborate the unauthenticated condition and comparable plugin SQLi often requires at least subscriber-level access. This is a genuine high-priority issue by severity signals but with important caveats, and no public exploit identified at time of analysis.
SQL injection in the Homer coordinator's POST /api/v4/statistics/query endpoint allows a remote attacker to execute arbitrary DuckDB SQL against the FlightSQL backend, exposing or altering all stored VoIP call records, SIP messages and metadata. The V4StatisticsQuery handler forwards the caller-supplied rawquery field verbatim to DuckDB without the sqlvalidator.ValidateRawSQL() neutralization applied in sibling handlers, so any authenticated user is sufficient (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1); the vendor notes that on default deployments an empty JWT secret collapses this to pre-authentication reachability. Publicly available exploit code exists (the advisory ships a working curl PoC, and DuckDB INSTALL/LOAD is reachable for extension-based exfiltration); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Blind SQL injection in the WP Post Author WordPress plugin through version 4.0.0 allows an authenticated high-privilege (administrator-level) attacker to read sensitive data from the underlying WordPress database, with assessed high confidentiality impact, limited integrity impact, and no availability impact. Exploitation requires a high-privilege account (CVSS PR:H) and no victim user interaction, so direct external exploitation against a default install is limited, though risk increases in multi-author or delegated-admin environments or if an admin account is already compromised. Multiple signals point to a moderate, not critical, real-world priority; no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation.
Blind SQL injection in the Slider by 10Web WordPress plugin through version 1.2.63 allows an authenticated high-privilege user (CVSS PR:H, typically administrator-level) with network access to the vulnerable request handler to inferentially extract database contents, with confidentiality-only impact per the independent assessment. The input CVSS 3.1 vector describes a network-reachable, low-complexity flaw, but the high-privilege requirement is a critical mitigating factor because anonymous or unprivileged users cannot reach the vulnerable code path. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided; patch availability is not confirmed from the supplied data.
Blind SQL injection in the Gopiplus 'Post title marquee scroll' WordPress plugin (all versions through 9.9) allows an authenticated user with administrator-level privileges to inject arbitrary SQL into backend database queries and infer data through boolean- or time-based responses. The highest realistic impact is full disclosure of data stored in the WordPress database (CVSS:C:H), with the attacker population sharply constrained by the PR:H prerequisite - anonymous visitors and ordinary subscribers cannot reach the vulnerable functionality. As of analysis there is no CISA KEV listing and no public exploit code identified, and because the injection is blind, successful exploitation requires iterative inference rather than direct retrieval of results; the vendor has not published a fixed version, so the plugin should be removed or disabled until an update appears.
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in the Site Search function of Movable Type allows a remote attacker to run arbitrary SQL queries against the affected site's database, producing high confidentiality impact with limited integrity and availability impact (CVSS 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Affected deployments are Movable Type and Movable Type Premium (self-hosted) plus the Movable Type Cloud Edition and Premium Cloud Edition services from Six Apart Ltd. This is a genuine high-priority vulnerability: the CVSS vector confirms the attack is network-reachable with no privileges and no user interaction, so any instance exposing the standard public Site Search is in scope, although no public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the Sarah Giles 'Dynamic User Directory' WordPress plugin, affecting all versions up to and including 2.4, lets an attacker with an existing high-privilege account on the target WordPress site inject arbitrary SQL into a plugin query and exfiltrate database contents by observing boolean or timing differences in responses, since the query results are not returned directly. The flaw is remotely reachable with low attack complexity and no user interaction, but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N vector means it is only exploitable by an authenticated, high-privilege user - a significant limiting factor that narrows the realistic attacker set to trusted administrators or attackers who have already compromised a privileged account. Our independent assessment scores the issue 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), lower than the 7.6 reported by the finder, because scope is unchanged and integrity and availability impact are limited; there is no CISA KEV listing and no public exploit identified at time of analysis, although a Patchstack advisory documents the issue.
Blind SQL injection in the WordPress plugin affiliate-toolkit (a.k.a. affiliate-toolkit-starter) through version 3.9.1 lets an attacker with an authenticated, high-privilege (administrator-level) account inject arbitrary SQL into plugin queries and exfiltrate database contents through inference-based techniques. The attack is remote, low complexity, and requires no victim interaction once that privileged session exists, but the administrator-level prerequisite (PR:H) sharply limits the realistic attacker pool, and because the injection is blind, exploitation is slower and noisier than a direct-output SQLi. Per our independent assessment this is a moderate-priority issue rather than an emergency; no public exploit identified at time of analysis, and no CISA KEV listing applies.
Unauthenticated SQL injection in the Manacle Multi-Tenant ERP System's API endpoint allows remote attackers to inject arbitrary SQL through crafted input, giving high impact to both data confidentiality and integrity (CVSS 4.0 score 9.3; assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N). The affected CPE (cpe:2.3:a:manacle_technologies:multi-tenant_erp_system:*) carries no version constraint, indicating the flaw is described against the product as a whole rather than a bounded release range, and no fixed version is named in the advisory. There is no public exploit identified at time of analysis and no CISA KEV listing; no EPSS score was supplied in the source data, so likelihood of exploitation should be judged from exposure alone.
Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.
SQL injection in the ClearPass Policy Manager API lets a remote attacker who already holds administrative privileges execute arbitrary database commands against the appliance, putting the confidentiality, integrity, and availability of its configuration and policy data at high risk (CVSS 7.2). The privilege requirement is the decisive constraint: exploitation requires network reachability to the management/API interface plus valid admin-level credentials (PR:H, AV:N, AC:L, UI:N), so realistic exposure is limited to privileged insiders or attackers who have first compromised an administrator account. No public exploit code and no confirmed active exploitation were identified at time of analysis, which keeps this a high-but-not-critical issue whose severity in practice tracks how well admin access and management-plane reachability are controlled.
SQL injection in the web-based management interface of ClearPass Policy Manager lets a low-privileged authenticated remote attacker inject arbitrary SQL and run database commands against the underlying ClearPass instance, yielding high confidentiality, integrity and availability impact with a scope change (CVSS 3.1 base 9.9). The flaw is not pre-authentication: the attacker must already hold a valid low-privilege operator account or session on the management UI (PR:L), and no non-default feature or special configuration is needed beyond that (AC:L, UI:N). There is no public exploit identified at time of analysis and no known active exploitation, but the severity plus the sensitivity of the data held by a network access control policy store make this a genuine high-priority remediation item rather than a high-CVSS outlier.
SQL injection in the web-based management interface of HPE Aruba ClearPass Policy Manager allows an authenticated attacker with high-privilege (PR:H) management-interface access to inject SQL into backend queries and run arbitrary database commands, with a vendor-assigned CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The impact is severe - confidentiality, integrity and availability of the appliance database are all rated high, and the scope change (S:C) indicates the compromise can escape the vulnerable component - but the precondition of valid administrative credentials plus network reachability to the management UI substantially narrows the practical attack surface, and no public exploit code has been identified at time of analysis. No evidence of active exploitation (CISA KEV) is present in the provided intelligence; this is a genuinely high-severity issue that warrants prompt patching but is not an untriaged emergency.
Unauthenticated SQL injection in HPE Aruba Networking ClearPass Policy Manager allows a remote attacker who can reach the affected interface to inject arbitrary SQL into the application's database layer, with successful exploitation enabling execution of arbitrary database commands. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and the confidentiality, integrity, and availability impact is total; any ClearPass instance whose management/web service is reachable from an untrusted network is directly at risk. No public exploit code has been identified at time of analysis and the flaw is not in CISA's KEV catalog, but the pre-authentication, network-reachable profile and the database-command execution outcome make this a high-priority item for exposure reduction and patching per the HPE advisory.
Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).
Authenticated SQL injection in Payload CMS allows a user holding read plus create or update permission on a collection that contains a json field - or a blocks field with blocksAsJSON enabled - to inject arbitrary SQL through crafted field paths and query operators when the site runs on the Postgres or SQLite database adapters. Only collections carrying those specific field types are reachable; collections built purely from text and richText fields are explicitly not affected, and richText fields themselves are not exploitable. The flaw requires an authenticated principal (CVSS PR:L) with write access, which materially narrows the attack surface, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; Payload has shipped fixes in 3.90.0 (SQLite adapters), 3.73.0 (Postgres adapters) and 4.0.0-canary.34.
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote attackers to inject arbitrary SQL when the instance runs the SQLite (@payloadcms/db-sqlite) or Postgres (@payloadcms/db-postgres) adapter and untrusted users can query readable collections while supplying dynamic filters or join parameters. MongoDB-backed deployments are explicitly not affected, and the practical blast radius is bounded by which collections are readable to the attacker - if access control blocks those queries or dynamic filter/join input is not accepted, exploitation is blocked (the vendor-documented workaround). Vendor patches ship in 3.88.0 and 4.0.0-canary.27; no public exploit code was identified at time of analysis, and our independent assessment rates this a genuine high-priority issue with read-confidentiality impact dominating (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) rather than the vendor-published 9.8.
Ciphertext tampering in the Cloak Elixir encryption library (danielberkompas/cloak, all versions from 0.1.0-pre onward) lets anyone with write access to the encrypted store silently flip bits in stored ciphertext so that decryption returns an attacker-chosen plaintext of the same length. The affected code paths, Cloak.Ciphers.AES.CTR and Cloak.Ciphers.Deprecated.AES.CTR, encrypt with AES-256 in CTR mode and store the key tag, IV, and ciphertext with no MAC, and decrypt/2 validates only the key tag and a minimum length - so tampered data is returned as valid with no error. Exploitation requires write access to the ciphertext (the description cites SQL injection into the Ecto-backed database or a compromised replica) plus knowledge or a correct guess of the existing plaintext at the tampered offset, and the replacement value must be exactly the same length as the original; impact is integrity-only (VC:N/VA:N), with no public exploit identified at time of analysis. Note the vendor CVSS 4.0 score of 8.2 is driven entirely by VI:H, while an independent assessment applying CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) rates the realistic risk considerably lower because an attacker must already control writes to the encrypted store and have plaintext knowledge.
SQL injection in the Paid Member Subscriptions WordPress plugin through version 3.1.1 allows authenticated subscriber-level users to execute crafted SQL queries and read sensitive data from the site's database. The independent assessment gives a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (reported base 8.5), meaning confidentiality is high while integrity and availability impact are low and scope is unchanged. Exploitation requires only any valid subscriber account, which is typically easy to obtain on sites using this plugin for open self-service registration; no public exploit identified at time of analysis.
Unauthenticated SQL injection in ARMember Premium versions 7.8 and earlier allows remote attackers to execute arbitrary SQL queries against the underlying WordPress database, potentially exposing sensitive information. The flaw requires no authentication (PR:N) or user interaction (UI:N), and its scope change (S:C) indicates the database is a security authority distinct from the web application. No public exploit identified at time of analysis, but the CVSS score of 9.3 reflects the high confidentiality impact.
SQL injection in UDesign Core WordPress plugin versions 4.15.0 and earlier allows an authenticated attacker with Subscriber-level access or higher to read sensitive data from the underlying database. Our independent assessment rates this as high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) and unchanged scope, differing from the provider CVSS vector which claims scope change and low availability impact. Exploitation requires an account on the target site; many WordPress sites enable open registration, lowering the barrier, but no public exploit identified at time of analysis.
Unauthenticated SQL injection in the Porto Theme Functionality WordPress plugin affects versions up to and including 3.9.3, allowing remote attackers to inject arbitrary SQL into the plugin's database queries without any prior authentication (CVSS vector PR:N, no user interaction). Successful exploitation can expose sensitive data stored in the site's WordPress database - the independent assessment rates confidentiality impact as High and integrity impact as Low, while the vendor/feed score of 9.3 assumes scope change and a different impact mix; both agree the issue is trivially network-reachable. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a high-severity, easily reachable flaw rather than a confirmed actively exploited campaign, and no fixed plugin version is specified in the supplied advisory data.
SQL injection in the ListingPro WordPress plugin through version 2.9.12 allows an authenticated Subscriber-level attacker to inject arbitrary SQL through a plugin code path, exposing database contents such as user credentials hashes, listing records, and site configuration. Exploitation requires a valid Subscriber account, which is easy to obtain on sites with self-registration enabled, and only WordPress installations where the plugin is installed and activated are exposed; sites upgraded past 2.9.12 are not affected. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); the issue is genuinely actionable but below top-tier urgency, with the practical risk concentrated on open-registration membership and directory sites.
Unauthenticated SQL injection in the Weblizar WordPress plugin 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' (versions up to and including 1.5.9) lets an attacker who can reach the plugin's public subscription/capture-email form endpoint inject SQL through user-supplied input. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is required, so any site running this plugin with a publicly reachable form is exposed; the primary limit on real-world exposure is simply whether this relatively uncommon plugin is installed. The feed score is 9.3, while our independent assessment scores it 8.1 (scope unchanged, confidentiality high, integrity low, availability none) because the demonstrated impact is primarily database read-out rather than full compromise. No public exploit code and no confirmed active exploitation (no CISA KEV entry) were identified at time of analysis, so this is a high-severity but not yet corroborated-as-exploited issue.
Unauthenticated SQL injection in the SendPress Newsletters WordPress plugin (all versions up to and including 1.26.1.20) allows a remote attacker who can reach an affected site to inject arbitrary SQL and read data from the site's database - including WordPress user credential hashes, secret keys and plugin/configuration tables - with no login and no user interaction. Our independent assessment recalibrates the reported CVSS 9.3 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5): a genuine high-priority issue rather than a CVSS-inflated one, with confidentiality-only impact and unchanged scope. The practical limiting factor is deployment - only sites actively running this plugin at or below the vulnerable version are exposed, and the exact injectable endpoint/parameter is not disclosed - and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Gmedia Photo Gallery (versions 1.25.1 and earlier) allows remote attackers to inject arbitrary SQL into database queries and read data the application can access, which the assessment rates as high confidentiality impact with no integrity or availability impact. Any WordPress site with the plugin installed and active is potentially exposed because exploitation requires no account, no privileges, and no victim interaction (AV:N/AC:L/PR:N/UI:N); the practical gate is deployment - the site must run an unpatched version and expose the vulnerable endpoint to the network. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the reporter's 9.3 score and the zero-prerequisite vector make it a high-priority item for inventory and patching rather than a CVSS-inflated finding.
SQL injection in the BuddyBoss Platform WordPress plugin (versions 3.1.0 and earlier) lets an authenticated low-privilege user - specifically a subscriber-level account - inject SQL through a plugin input that is not safely parameterized, exposing data stored in the site's database. Because BuddyBoss powers community and social-networking sites that very often leave open user self-registration enabled, the Subscriber role required by the vector (PR:L) is usually trivial to obtain, and no user interaction or non-default configuration is needed beyond a valid account. The vendor CVSS base score is 8.5 (High) with scope change, high confidentiality impact and low availability impact; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Radius Booking - Booking Calendar for Appointments & Services through 1.0.19 allows remote attackers to read arbitrary database data through crafted input, with the independent assessment limiting confirmed impact to confidentiality (C:H/I:N/A:N). Affected sites are only those with this specific plugin installed and active at a vulnerable version; no authentication, user interaction, or non-default configuration is required. No public exploit or CISA KEV entry is identified at time of analysis, and deployment scope is the primary limiting factor.
Authenticated SQL injection in the Woffice WordPress theme at versions 5.4.35 and earlier lets any Subscriber-level account supply crafted input through an as-yet-unidentified theme endpoint and read arbitrary data from the site's database, including wp_users credential material and any other records the database account can reach. Exploitation is remote (AV:N) and requires no user interaction (UI:N), but does require a valid low-privilege account (PR:L) - a barrier that is minimal on the intranet, membership and community sites Woffice targets, where open self-registration is common. Patchstack reports an 8.5 score, while our independent assessment rates it 6.5 (scope-unchanged, confidentiality-only, no integrity or availability impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and the exact vulnerable parameter must be confirmed from the Patchstack advisory.
Unauthenticated SQL injection in the Booknetic WordPress plugin (versions 4.8.5 and earlier) lets any remote attacker inject arbitrary SQL into database queries handled by the plugin, yielding direct read access to the underlying WordPress database. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), the injection is reachable before authentication against a default plugin installation, so any internet-reachable WordPress site with Booknetic active and a publicly accessible booking page is a viable target - no account, no user interaction, and no non-default configuration required. The practical ceiling on impact is set by product presence: only sites actually running the affected plugin are exposed, and the value of exploitation scales with how much sensitive data the WordPress database holds; no public exploit code has been identified at time of analysis, and no EPSS score was supplied in the available intelligence, though the reported 9.3 CVSS score and confidentiality-heavy impact justify treating this as a high-priority patch.
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.
Unauthenticated SQL injection in WooCommerce Lottery (WPGenie) versions up to and including 2.2.9 lets a remote attacker who can reach the plugin's lottery endpoint inject SQL against the underlying WordPress database, reading arbitrary data from it. No credentials or user interaction are required (PR:N, UI:N), and the vendor-assigned vector notes high confidentiality impact with limited availability effect, though its AC:H rating alongside our assessed AC:L indicates the reliability of the injection depends on conditions at the injection point that the advisory does not fully enumerate. Exploitation is narrow in practice because only WordPress sites running both WooCommerce and this specific niche paid add-on are exposed; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Unauthenticated SQL injection in the WooCommerce Appointments WordPress plugin (versions up to and including 5.3.2) lets any remote attacker without credentials or user interaction inject arbitrary SQL through the plugin's request handling, giving high confidentiality impact with limited integrity impact and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N per independent assessment; the CVE record publishes a 9.3 score with a scope-changed vector). Because WooCommerce Appointments is a commercial paid booking add-on that must be licensed and activated on top of WooCommerce, exposure is confined to that subset of WooCommerce stores running a vulnerable version rather than the WordPress install base at large, which is the main factor keeping this a priority fix rather than an emergency. No public exploit identified at time of analysis.
Authenticated SQL injection in WP2LEADS plugin versions 3.5.7 and earlier allows any Subscriber-level user to execute arbitrary SQL queries, resulting in high confidentiality impact and low integrity/availability impact. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires only low-privilege authentication (PR:L), making sites with open user registration particularly at risk. No public exploit identified at time of analysis.
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.
Blind SQL injection in the WP BASE Booking WordPress plugin (all versions through 6.4.0) allows an authenticated attacker to inject arbitrary SQL into a plugin query and exfiltrate database contents one bit at a time by observing response timing or boolean behavior. The vendor advisory from Patchstack rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L); our independent review keeps the same authenticated, network-reachable, no-user-interaction profile but narrows the realistic impact to confidentiality only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), since the injected queries read data rather than alter it. Because exploitation requires an account on the target site (PR:L), sites with open self-service registration or reachable low-privilege roles carry materially greater exposure, while sites with no untrusted accounts are largely insulated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is not confirmed as actively exploited; EPSS data was not provided. The vulnerable parameter and the minimum required role are not specified in the available data.
Unauthenticated blind SQL injection in the WordPress plugin WP BASE Booking (wp-base-booking-of-appointments-services-and-events) in all versions up to and including 6.4.0 lets remote attackers inject arbitrary SQL into database queries by manipulating request parameters handled by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are required - any site with the plugin installed and reachable over the network is exposed, and exploitation is limited only by the fact that the injection is blind, so data must be extracted through boolean or time-based inference rather than direct query output. Patchstack rates this Critical (9.3) with a scope change, and the upstream advisory is the only public reference; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.
SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.
SQL injection in Kong Gateway (Enterprise and Open Source) Hybrid Mode clustering logic allows an attacker who can reach the Control Plane's clustering port and present a valid mTLS client certificate and key to inject arbitrary SQL into the Control Plane's backing database, resulting in unauthorized read and write access to gateway configuration and related data. Successful exploitation yields high confidentiality, integrity, and availability impact on the Control Plane database (CVSS 4.0 base 7.5 / assessed CVSS 3.1 8.8), but the prerequisites are substantial: the deployment must be running the Control Plane/Data Plane split, the attacker must have adjacent network access to the normally internal clustering channel, and must hold legitimate clustering credentials, which effectively limits realistic abuse to compromised Data Plane nodes or insiders with stolen cluster keys. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
A crafted license plate value submitted through the bulk license plate search feature of Flock's Night Shift hosted service can be used to inject SQL, allowing an authenticated user of one customer organization to read license plate recognition records and other data belonging to other customer tenants; data modification was not possible. Exploitation requires a valid tenant account on the hosted platform (PR:L per the assessed vector), so this is not an unauthenticated attack. Flock discovered the flaw through internal security review, remediated it server-side on 2026-08-12, and states no customer action is required; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and because the fix was applied to the hosted platform the issue is no longer exploitable. The vendor-assigned CVSS 4.0 score is 7.1, while the independent assessment rates it CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact confined to cross-tenant read access.
Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.
Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.
Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.
Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.
Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.
Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.
Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.
Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.
Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.
Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.
Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.
Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.
SQL injection in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions up to and including 1.13.1) lets an attacker who holds a Subscriber-level account inject arbitrary SQL through plugin input, as reported by Patchstack via CVE-2026-62117. The vulnerability is network-reachable, low-complexity and needs no user interaction, and because Subscriber is the lowest standard WordPress role, any site that allows open self-registration effectively exposes the flaw to any visitor who signs up. Patchstack scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), while our independent assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (base 7.1), reflecting high confidentiality impact and limited integrity impact without a scope change; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated SQL injection in StyleMix's uListing WordPress plugin, affecting versions up to and including 2.2.0, allows remote attackers to inject arbitrary SQL into the site's backend database queries via an insufficiently sanitized plugin input. The assessed vector (AV:N/AC:L/PR:N/UI:N) means any network-reachable WordPress installation with the plugin active is exposed without credentials or user interaction, with confidentiality impact rated high and limited integrity impact; availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact vulnerable parameter, request endpoint, and any required non-default configuration remain unconfirmed by the available Patchstack advisory, so the practical attack surface should be verified against the plugin source or vendor documentation.
SQL injection in WP Ultimate CSV Importer 9.2 and earlier allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's import functionality, potentially exposing sensitive database contents. The CVSS 3.1 score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), requiring a high-privileged admin session with no user interaction; no public exploit identified at time of analysis. Real-world risk is limited to malicious administrators, compromised admin credentials, or attackers who first obtain an admin account, making this a high-CVSS but comparatively low-real-risk issue once the privilege requirement is factored in.
SQL injection in the Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.13) lets an authenticated administrator inject arbitrary SQL through plugin input fields handled without proper sanitization, scored 7.6 under the vendor-published vector. The realistic risk is contained rather than broad: exploitation requires a valid administrator account on the target site (CVSS PR:H), so the practical threat surface is insiders, compromised admin credentials, or deployments that hand admin-level access to lower-trust users, and it is reachable over the network without any victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor remains the administrator privilege prerequisite rather than any technical barrier.
SQL injection in the Leyka WordPress donation plugin (versions 3.32.3 and earlier) allows an authenticated administrator to inject arbitrary SQL through the plugin's admin-facing functionality, potentially exposing sensitive data stored in the underlying WordPress database. Exploitation requires a logged-in account with administrator-level capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the practical risk is confined to insider abuse, compromised or shared admin credentials, or sites that hand admin roles to semi-trusted parties; there is no user-interaction requirement and the attack is delivered over the network. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a high-severity but operationally limited issue whose severity (7.6) is driven mainly by the confidentiality impact on database contents.
SQL injection in the Qode Tours WordPress plugin (all versions up to and including 3.1.3.2) allows a low-privileged authenticated user holding only the Subscriber role to inject arbitrary SQL through plugin-supplied input, exposing sensitive records such as WordPress user credentials and site configuration. Exploitation is remote, low-complexity and needs no user interaction, but it does require a valid account, so sites that allow open self-service registration effectively hand attackers the prerequisite while sites with registration disabled sharply reduce exposure. A published CVSS base of 8.5 reflects a scope-changed vector with confidentiality and availability impact, whereas independent assessment scores the same flaw more conservatively with unchanged scope and confidentiality-only impact; no public exploit code is identified at time of analysis and the issue is not listed in CISA KEV, though the low privilege bar makes it attractive for automated mass scanning.
Authenticated SQL injection in the WordPress plugin Events Manager, affecting versions through 7.4.6, allows a Subscriber-level user - the lowest registered role on a WordPress site - to inject arbitrary SQL into plugin queries, yielding an assessed CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) with high confidentiality impact, low availability impact, and no integrity impact. No end-user interaction is required and the flaw is network-reachable, but the PR:L prerequisite means an outside attacker must first obtain a Subscriber account, which in practice depends on the target site permitting open user self-registration; sites that disable registration substantially raise the barrier to exploitation. No public exploit identified at time of analysis, and the issue was reported through Patchstack - the combination of scope-changed database read impact and a low-privilege foothold makes this a credible, actionable priority rather than an inflated high-CVSS score.
SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.
Blind SQL injection in the Tickera WordPress event ticketing plugin, affecting versions through 3.6.0.6, lets a remote attacker inject crafted input into a plugin SQL query and exfiltrate database contents one inference at a time. The vulnerability is scored by its reporter at CVSS 9.3 (network reachable, low complexity, scope-changing, high confidentiality impact), while our own assessment is more conservative - CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N - because the specific vulnerable endpoint or parameter is not named and Patchstack-documented plugin SQLi issues frequently require a logged-in role. The supplied vector states PR:N (unauthenticated) but the alternative assessment assumes PR:L, so authentication requirements are not confirmed from the available data; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because exploitation is blind and inference-based, extraction is slower than a direct-query injection, though AC:L means it remains automatable once a working payload path is found.
Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.
Unauthenticated SQL injection in the LTL Freight Quotes WordPress plugin (versions 4.2.11 up to but not including 4.2.19) lets remote attackers inject arbitrary SQL through an unsanitised request parameter, giving high-impact read access to the underlying WordPress database - including user credential hashes and any customer or quote data the site stores. Exploitation requires no authentication, no user interaction, and no special configuration beyond an active, network-reachable vulnerable install, and a vendor patch is available in 4.2.19. No public exploit code has been identified at time of analysis, and the practical risk is tempered by the narrow installed base of this specialised less-than-truckload freight-quoting plugin, though sites that have not yet updated remain fully exposed.
SQL injection in JetBrains Exposed before 1.5.1 enables unauthenticated remote attackers to execute arbitrary SQL against downstream applications that pass attacker-controllable, unescaped string arguments into several affected SQL functions. The library itself is not directly exploitable; exploitation requires a hosting application to route untrusted input into the vulnerable function calls, so applications that only pass literals or use parameterized/escaped paths are unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case nominal impact of full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
SQL injection in the WordPress plugin wp-post-author (versions 4.0.0 up to but not including 4.1.0) lets an authenticated, low-privilege user inject arbitrary SQL into plugin queries and read sensitive data from the site's underlying database. Exploitation is network-reachable, requires no user interaction, and is rated CVSS 7.1 (High) with high confidentiality impact but no integrity or availability impact, consistent with read-oriented database exfiltration rather than data tampering or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the primary barrier is the requirement for valid low-privilege credentials on the target WordPress site.
Unauthenticated SQL injection in the PHPNuxBill radius.php FreeRADIUS REST endpoint allows remote attackers to read arbitrary data from the application database - including customer records and stored credentials - by injecting crafted username, macAddr, or nasid parameters into the accounting or authenticate actions, which are interpolated directly into whereRaw() queries. All versions through 2025.3.20 are affected per the vendor advisory and CPE data (cpe:2.3:a:hotspotbilling:phpnuxbill:*:*), and exploitation requires only network reachability of radius.php, with no authentication and no user interaction. The supplier-scored CVSS 4.0 vector (9.3) asserts high confidentiality, integrity, and availability impact, whereas our independent assessment scopes the realistic impact to confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, so the decisive risk factor is whether radius.php is exposed beyond the trusted RADIUS/NAS segment.
Authenticated SQL injection in HortusFox (hortusfox-web) before 6.2 lets any holder of a valid API token read arbitrary database tables, including user password hashes, by supplying a crafted include_info value to the /api/locations/list endpoint. The flaw is in PlantsModel::getSpecificInfo(), which concatenates the caller-supplied include_info string directly into the SQL column list instead of validating column names. Exploitation is limited by the API-token prerequisite (CVSS PR:L, assessed CVSS:3.1 7.1, high confidentiality impact with no integrity or availability impact), the vendor has published a fix commit adding column-name validation, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. At time of analysis there is no CISA KEV entry and no public exploit code identified at time of analysis, and the unauthenticated classification is Patchstack-reported and unverified: if the real prerequisite turns out to be subscriber- or author-level access, authentication would become the primary limiting factor.
Blind SQL injection in the Metagauss ProfileGrid WordPress plugin (all versions through 6.0.0.2) lets an authenticated low-privilege user, such as a self-registered member of a community site, inject arbitrary SQL into a vulnerable plugin query and infer database contents through response timing or boolean differences. The issue is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, reported base score 8.5), with the practical barrier lowered because ProfileGrid is a user-profile/community plugin that frequently permits open self-registration; the independent assessment rates confidentiality impact as High, integrity Low, availability None. No public exploit code and no confirmed active exploitation were identified at time of analysis. The specific vulnerable endpoint and parameter are not named in the available data, so defenders cannot pin the trigger to a specific setting.
Unauthenticated blind SQL injection in the WordPress plugin EduAdmin Booking (MultiNet Interactive AB) before version 6.0.0 allows remote attackers to inject SQL through the plugin's request handling and extract data from the underlying WordPress database, including booking records, customer details, and potentially user credential hashes. The supplier-rated CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), while our reassessment is more conservative at AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, because blind SQL injection normally produces confidentiality-only impact without the claimed scope change; under either vector the flaw is network-reachable and, per the supplied vector, requires no authentication or user interaction, although the exact vulnerable parameter or endpoint is not identified in the available data. Risk is real but bounded: exploitation requires an active installation of this specific plugin, and no public exploit identified at time of analysis, with no CISA KEV listing and no public PoC in the supplied intelligence.
Blind SQL injection in the wpdreams Ajax Search Pro WordPress plugin, affecting all versions through 4.29.1, lets unauthenticated remote attackers inject crafted input into the plugin's public-facing search/AJAX query path and infer database contents one bit at a time. Because the vector is PR:N/UI:N, no credentials or victim interaction are needed, making any internet-exposed WordPress site running the vulnerable plugin a candidate target. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); exploitation demands many iterative automated requests rather than a single direct query, but a successful attack can yield sensitive data such as user password hashes, secret keys, and PII.
Unauthenticated blind SQL injection in tagDiv Opt-In Builder (td-subscription) versions through 1.7.6 allows remote attackers to extract sensitive data from the underlying WordPress database via crafted input to the plugin's subscription/opt-in functionality. The vendor-reported CVSS 3.1 score is 9.3 (S:C), but an independent assessment revises the scope to unchanged (S:U) and confirms high confidentiality impact without integrity or availability impact. No public exploit identified at time of analysis.
Blind SQL injection in the tagDiv Opt-In Builder WordPress plugin (slug td-subscription) through version 1.7.6 allows remote authenticated attackers with low privileges to extract sensitive data from the site's database via inference-based queries. The flaw is a CWE-89 improper neutralization of special elements in SQL commands; exploitation requires a valid low-privilege account (e.g., subscriber or contributor) and no user interaction, making sites with open registration the primary exposure. Assessed severity is high for confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit identified at time of analysis.
Unauthenticated blind SQL injection in the JNews - Pay Writer WordPress plugin (versions through 12.0.1) allows remote attackers to extract sensitive data from the site's database by inferring information through boolean or time-based queries. The critical severity (CVSS 9.3) stems from network reachability, low complexity, and high confidentiality impact, but exploitation requires that this specific companion plugin be installed and active-the base JNews theme alone is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Blind SQL injection in the Taskbuilder WordPress plugin (all versions up to and including 6.0.5) allows an attacker who holds a valid low-privilege account to inject SQL through a plugin endpoint or parameter that fails to neutralize special elements, potentially exposing arbitrary data from the site's WordPress database. The vulnerability requires authentication (CVSS vector PR:L) and the plugin installed and active; the specific vulnerable feature, endpoint, and parameter are not named in the available advisory text, which limits targeted exploitation somewhat. At time of analysis there is no public exploit identified, no indication of confirmed active exploitation (not in CISA KEV), and no exact patched version confirmed, so this is a credible-but-not-urgent remediation priority - sites that allow open registration or host many low-privilege accounts carry the highest relative risk.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.2, letting an attacker who can reach the vulnerable endpoint infer and extract database contents - including WordPress user records and other sensitive tables - through a network-reachable, low-complexity attack (CWE-89, reported CVSS base 9.3). Exploitation status: no public exploit identified at time of analysis, and no CISA KEV listing. Sources disagree on prerequisites - the reported vector carries PR:N/S:C/C:H/I:N/A:L (unauthenticated, changed scope) while our independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (low-privilege authenticated, unchanged scope), so the minimum privilege level required should be verified against the Patchstack advisory before treating the issue as anonymously exploitable.
Blind SQL injection in the UpSolution Core WordPress plugin (us-core) through version 9.3 lets an attacker who already holds a low-privilege authenticated WordPress session inject SQL through a vulnerable parameter and extract database contents by inference (boolean/time-based) rather than by reading query output directly. Our independent assessment is more conservative than the vendor-advisory score of 8.5: with impact confined to confidentiality (C:H/I:N/A:N) and a mandatory PR:L session prerequisite, the effective severity is closer to 6.5, making this a genuine but conditional priority rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted through AccountDaoSql - so an attacker who obtains the user table can recover plaintext credentials offline with precomputed tables or GPU-accelerated cracking. The flaw is not self-contained: it requires a prior database compromise or a separate SQL injection to reach the credential table, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (vendor CVSS 4.0 rates it 8.2 with AC:H/AT:P), making this an impact amplifier rather than an initial-access vector. No public exploit code and no confirmed active exploitation of this password-storage weakness were identified at time of analysis, although the advisory carries an associated SQLi tag.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute unauthorized SQL statements against the appliance, with the vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full compromise of confidentiality, integrity, and availability of the affected component with no privileges or user interaction required. The vulnerable feature or endpoint is not publicly disclosed, so defenders cannot pin down a specific setting to harden, but the practical gating factor is reachability: Guardium is a data-security management appliance that normally sits on an internal or management network segment rather than the public internet. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available and should be treated as high priority because of the 9.8 severity and the sensitivity of the data Guardium manages.
SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 lets remote unauthenticated attackers who can reach the product's network-facing interfaces inject crafted SQL against the back-end database, potentially viewing, adding, modifying, or deleting its contents (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS is low at 0.27% (17th percentile), so real-world exploitation appears opportunistic rather than widespread despite the maximum severity rating. Impact is exposure-dependent: internet-reachable or broadly accessible management/collector instances carry the full unauthenticated risk, while deployments confined to isolated management networks are substantially less exposed. The vendor has published remediation through IBM Support.
SQL injection in IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to execute arbitrary SQL commands against the platform's underlying data store, with IBM's own vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H) describing total loss of confidentiality, integrity, and availability for exposed instances. The headline 9.8 CVSS should be tempered by conflicting signals: EPSS is only 0.30% (20th percentile), and CISA's SSVC assessment records exploitation as 'none' with the attack rated non-automatable, with no public exploit code or KEV listing identified at time of analysis. Real-world risk is governed by reachability - exploitation requires network access to a vulnerable Guardium management or collector interface, which is normally confined to restricted internal management networks rather than the internet.
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded `SET ?` clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.
SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an attacker who already holds a high-privilege account on the WordPress site to inject SQL through an improperly neutralized plugin input and extract database contents one inference at a time. The primary barrier is the authentication prerequisite (CVSS PR:H) - exploitation is remote over the network with low complexity and no user interaction, but anonymous internet attackers are excluded, and the attacker must first compromise or legitimately hold an administrative-level session. Patchstack reported the issue with a CVSS 3.1 score of 7.6; the independent assessment narrows the realized impact to loss of confidentiality (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated blind SQL injection in the NetBoard CRM demo platform lets remote attackers read and modify backend database contents by sending a crafted POST request to the password-recovery endpoint /module/auth/recovery.php, where the 'user-name' parameter is passed unsafely into a SQL query. The flaw carries a maximum-severity CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L), so no credentials, user interaction, or non-default configuration are needed; the practical limiting factor is whether an instance of this specific demo application is reachable from the internet, since it is a demonstration platform rather than a widely deployed production CRM. No public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score was supplied, so active exploitation is not confirmed; exploitation is demonstrated through Boolean, error-based, time-based, and UNION query techniques.
Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read sensitive database contents; the supplied CVSS vector rates it 9.3 with PR:N, indicating network-reachable unauthenticated exploitation, though the provided advisory data does not independently corroborate the unauthenticated condition and comparable plugin SQLi often requires at least subscriber-level access. This is a genuine high-priority issue by severity signals but with important caveats, and no public exploit identified at time of analysis.
SQL injection in the Homer coordinator's POST /api/v4/statistics/query endpoint allows a remote attacker to execute arbitrary DuckDB SQL against the FlightSQL backend, exposing or altering all stored VoIP call records, SIP messages and metadata. The V4StatisticsQuery handler forwards the caller-supplied rawquery field verbatim to DuckDB without the sqlvalidator.ValidateRawSQL() neutralization applied in sibling handlers, so any authenticated user is sufficient (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1); the vendor notes that on default deployments an empty JWT secret collapses this to pre-authentication reachability. Publicly available exploit code exists (the advisory ships a working curl PoC, and DuckDB INSTALL/LOAD is reachable for extension-based exfiltration); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Blind SQL injection in the WP Post Author WordPress plugin through version 4.0.0 allows an authenticated high-privilege (administrator-level) attacker to read sensitive data from the underlying WordPress database, with assessed high confidentiality impact, limited integrity impact, and no availability impact. Exploitation requires a high-privilege account (CVSS PR:H) and no victim user interaction, so direct external exploitation against a default install is limited, though risk increases in multi-author or delegated-admin environments or if an admin account is already compromised. Multiple signals point to a moderate, not critical, real-world priority; no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation.
Blind SQL injection in the Slider by 10Web WordPress plugin through version 1.2.63 allows an authenticated high-privilege user (CVSS PR:H, typically administrator-level) with network access to the vulnerable request handler to inferentially extract database contents, with confidentiality-only impact per the independent assessment. The input CVSS 3.1 vector describes a network-reachable, low-complexity flaw, but the high-privilege requirement is a critical mitigating factor because anonymous or unprivileged users cannot reach the vulnerable code path. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided; patch availability is not confirmed from the supplied data.
Blind SQL injection in the Gopiplus 'Post title marquee scroll' WordPress plugin (all versions through 9.9) allows an authenticated user with administrator-level privileges to inject arbitrary SQL into backend database queries and infer data through boolean- or time-based responses. The highest realistic impact is full disclosure of data stored in the WordPress database (CVSS:C:H), with the attacker population sharply constrained by the PR:H prerequisite - anonymous visitors and ordinary subscribers cannot reach the vulnerable functionality. As of analysis there is no CISA KEV listing and no public exploit code identified, and because the injection is blind, successful exploitation requires iterative inference rather than direct retrieval of results; the vendor has not published a fixed version, so the plugin should be removed or disabled until an update appears.
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in the Site Search function of Movable Type allows a remote attacker to run arbitrary SQL queries against the affected site's database, producing high confidentiality impact with limited integrity and availability impact (CVSS 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). Affected deployments are Movable Type and Movable Type Premium (self-hosted) plus the Movable Type Cloud Edition and Premium Cloud Edition services from Six Apart Ltd. This is a genuine high-priority vulnerability: the CVSS vector confirms the attack is network-reachable with no privileges and no user interaction, so any instance exposing the standard public Site Search is in scope, although no public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the Sarah Giles 'Dynamic User Directory' WordPress plugin, affecting all versions up to and including 2.4, lets an attacker with an existing high-privilege account on the target WordPress site inject arbitrary SQL into a plugin query and exfiltrate database contents by observing boolean or timing differences in responses, since the query results are not returned directly. The flaw is remotely reachable with low attack complexity and no user interaction, but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N vector means it is only exploitable by an authenticated, high-privilege user - a significant limiting factor that narrows the realistic attacker set to trusted administrators or attackers who have already compromised a privileged account. Our independent assessment scores the issue 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), lower than the 7.6 reported by the finder, because scope is unchanged and integrity and availability impact are limited; there is no CISA KEV listing and no public exploit identified at time of analysis, although a Patchstack advisory documents the issue.
Blind SQL injection in the WordPress plugin affiliate-toolkit (a.k.a. affiliate-toolkit-starter) through version 3.9.1 lets an attacker with an authenticated, high-privilege (administrator-level) account inject arbitrary SQL into plugin queries and exfiltrate database contents through inference-based techniques. The attack is remote, low complexity, and requires no victim interaction once that privileged session exists, but the administrator-level prerequisite (PR:H) sharply limits the realistic attacker pool, and because the injection is blind, exploitation is slower and noisier than a direct-output SQLi. Per our independent assessment this is a moderate-priority issue rather than an emergency; no public exploit identified at time of analysis, and no CISA KEV listing applies.
Unauthenticated SQL injection in the Manacle Multi-Tenant ERP System's API endpoint allows remote attackers to inject arbitrary SQL through crafted input, giving high impact to both data confidentiality and integrity (CVSS 4.0 score 9.3; assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N). The affected CPE (cpe:2.3:a:manacle_technologies:multi-tenant_erp_system:*) carries no version constraint, indicating the flaw is described against the product as a whole rather than a bounded release range, and no fixed version is named in the advisory. There is no public exploit identified at time of analysis and no CISA KEV listing; no EPSS score was supplied in the source data, so likelihood of exploitation should be judged from exposure alone.
Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.
SQL injection in the ClearPass Policy Manager API lets a remote attacker who already holds administrative privileges execute arbitrary database commands against the appliance, putting the confidentiality, integrity, and availability of its configuration and policy data at high risk (CVSS 7.2). The privilege requirement is the decisive constraint: exploitation requires network reachability to the management/API interface plus valid admin-level credentials (PR:H, AV:N, AC:L, UI:N), so realistic exposure is limited to privileged insiders or attackers who have first compromised an administrator account. No public exploit code and no confirmed active exploitation were identified at time of analysis, which keeps this a high-but-not-critical issue whose severity in practice tracks how well admin access and management-plane reachability are controlled.
SQL injection in the web-based management interface of ClearPass Policy Manager lets a low-privileged authenticated remote attacker inject arbitrary SQL and run database commands against the underlying ClearPass instance, yielding high confidentiality, integrity and availability impact with a scope change (CVSS 3.1 base 9.9). The flaw is not pre-authentication: the attacker must already hold a valid low-privilege operator account or session on the management UI (PR:L), and no non-default feature or special configuration is needed beyond that (AC:L, UI:N). There is no public exploit identified at time of analysis and no known active exploitation, but the severity plus the sensitivity of the data held by a network access control policy store make this a genuine high-priority remediation item rather than a high-CVSS outlier.
SQL injection in the web-based management interface of HPE Aruba ClearPass Policy Manager allows an authenticated attacker with high-privilege (PR:H) management-interface access to inject SQL into backend queries and run arbitrary database commands, with a vendor-assigned CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The impact is severe - confidentiality, integrity and availability of the appliance database are all rated high, and the scope change (S:C) indicates the compromise can escape the vulnerable component - but the precondition of valid administrative credentials plus network reachability to the management UI substantially narrows the practical attack surface, and no public exploit code has been identified at time of analysis. No evidence of active exploitation (CISA KEV) is present in the provided intelligence; this is a genuinely high-severity issue that warrants prompt patching but is not an untriaged emergency.
Unauthenticated SQL injection in HPE Aruba Networking ClearPass Policy Manager allows a remote attacker who can reach the affected interface to inject arbitrary SQL into the application's database layer, with successful exploitation enabling execution of arbitrary database commands. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials or user interaction are required and the confidentiality, integrity, and availability impact is total; any ClearPass instance whose management/web service is reachable from an untrusted network is directly at risk. No public exploit code has been identified at time of analysis and the flaw is not in CISA's KEV catalog, but the pre-authentication, network-reachable profile and the database-command execution outcome make this a high-priority item for exposure reduction and patching per the HPE advisory.
Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).
Authenticated SQL injection in Payload CMS allows a user holding read plus create or update permission on a collection that contains a json field - or a blocks field with blocksAsJSON enabled - to inject arbitrary SQL through crafted field paths and query operators when the site runs on the Postgres or SQLite database adapters. Only collections carrying those specific field types are reachable; collections built purely from text and richText fields are explicitly not affected, and richText fields themselves are not exploitable. The flaw requires an authenticated principal (CVSS PR:L) with write access, which materially narrows the attack surface, and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; Payload has shipped fixes in 3.90.0 (SQLite adapters), 3.73.0 (Postgres adapters) and 4.0.0-canary.34.
SQL injection in Payload CMS 3.0.0 through before 3.88.0 (and 4.0.0-canary builds before 4.0.0-canary.27) allows remote attackers to inject arbitrary SQL when the instance runs the SQLite (@payloadcms/db-sqlite) or Postgres (@payloadcms/db-postgres) adapter and untrusted users can query readable collections while supplying dynamic filters or join parameters. MongoDB-backed deployments are explicitly not affected, and the practical blast radius is bounded by which collections are readable to the attacker - if access control blocks those queries or dynamic filter/join input is not accepted, exploitation is blocked (the vendor-documented workaround). Vendor patches ship in 3.88.0 and 4.0.0-canary.27; no public exploit code was identified at time of analysis, and our independent assessment rates this a genuine high-priority issue with read-confidentiality impact dominating (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) rather than the vendor-published 9.8.
Ciphertext tampering in the Cloak Elixir encryption library (danielberkompas/cloak, all versions from 0.1.0-pre onward) lets anyone with write access to the encrypted store silently flip bits in stored ciphertext so that decryption returns an attacker-chosen plaintext of the same length. The affected code paths, Cloak.Ciphers.AES.CTR and Cloak.Ciphers.Deprecated.AES.CTR, encrypt with AES-256 in CTR mode and store the key tag, IV, and ciphertext with no MAC, and decrypt/2 validates only the key tag and a minimum length - so tampered data is returned as valid with no error. Exploitation requires write access to the ciphertext (the description cites SQL injection into the Ecto-backed database or a compromised replica) plus knowledge or a correct guess of the existing plaintext at the tampered offset, and the replacement value must be exactly the same length as the original; impact is integrity-only (VC:N/VA:N), with no public exploit identified at time of analysis. Note the vendor CVSS 4.0 score of 8.2 is driven entirely by VI:H, while an independent assessment applying CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) rates the realistic risk considerably lower because an attacker must already control writes to the encrypted store and have plaintext knowledge.
SQL injection in the Paid Member Subscriptions WordPress plugin through version 3.1.1 allows authenticated subscriber-level users to execute crafted SQL queries and read sensitive data from the site's database. The independent assessment gives a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L (reported base 8.5), meaning confidentiality is high while integrity and availability impact are low and scope is unchanged. Exploitation requires only any valid subscriber account, which is typically easy to obtain on sites using this plugin for open self-service registration; no public exploit identified at time of analysis.
Unauthenticated SQL injection in ARMember Premium versions 7.8 and earlier allows remote attackers to execute arbitrary SQL queries against the underlying WordPress database, potentially exposing sensitive information. The flaw requires no authentication (PR:N) or user interaction (UI:N), and its scope change (S:C) indicates the database is a security authority distinct from the web application. No public exploit identified at time of analysis, but the CVSS score of 9.3 reflects the high confidentiality impact.
SQL injection in UDesign Core WordPress plugin versions 4.15.0 and earlier allows an authenticated attacker with Subscriber-level access or higher to read sensitive data from the underlying database. Our independent assessment rates this as high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) and unchanged scope, differing from the provider CVSS vector which claims scope change and low availability impact. Exploitation requires an account on the target site; many WordPress sites enable open registration, lowering the barrier, but no public exploit identified at time of analysis.
Unauthenticated SQL injection in the Porto Theme Functionality WordPress plugin affects versions up to and including 3.9.3, allowing remote attackers to inject arbitrary SQL into the plugin's database queries without any prior authentication (CVSS vector PR:N, no user interaction). Successful exploitation can expose sensitive data stored in the site's WordPress database - the independent assessment rates confidentiality impact as High and integrity impact as Low, while the vendor/feed score of 9.3 assumes scope change and a different impact mix; both agree the issue is trivially network-reachable. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a high-severity, easily reachable flaw rather than a confirmed actively exploited campaign, and no fixed plugin version is specified in the supplied advisory data.
SQL injection in the ListingPro WordPress plugin through version 2.9.12 allows an authenticated Subscriber-level attacker to inject arbitrary SQL through a plugin code path, exposing database contents such as user credentials hashes, listing records, and site configuration. Exploitation requires a valid Subscriber account, which is easy to obtain on sites with self-registration enabled, and only WordPress installations where the plugin is installed and activated are exposed; sites upgraded past 2.9.12 are not affected. No public exploit identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); the issue is genuinely actionable but below top-tier urgency, with the practical risk concentrated on open-registration membership and directory sites.
Unauthenticated SQL injection in the Weblizar WordPress plugin 'Newsletter Subscription Form - User Subscriptions Form, Capture Email' (versions up to and including 1.5.9) lets an attacker who can reach the plugin's public subscription/capture-email form endpoint inject SQL through user-supplied input. Per the CVSS vector (PR:N/UI:N), no authentication or victim interaction is required, so any site running this plugin with a publicly reachable form is exposed; the primary limit on real-world exposure is simply whether this relatively uncommon plugin is installed. The feed score is 9.3, while our independent assessment scores it 8.1 (scope unchanged, confidentiality high, integrity low, availability none) because the demonstrated impact is primarily database read-out rather than full compromise. No public exploit code and no confirmed active exploitation (no CISA KEV entry) were identified at time of analysis, so this is a high-severity but not yet corroborated-as-exploited issue.
Unauthenticated SQL injection in the SendPress Newsletters WordPress plugin (all versions up to and including 1.26.1.20) allows a remote attacker who can reach an affected site to inject arbitrary SQL and read data from the site's database - including WordPress user credential hashes, secret keys and plugin/configuration tables - with no login and no user interaction. Our independent assessment recalibrates the reported CVSS 9.3 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5): a genuine high-priority issue rather than a CVSS-inflated one, with confidentiality-only impact and unchanged scope. The practical limiting factor is deployment - only sites actively running this plugin at or below the vulnerable version are exposed, and the exact injectable endpoint/parameter is not disclosed - and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Gmedia Photo Gallery (versions 1.25.1 and earlier) allows remote attackers to inject arbitrary SQL into database queries and read data the application can access, which the assessment rates as high confidentiality impact with no integrity or availability impact. Any WordPress site with the plugin installed and active is potentially exposed because exploitation requires no account, no privileges, and no victim interaction (AV:N/AC:L/PR:N/UI:N); the practical gate is deployment - the site must run an unpatched version and expose the vulnerable endpoint to the network. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the reporter's 9.3 score and the zero-prerequisite vector make it a high-priority item for inventory and patching rather than a CVSS-inflated finding.
SQL injection in the BuddyBoss Platform WordPress plugin (versions 3.1.0 and earlier) lets an authenticated low-privilege user - specifically a subscriber-level account - inject SQL through a plugin input that is not safely parameterized, exposing data stored in the site's database. Because BuddyBoss powers community and social-networking sites that very often leave open user self-registration enabled, the Subscriber role required by the vector (PR:L) is usually trivial to obtain, and no user interaction or non-default configuration is needed beyond a valid account. The vendor CVSS base score is 8.5 (High) with scope change, high confidentiality impact and low availability impact; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Unauthenticated SQL injection in the WordPress plugin Radius Booking - Booking Calendar for Appointments & Services through 1.0.19 allows remote attackers to read arbitrary database data through crafted input, with the independent assessment limiting confirmed impact to confidentiality (C:H/I:N/A:N). Affected sites are only those with this specific plugin installed and active at a vulnerable version; no authentication, user interaction, or non-default configuration is required. No public exploit or CISA KEV entry is identified at time of analysis, and deployment scope is the primary limiting factor.
Authenticated SQL injection in the Woffice WordPress theme at versions 5.4.35 and earlier lets any Subscriber-level account supply crafted input through an as-yet-unidentified theme endpoint and read arbitrary data from the site's database, including wp_users credential material and any other records the database account can reach. Exploitation is remote (AV:N) and requires no user interaction (UI:N), but does require a valid low-privilege account (PR:L) - a barrier that is minimal on the intranet, membership and community sites Woffice targets, where open self-registration is common. Patchstack reports an 8.5 score, while our independent assessment rates it 6.5 (scope-unchanged, confidentiality-only, no integrity or availability impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and the exact vulnerable parameter must be confirmed from the Patchstack advisory.
Unauthenticated SQL injection in the Booknetic WordPress plugin (versions 4.8.5 and earlier) lets any remote attacker inject arbitrary SQL into database queries handled by the plugin, yielding direct read access to the underlying WordPress database. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), the injection is reachable before authentication against a default plugin installation, so any internet-reachable WordPress site with Booknetic active and a publicly accessible booking page is a viable target - no account, no user interaction, and no non-default configuration required. The practical ceiling on impact is set by product presence: only sites actually running the affected plugin are exposed, and the value of exploitation scales with how much sensitive data the WordPress database holds; no public exploit code has been identified at time of analysis, and no EPSS score was supplied in the available intelligence, though the reported 9.3 CVSS score and confidentiality-heavy impact justify treating this as a high-priority patch.
SQL injection in the Mooberry Book Manager plugin for WordPress (4.16.2) allows an attacker holding an authenticated Subscriber-level account to inject SQL through plugin input and read data from the underlying WordPress database. Exploitation needs only a low-privilege account and no victim interaction, so sites with open user registration are the most exposed, though the confirmed impact is information disclosure rather than data tampering. No public exploit code has been identified and there is no CISA KEV entry or other indication of active exploitation at the time of analysis, so this is a moderate-priority issue rather than an urgent one.
Unauthenticated SQL injection in WooCommerce Lottery (WPGenie) versions up to and including 2.2.9 lets a remote attacker who can reach the plugin's lottery endpoint inject SQL against the underlying WordPress database, reading arbitrary data from it. No credentials or user interaction are required (PR:N, UI:N), and the vendor-assigned vector notes high confidentiality impact with limited availability effect, though its AC:H rating alongside our assessed AC:L indicates the reliability of the injection depends on conditions at the injection point that the advisory does not fully enumerate. Exploitation is narrow in practice because only WordPress sites running both WooCommerce and this specific niche paid add-on are exposed; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Unauthenticated SQL injection in the WooCommerce Appointments WordPress plugin (versions up to and including 5.3.2) lets any remote attacker without credentials or user interaction inject arbitrary SQL through the plugin's request handling, giving high confidentiality impact with limited integrity impact and no availability impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N per independent assessment; the CVE record publishes a 9.3 score with a scope-changed vector). Because WooCommerce Appointments is a commercial paid booking add-on that must be licensed and activated on top of WooCommerce, exposure is confined to that subset of WooCommerce stores running a vulnerable version rather than the WordPress install base at large, which is the main factor keeping this a priority fix rather than an emergency. No public exploit identified at time of analysis.
Authenticated SQL injection in WP2LEADS plugin versions 3.5.7 and earlier allows any Subscriber-level user to execute arbitrary SQL queries, resulting in high confidentiality impact and low integrity/availability impact. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires only low-privilege authentication (PR:L), making sites with open user registration particularly at risk. No public exploit identified at time of analysis.
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.
Blind SQL injection in the WP BASE Booking WordPress plugin (all versions through 6.4.0) allows an authenticated attacker to inject arbitrary SQL into a plugin query and exfiltrate database contents one bit at a time by observing response timing or boolean behavior. The vendor advisory from Patchstack rates this 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L); our independent review keeps the same authenticated, network-reachable, no-user-interaction profile but narrows the realistic impact to confidentiality only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), since the injected queries read data rather than alter it. Because exploitation requires an account on the target site (PR:L), sites with open self-service registration or reachable low-privilege roles carry materially greater exposure, while sites with no untrusted accounts are largely insulated. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is not confirmed as actively exploited; EPSS data was not provided. The vulnerable parameter and the minimum required role are not specified in the available data.
Unauthenticated blind SQL injection in the WordPress plugin WP BASE Booking (wp-base-booking-of-appointments-services-and-events) in all versions up to and including 6.4.0 lets remote attackers inject arbitrary SQL into database queries by manipulating request parameters handled by the plugin. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special configuration are required - any site with the plugin installed and reachable over the network is exposed, and exploitation is limited only by the fact that the injection is blind, so data must be extracted through boolean or time-based inference rather than direct query output. Patchstack rates this Critical (9.3) with a scope change, and the upstream advisory is the only public reference; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated SQL injection in OrdaSoft Joomla CCK before 8.3.16 allows remote attackers to execute arbitrary SQL via the user-supplied order column for records, compromising the confidentiality, integrity, and availability of the Joomla database. The flaw affects only sites that have installed this third-party CCK extension, so prevalence is the main limiting factor; no public exploit code was identified at time of analysis, and there is no KEV confirmation of active exploitation. With a CVSS 4.0 score of 9.3 and an independent CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:H, this is a high-priority issue for affected deployments.