SQLi
Monthly
Blind SQL injection in the Sirv WordPress plugin through version 8.2.5 allows an authenticated low-privilege user to execute crafted SQL queries against the underlying WordPress database, potentially exposing sensitive data. The attack is network-reachable, requires no user interaction, and is limited by the need for a valid low-privilege WordPress session and an active vulnerable plugin installation; the specific injectable parameter is not named in the available data. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 score is 8.5.
Blind SQL injection in the Groundhogg WordPress plugin (versions through 4.8.3) allows an authenticated high-privilege user - an administrator, or any account granted Groundhogg admin capabilities - to inject SQL into a plugin query and extract data from the underlying WordPress database. The flaw is network-reachable with low attack complexity and requires no victim interaction, but the PR:H metric means an attacker must already hold elevated credentials, which sharply limits who can exploit it; there is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. The reporting source scored this 7.6, whereas independent assessment rates it lower (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, ~4.9) because the injection is blind, read-only in effect, and gated behind admin-level access - a genuine but conditional risk rather than a drop-everything emergency.
SQL injection in GouGuOA 6.0.5 and earlier allows an attacker who can reach the /home/message/rubbish endpoint to inject arbitrary SQL through the keywords parameter, yielding full compromise of confidentiality, integrity and availability of the backend database (CWE-89, CVSS 3.1 base 9.8 as reported). The MITRE-supplied vector rates it unauthenticated (PR:N/UI:N), but our independent assessment lowers the privilege metric to PR:L because /home/message/rubbish is a message trash/recycle-bin function that in typical OA deployments is only reachable after login, so a valid session may in practice be a prerequisite - this materially changes the realistic attack surface and should be verified against the referenced write-up. No public exploit code has been confirmed and the CVE is not listed in CISA KEV, though a public technical write-up exists at the referenced GitHub repository; no EPSS score was available in the input, so no probability estimate is asserted.
SQL injection in FineAdmin v1.0 allows attackers to reach the /Permissions/Button/List endpoint and inject crafted SQL through the field/order (sort) parameter handled by ButtonService.GetListByFilter(), exposing sensitive database contents. Publicly available exploit code exists (an author-published proof-of-concept write-up is referenced), but there is no confirmed active exploitation (CISA KEV), and EPSS is very low at 0.15% (4th percentile), reflecting the product's obscure, small deployment footprint. The vendor-supplied CVSS of 9.8 (PR:N) conflicts with the assessed vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, which assumes the attacker realistically needs an authenticated admin or back-office session because the affected function is an administrative permissions/button-management feature - that authentication prerequisite is the key limiting factor defenders should verify rather than the headline score.
Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Unauthenticated SQL injection in the WP Visitor Statistics (Real Time Traffic) WordPress plugin through 8.7 lets any remote client poison the wp_logVisit table by submitting a crafted referrer URL to the wmcTrack tracking endpoint; the injected SQL then fires inside the session of an administrator who opens the Traffic Sources dashboard, allowing extraction of sensitive data such as user password hashes and stored configuration secrets. The impact is confidentiality-only - no integrity or availability effect was assessed - and the attack is second-order, so it remains dormant until a privileged user views the affected report. This is a genuine but conditional risk rather than an emergency: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector (UI:R) reflects that a privileged victim must open the dashboard for the payload to execute.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.
SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.
Authenticated JPQL injection in UTMStack SIEM deployments before 11.2.16 lets any holder of a low-privilege account read arbitrary database entities through the GET /api/utm-network-scans/searchPropertyValues endpoint, including sensitive credential tables such as jhi_user. The flaw is reachable by remote attackers (CVSS:4.0 AV:N/PR:L, assessed equivalently as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), so exploitation is confined to malicious insiders or attackers who have already obtained a valid credential - no unauthenticated internet path or non-default configuration is required beyond an authenticated session. No public exploit code has been identified and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis; the primary risk is direct confidentiality loss, not data integrity or availability, and vendor-released patch 11.2.16 is available.
Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL against the backend PostgreSQL database via the assetType and groupName parameters of GET /api/utm-asset-groups/searchGroupsByFilter. Because the database connection runs with DBA (PostgreSQL superuser-class) privileges, successful exploitation extends from full read and modification of stored data to potential filesystem access on the host. The vendor has released a fix in v11.2.16; no public exploit code has been identified at time of analysis, and the main practical constraint is that an authenticated session is required. Reported by VulnCheck, and tracked as CWE-89.
Authenticated SQL injection in GG Soft Software Services Inc.'s Paperwork (versions through 2026-09-09) lets a logged-in low-privileged user inject arbitrary SQL through network-reachable input, giving high confidentiality impact on stored data (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The PR:L prerequisite means the attacker must already hold a valid Paperwork account before the injection can be triggered, and the low integrity rating indicates limited write capability rather than broad database manipulation. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the flaw was reported by TR-CERT.
SQL injection in YesWiki before 4.6.7 allows an attacker with page-write access - which the supplied CVSS 4.0 vector (PR:N) rates as unauthenticated on default installations - to inject a UNION subquery through the Bazar nuagetag action's tags attribute, exfiltrating password hashes and arbitrary database table contents. The flaw carries a CVSS 4.0 score of 8.8, and an independent assessment confirms high confidentiality impact with low integrity and availability impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the vendor has released a patch (4.6.7) and public advisories are available.
Blind SQL injection in YesWiki before 4.6.7 allows unauthenticated remote attackers to read arbitrary database contents, including administrator password hashes from the yeswiki_users table, by planting a crafted option id in an anonymously editable Bazar list and then using {{newtextsearch}} requests as a boolean oracle. Successful exploitation depends on the deployment actually permitting anonymous editing of a Bazar list, and because the technique is blind, extraction is slow and noisy rather than a single-shot dump. Vendor severity is 8.7 (CVSS 4.0, AV:N/AC:L/PR:N/UI:N); our independent assessment, based on CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, confirms a high-confidentiality, no-integrity, no-availability impact with no authentication or user interaction required, and no public exploit code identified at time of analysis, with no evidence of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in YesWiki before 4.6.7 allows remote attackers to read arbitrary database contents, including user password hashes, by saving crafted Bazar filtertags markup into a page. The Bazar filtertags action wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause, so a token ending in a backslash breaks quote parity under MySQL/MariaDB escaping and permits a five-column UNION subquery. Exploitation requires a MySQL-family backend and the ability to store filtertags markup - on default installations with open page editing no authentication or user interaction is required - and no public exploit code has been identified at time of analysis; the issue carries a CVSS 8.8 score and is a genuine high-priority flaw, not an inflated rating.
Second-order SQL injection in YesWiki before 4.6.7 allows a low-privileged authenticated user to read database contents and bypass read ACLs by self-registering an account whose username contains a double-quote SQL payload, which AclService::updateRequestWithACL later concatenates unescaped into the read-ACL LIKE clause when a non-admin ACL-filtered listing is loaded. Exploitation requires the instance to permit account self-registration and to accept a username carrying the payload, per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L vector, so instances with self-registration disabled or with strict username validation are substantially harder to attack, and no victim interaction is needed. Although the vendor has released a fix in 4.6.7, no public exploit code has been identified at time of analysis; impact is confined to database read-out and read-ACL bypass rather than write or remote code execution, making this a genuine but moderate-priority issue, not an emergency.
SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.
SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.
Unauthenticated SQL injection in the WordPress File Upload plugin (nickboss) up to and including version 5.1.10 lets any remote attacker who can reach the site inject arbitrary SQL into the plugin's database queries, producing high confidentiality impact on data stored in the WordPress database with only limited integrity impact and no availability impact in our assessment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms no authentication or user interaction is required and assumes a default installation, so any network-reachable site running the plugin at 5.1.10 or earlier with the injectable endpoint exposed is at risk. Exploitation status: no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Patchstack, which reported the issue, rates it 9.3, higher than our independent assessment, chiefly because the supplied vector claims a scope change and an availability impact we did not substantiate.
Blind SQL injection in the Ultimate Member WordPress plugin (versions through 2.13.1) lets an authenticated high-privilege account - an administrator or an equivalently trusted Ultimate Member role - inject SQL into plugin-supplied input and read database contents one inference at a time. The flaw is network-reachable with low attack complexity and no user interaction, but the CVSS vector (PR:H) means it is realistically an insider-abuse or post-account-compromise scenario rather than an unauthenticated remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; confidentiality impact is high, while integrity and availability impact are limited to none/low.
Blind SQL injection in the WordPress plugin Captivate Sync (all versions through 3.3.2) allows an authenticated administrator-level user to inject crafted SQL into a plugin parameter and extract database contents through boolean- or time-based inference. The vendor-published score is 7.6, but our independent assessment rates the true impact lower: exploitation requires a high-privilege (PR:H) WordPress account, the injection is blind so no direct query output is returned, and the demonstrated consequence is read-only disclosure of backend data rather than data modification or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be triaged as a moderate-priority, access-gated issue despite the headline CVSS number. It is most relevant to multi-author or managed WordPress installations where untrusted or over-privileged accounts hold administrator rights.
Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates) through version 2.0.20 allows an authenticated low-privilege user to read arbitrary data from the site's database by injecting SQL through an unsanitized plugin parameter. Exploitation is network-remote and requires no user interaction, though it does require an account with at least contributor/subscriber-tier privileges (PR:L); because the injection is blind, data extraction is iterative and slower than a direct UNION-based attack but remains reliably automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated on membership, e-commerce, and multi-author WordPress sites that hand out low-privilege accounts to untrusted users.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated filter injection in the n8n Supabase node's 'Filters (String)' mode allows attackers to manipulate PostgREST queries and read, update, or delete all records in connected Supabase tables in a single request. The flaw affects n8n versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0, but only when a workflow passes untrusted input to the vulnerable node. No public exploit code has been identified at time of analysis, though a vendor patch is available.
Blind SQL injection in the Grafana datasource endpoint of Pandora FMS 777 and later lets an authenticated console user inject arbitrary SQL through the unsanitized 'module' request parameter and read database contents. Because the endpoint does not return query results directly, exfiltration requires inference-based (boolean or time-based) techniques, and the CVSS 4.0 base score of 7.2 reflects a network-reachable, low-complexity attack with high confidentiality impact (database read) but only limited integrity and availability effects. Exploitation is gated by a valid Pandora FMS session with access to the Grafana datasource integration, so unauthenticated internet attackers cannot exploit a default login-protected deployment directly; no public exploit identified at time of analysis, and this CVE is not in CISA KEV.
Unauthenticated SQL injection in the Pro Like Button WordPress plugin (all versions before 2.0) allows any remote attacker to inject arbitrary SQL through an unsanitized request parameter, giving high-confidentiality read access to data the WordPress database user can reach - typically user credential hashes, private post content, and any other plugin or application tables on the same database. Exploitation needs no authentication, no user interaction, and no special configuration (AV:N/PR:N/UI:N/AC:L), so any site running the vulnerable plugin that is reachable from the internet is exposed; the main limiting factor is the plugin's niche install base rather than any technical obstacle. No public exploit code was identified at time of analysis, and the vendor has released version 2.0 as the fix, per the WPScan advisory, VulDB entry, and ENISA EUVD record.
Unauthenticated SQL injection in the Paytm Payment Gateway WordPress plugin (versions before 2.8.9) lets remote attackers inject arbitrary SQL through payment callback data that the plugin fails to escape before building a database query. Exploitation is conditional: the gateway must be enabled on the WordPress site without payment credentials configured, a specific deployment state in which the plugin's callback integrity/signature check can be forged, so an attacker can supply a crafted, seemingly valid callback. No authentication or user interaction is required once those conditions hold, and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, 7.5 HIGH) reflects high attack complexity and database-scope impact; no public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV), though the pre-2.8.9 install base and internet-facing nature of WordPress sites warrant prompt patching.
Second-order SQL injection in Kiteworks Secure Data Forms (versions below 9.5.1) allows an authenticated, low-privilege user to influence a value derived from their stored account data that is later concatenated into a database query without sanitization, potentially exposing or manipulating data behind the application. Exploitation is condition-gated: the attacker needs a valid session, and only deployments where a specific optional feature is enabled are affected, so installs without that feature are not exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), which keeps this a mid-severity, moderate-priority issue; the vendor has released a fix in 9.5.1.
Stored SQL injection in Kiteworks Core before 9.5.0 allows an authenticated administrator to read sensitive data from the underlying database and to degrade availability of the service. Exploitation is only reachable through the affected administrative reporting feature and requires an existing, authenticated administrative account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the flaw is not exposed to unauthenticated or low-privileged users; no public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score accompanies this CVE. Our independent assessment rates the issue at moderate priority: confidentiality and availability impact are high, but integrity impact is limited (C:H/I:L/A:H), and the mandatory full administrative privilege sharply narrows the realistic attack surface to trusted insiders or attackers who have already compromised an admin session.
Unauthenticated SQL injection in the JCTables extension for Joomla (joomcode.com) through version 1.21.1 lets any remote attacker read and write arbitrary database content, because the extension's front-end CRUD API controller performs neither a Joomla token check nor any authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL, so a default install with the extension's front-end endpoint reachable is exploitable by an unauthenticated attacker with no user interaction and no non-default configuration (CVSS 4.0 base 10.0; our independent assessment concurs this is a top-tier priority rather than a high-score/low-risk case). Exposure is limited to Joomla sites that actually have this specific third-party extension installed, and no confirmed public exploit code was identified in the available intelligence at time of analysis, although public research describing a read/write SQLi-to-RCE chain has been published.
Unauthenticated SQL injection in Trex MES (all versions through 2026-09-29) lets a remote attacker reach the application over the network and inject arbitrary SQL into backend database queries, with the reported impact escalating to execution of operating-system commands. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any network-reachable instance of the MES web interface is directly in scope; the practical exposure limit is that this is niche manufacturing-execution software typically deployed on internal or OT-adjacent networks rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor patch version is specified in the available intelligence, so defenders should treat network isolation of the MES interface as the primary risk control while awaiting vendor guidance.
Blind SQL injection in WPTasty Business Directory plugin versions through 6.4.27 allows an authenticated attacker with high privileges to infer database contents without direct query output, using boolean- or time-based inference. The CVSS vector indicates network exploitability, no user interaction, and high confidentiality impact, but the PR:H requirement means the attacker must already hold a privileged WordPress account, so this is a plausible but not urgent priority. No public exploit has been identified at time of analysis, and KEV status is not indicated.
Unauthenticated SQL injection in Dolusoft SOPLOG affects every release before 2026.9.4.1, allowing a remote attacker who can reach a SOPLOG instance to inject arbitrary SQL into the application's backend queries, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N combined with high confidentiality, integrity, and availability impact producing a 9.8 Critical score. Because the vector carries PR:N and UI:N, no credentials, user interaction, or special configuration are required against a default deployment, so the practical limiting factor is exposure and prevalence rather than technical prerequisites - realistic risk is confined to organizations that actually run SOPLOG, and VPN-only, WAF-fronted, or non-internet-facing instances are substantially harder to reach. No public exploit identified at time of analysis, and the specific vulnerable parameter or endpoint has not been disclosed, which currently prevents defenders from scoping a precise detection or virtual-patch signature.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
SQL injection in the Category Discount WooCommerce WordPress plugin (slug woo-product-category-discount, CVE-2026-96828) affects all versions up to and including 5.18 and allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's admin-side functionality, yielding high-impact confidentiality exposure (CVSS 7.6, C:H/I:N/A:L, S:C). The PR:H prerequisite is the dominant limiting factor: only the highest-privilege role can reach the vulnerable code, so this is realistically a post-account-compromise or insider-abuse vector rather than an opportunistic unauthenticated attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; Patchstack is credited with reporting the flaw.
SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
Authenticated SQL injection in the weDevs WP ERP plugin for WordPress, affecting all releases up to and including 1.17.9, allows an attacker with Author-level or higher WordPress privileges to inject arbitrary SQL and read data from the site's database. The vulnerability is network-reachable and requires no user interaction, and because the CVSS scope is marked as changed (S:C) with high confidentiality impact (C:H), a successful injection can reach data beyond the plugin's own tables, including other plugins' and core WordPress content. Exploitation is privilege-gated by the PR:H rating, so exposure concentrates on multi-author, membership or community sites where Author accounts are handed to third parties; there is no public exploit identified at time of analysis and no confirmed vendor patch version in the available intelligence, making this a genuine but privilege-gated risk.
SQL injection in the Estatik WordPress plugin (versions <= 4.3.5) allows an authenticated attacker with administrator privileges to read sensitive data from the WordPress database. The vulnerability is a CWE-89 SQL injection in an admin-side function, requiring high privileges (PR:H) but no user interaction. No public exploit code has been identified at the time of analysis, and the primary risk is in environments where administrator access is delegated or on multisite installations where raw database access is not otherwise available.
SQL injection in GamiPress WordPress plugin versions 8.0.2 and earlier allows unauthenticated attackers to read sensitive data from the database. Our independent assessment indicates no user interaction or authentication is required (PR:N), though the originally provided CVSS vector specifies PR:L, creating a discrepancy that should be verified with the vendor. No public exploit code has been identified at time of analysis.
Authenticated SQL injection in the Easy Pricing Tables WordPress plugin affects versions up to and including 4.1.2, allowing any account holding at least the Contributor role to inject arbitrary SQL into the site's database and read sensitive data such as user credential hashes, password reset tokens, and stored configuration. Exploitation requires a valid logged-in account with Contributor privileges, needs no user interaction, and is network-reachable; no public exploit code has been identified at time of analysis, and the issue is not reported as actively exploited. Realistic exposure is concentrated on multi-author sites, membership or community sites with open registration granting Contributor, or any site where an attacker can obtain low-privilege credentials, while single-admin sites with registration disabled are at substantially lower risk.
Authenticated SQL injection in the Quiz Cat WordPress plugin (versions 3.1.1 and earlier) allows an attacker holding at least the WordPress Author role to send crafted requests that are woven into backend SQL statements, giving read access to sensitive database contents such as user records and stored quiz data, with secondary potential to alter or disrupt data. Exploitation is remote and requires no user interaction, but it is gated behind the Author privilege, so the realistic exposure surface is multi-author, membership, and user-generated-content sites that hand Author accounts to untrusted or numerous users; anonymous visitors and Subscriber- or Contributor-only accounts cannot trigger it. No public exploit code has been identified at time of analysis. The reported CVSS is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment is slightly more conservative at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - both agree the dominant impact is confidentiality loss.
Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, allowing remote attackers to inject arbitrary SQL into the site's database queries without logging in or any user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). The assessed impact is primarily to database confidentiality (C:H) with only limited integrity impact (I:L) and no availability effect, which confines the practical worst case to large-scale data disclosure rather than site takeover or denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the low attack complexity and lack of authentication prerequisites make weaponization straightforward; EPSS data was not provided in the source intelligence. This is a genuine priority for any WordPress site running the plugin, since exploitation requires only that the affected version be installed and reachable, with no special configuration needed.
SQL injection in WP Activity Log 5.6.6 and earlier allows an authenticated WordPress administrator to inject SQL through an admin-accessible plugin function, potentially reading sensitive database contents and causing limited integrity or availability impact. The vulnerability requires a high-privileged admin account per the PR:H vector, so it is not exploitable by unauthenticated visitors or lower-privileged users; no public exploit code was identified at time of analysis. The supplied base CVSS is 7.6, and the independent assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L, while the provided NVD-style vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L.
Authenticated SQL injection in Moodle's question bank web service allows a low-privilege user to inject unsanitized input into database queries, potentially exposing, modifying, or deleting sensitive data in the underlying database. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid account that can reach the question bank web-service endpoint is a potential vector - exploitation by fully anonymous users is not possible, and the requirement for credentials and for the web service to be enabled/exposed are the main limiting factors. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (14th percentile), and CISA SSVC rates exploitation as none with partial technical impact; this is a credible, exploitable issue but not an emergency.
SQL injection in Digiwin EasyFlow .NET allows an authenticated, low-privilege remote user to read arbitrary contents of the application's backend database. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), exploitation is network-reachable and low-complexity but requires a valid account (PR:L) and produces high confidentiality impact only - no integrity or availability effect, consistent with a read-only data-exfiltration primitive. The CVSS base score is 7.1; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and no EPSS score was provided with the source data.
Unauthenticated time-based blind SQL injection in the Motors - Car Dealership & Classified Listings plugin for WordPress (all versions up to and including 1.4.109) lets remote attackers inject SQL through the 'stm_lat' and 'stm_lng' parameters and infer sensitive database contents one timed request at a time. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no account, privileges, or user interaction are needed - only that the plugin is installed and the geo-location endpoint that consumes these latitude/longitude parameters is reachable, which is the case in default configurations. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is viable but inherently slow and noisy, since each extracted bit requires a distinct delayed response, so the practical risk is slow, stealthy exfiltration of database contents (hashes, user data, listing records) rather than rapid mass compromise.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject SQL through the 'reportType' parameter of the product summary report in the balancing reports section, with data recovered indirectly by measuring database response delays rather than returned in the response. The issue is remotely reachable with no user interaction but is gated behind a privileged session (vendor CVSS:4.0 base 8.5; independent assessment CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L), so confidentiality is the primary exposure while integrity and availability impacts remain limited. Exploitation status: no public exploit identified at time of analysis, and the vendor addresses it by upgrading to TMS7 v7.8; taken together this is a genuine but access-gated data-confidentiality issue in a niche OT deployment rather than an internet-wide emergency.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated high-privilege user inject SQL through the 'screenID' parameter of the electronic transaction queue viewer in the manual transactions section, using response-time delays to infer database contents. Exploitation requires an existing high-privilege (PR:H) session on the affected web interface, so anonymous and low-privilege users are excluded, and the blind, inference-based technique makes data extraction slow rather than directly returned. No public exploit code has been identified at time of analysis and the issue is remediated in TMS7 version 7.8, so despite the vendor's CVSS 4.0 score of 8.5 the practical operational priority for most terminal operators is moderate.
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application lets an attacker who already holds a high-privileged session inject SQL through the 'pattern' query parameter and infer database contents from response timing. The vendor addressed the flaw in TMS7 version 7.8, so unpatched pre-7.8 deployments are the exposed population; TOPHAT is also listed in the affected CPE set. The issue requires authenticated high-privileged access (CVSS PR:H) and the product has a limited OT footprint, so this is a real but access-gated concern rather than an internet-scale emergency, and no public exploit identified at time of analysis.
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech Systems' TMS7 and TopHat terminal-automation platforms, confirmed affecting version 7.6.3, lets an attacker with an authenticated high-privilege session force the backend database to leak data through conditional response delays. Exploitation is access-gated rather than open: the independent assessment (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) aligns with the vendor's v4.0 vector (PR:H) in requiring a privileged, authenticated foothold, and the flaws sit in OT/terminal-management deployments that are normally segmented rather than internet-facing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped a fix in TMS7 v7.8.
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and earlier lets a high-privilege authenticated attacker inject SQL through the supplier_no parameter and infer database contents by measuring conditional query delays. The vendor fixed the issue in TMS7 v7.8, documented in CISA ICS advisory ICSA-26-272-02 and tracked as EUVD-2026-89428, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because exploitation requires a privileged authenticated session against the business allocation search endpoint, the issue is access-gated rather than broadly reachable, although the assessed confidentiality and availability impacts on the database are high.
Unauthenticated SQL injection in the third-party MediaWiki UserPageViewTracker extension allows any remote attacker who can reach a wiki running an affected version to read and exfiltrate arbitrary data from the MediaWiki database backend. The flaw is present in all versions of the extension before the vendor's fixed releases 1.46.1, 1.45.5, and 1.43.10, and per the CVSS vector (AV:N/AC:L/PR:N/UI:N) requires no authentication or user interaction; impact is confined to confidentiality (C:H) with no asserted integrity or availability effect. Publicly available exploit code exists according to the CISA SSVC assessment (Exploitation: poc), but there is no KEV listing and no confirmed active exploitation, and the EPSS score is low at 0.16% (5th percentile), consistent with a genuine but moderate-priority issue whose real-world exposure is limited by the fact that the extension is optional and absent from default MediaWiki installs.
Time-based blind SQL injection in ClipBucket v5 (all builds through 5.5.3-#197) allows an authenticated administrator holding the basic_settings permission to inject arbitrary SQL through the language_id parameter of the language update function, enabling extraction or modification of database contents. The flaw is reachable over the network with no user interaction, but the high-privilege prerequisite is the primary limiting factor: neither unauthenticated nor low-privilege users can trigger it, and builds patched after upstream commit ecbdf2d5 are not affected. Publicly available exploit code exists (a published HackMD write-up demonstrating the blind SQLi), though there is no confirmed active exploitation (no CISA KEV listing); EPSS-style urgency is moderate given the admin-level access required.
Time-based blind SQL injection in ClipBucket v5 (through 5.5.3-#197) allows an authenticated administrator who holds the video_moderation permission to inject arbitrary SQL through the videoid parameter of the admin video edit function, enabling extraction and partial modification of database contents. Exploitation requires a valid high-privilege admin session with that specific permission, so anonymous or low-privilege users cannot trigger it; once such an account is authenticated, no user interaction or non-default configuration is needed. Publicly available exploit code exists (a published two-blind-SQLi write-up), and an upstream fix is available as a commit that casts videoid to an integer; the issue is a real but modest-priority finding given the authentication prerequisite.
Unauthenticated SQL injection in Flowring Agentflow 4.0 lets remote attackers run arbitrary SQL commands against the application database through the id parameter of the /WebAgenda/SMBAjaxConfigProcess.do endpoint, giving full read/write access to back-end data as returned by the vulnerable query. Only deployments running a build older than the 2025/08/08 fixed release and exposing the WebAgenda API to the network are affected; the CVSS 4.0 base score of 9.3 and the parallel CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C/I/A:H) both reflect that no authentication, user interaction, or non-default configuration is required. No public exploit code has been identified at time of analysis, but the report originates from ZUSO ART and the endpoint is trivially reachable wherever WebAgenda is internet-exposed, so the practical risk for unsegmented deployments is high.
Unauthenticated SQL injection in Flowring Agentflow 4.0 allows any remote attacker who can reach the web interface to execute arbitrary SQL statements through the 'words' parameter of the /WebAgenda/SMBAjaxAutoComplete.do endpoint. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) and our independent CVSS 3.1 assessment (9.8-equivalent high confidentiality, integrity and availability impact) agree that exploitation requires no credentials, privileges, or user interaction - only network reachability and an instance built before the 2025/08/08 fixed release. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by ZUSO ART and remains a high-priority target for rapid patching given its trivial, pre-auth exploitation profile.
SQL injection in Bytebase DBHub 1.2.0 allows unauthenticated remote attackers to submit crafted SQL statements that the /utils/sql-parser.ts component fails to classify correctly, bypassing the MCP server's parser-level read-only enforcement so the statement reaches the backend database and can expose sensitive database information. Only version 1.2.0 is confirmed affected, and there is no public exploit code identified at time of analysis and no CISA KEV confirmation of active exploitation; no EPSS score or vendor-published fix version was present in the available intelligence. The vendor rates this Critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), whereas independent assessment places the confidentiality impact higher and integrity/availability lower (C:H/I:L/A:L), and notes that real-world exposure is substantially reduced where the DBHub MCP server is run locally or behind a trusted MCP client rather than being network-reachable.
SiYuan versions before v3.8.4 contain a SQL injection vulnerability (CWE-89) in block query embed blocks that allows remote, unauthenticated attackers to execute arbitrary SQL against the local siyuan.db database, but exploitation requires the victim to import a malicious .sy document (UI:R). Successful exploitation enables high confidentiality impact (e.g., data exfiltration via VACUUM INTO) and low integrity impact (data tampering), with no availability impact, per the independent CVSS 3.1 assessment. No public exploit or CISA KEV entry is currently known, but a vendor patch (v3.8.4) is available.
Unauthenticated SQL injection in the OrdaSoft Book Library (Free) extension for Joomla, affecting all versions below 6.4.6, allows remote attackers to inject arbitrary SQL into an ORDER BY clause via the field and direction request parameters handled by the books() function in site/booklibrary.php. Because the injection lands in an unquoted ORDER BY position, the extension's keyword-blacklist filter (protectInjectionWithoutQuote()) can be defeated with a trailing decoy comment such as '-- xselect' that makes the filter merely quote the value instead of rejecting it, and exploitation requires only a prior request to prime session-stored sort defaults before the vulnerable code path is reached. Both the vendor's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, high C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate a fully unauthenticated, low-complexity, network-reachable flaw with high confidentiality, integrity, and availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Real Estate Manager (Free) extension for Joomla before 6.7.9 allows remote attackers to inject arbitrary SQL through the order_field parameter, which is concatenated unquoted into the ORDER BY clause of three public frontend property-listing queries (category browsing, search results, and full listing). Because the injection point is exposed on pre-authentication pages with no login, user interaction, or non-default configuration required, any reachable installation is at risk; the assessed impact is high confidentiality loss (blind extraction of database contents), while the ORDER BY sink constrains the attacker to data-read techniques rather than direct modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the only reference supplied is the vendor site, so patch status should be verified directly with OrdaSoft.
Unauthenticated SQL injection in the Vehicle Manager (Free) extension for Joomla versions prior to 6.5.8 allows remote attackers to inject SQL code via the order_field and order_direction parameters at three frontend entry points (category listing, search, and all-vehicles listing). Because the injection point is an unquoted ORDER BY clause, exploitation is constrained to blind/inferential techniques, but it can still lead to high confidentiality impact (e.g., extraction of sensitive database contents) with limited integrity and availability impact. No public exploit code has been identified, and the vulnerability requires no authentication or non-default configuration, making any public-facing installation a potential target; however, the overall real-world priority is moderate due to the product's footprint.
Authenticated SQL injection in Iron Mountain enVision builds prior to 260655 allows a network-based attacker holding a low-privilege account to inject arbitrary SQL through an improperly neutralized input parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects low-complexity exploitation with no user interaction and high impact across confidentiality, integrity, and availability, meaning an authenticated user could read, modify, or destroy database contents. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the vendor reports a patch is available; discovery is credited to TR-CERT (Turkish national CERT).
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets remote attackers push arbitrary SQL into a query parameter that is concatenated into a SQL predicate, potentially exposing or altering backend payroll data. The published CVSS 4.0 score is 9.3 with PR:N and no user interaction, and the independent assessment agrees on high confidentiality and integrity impact with no availability impact, but exploitation is time-based blind, so it demands many timed requests and is slower and more detectable than direct exfiltration. The issue is confirmed only in version R2026.2.0 after unsuccessful vendor contact attempts; no public exploit code or confirmed active exploitation was identified at time of analysis, and because much of Dayforce is delivered as vendor-hosted SaaS the set of independently exploitable targets is narrower than the raw score implies.
Unauthenticated DQL injection in AzuraCast before 0.23.8 allows remote attackers to extract sensitive database information, including user credentials and station settings, via the sortOrder parameter in the search/list API. No authentication or user interaction is required (CVSS 4.0 PR:N/UI:N), though exploitation requires network reachability to the AzuraCast web interface. No public exploit identified at time of analysis, but the flaw is trivially exploitable and affects many internet-facing radio panel deployments.
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, letting remote attackers reach the plugin's vulnerable request handlers and inject arbitrary SQL into backend database queries; the vendor-assigned CVSS 4.0 vector (8.3, AV:N/AC:L/AT:P/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) both describe a network-reachable, no-authentication, no-user-interaction flaw capable of returning or altering stored data. Only Joomla sites that actually have this third-party extension installed and expose the affected endpoint are in scope, and the plugin's comparatively small install base limits the overall attack surface; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Successful exploitation depends on the injectable feature being reachable in the target deployment, which is why the CVSS 4.0 vector carries the AT:P attack-requirement flag.
Unauthenticated SQL injection in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) lets remote attackers inject arbitrary SQL into read queries through the video search and sorting parameters of the public-facing gallery. No credentials, user interaction, or non-default configuration are required - only that the extension is installed and its video search/sorting front end is reachable, which is its normal deployment state. The CNA rates it 9.3 under CVSS 4.0, our independent assessment scores it as high severity with confidentiality impact dominant (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is bounded by deployment scope: core Joomla installations without this third-party extension are not affected, but any site that does run it is exposed to unauthenticated database disclosure.
Second-order SQL injection in Budibase Server (@budibase/server) before 3.45.0 can let an authenticated attacker with DDL rights on a connected MySQL or MSSQL datasource create a malicious column name that escapes identifier quoting, then execute injected SQL when a Budibase builder later renames that column through the UI. Because the MySQL connection is opened with multipleStatements:true in this default case, stacked statements can run as the datasource user and bypass Budibase's row/table permission model, enabling arbitrary reads, writes, or destructive operations. No public exploit identified at time of analysis; vendor-released patch: 3.45.0.
SQL injection in SiYuan's graph query endpoint, affecting all releases before v3.8.4, allows an unauthenticated remote attacker to read arbitrary database rows spanning every notebook on the instance. The issue is conditionally gated: it only becomes reachable when the deployment is running in published-site mode with authentication disabled, which is a non-default configuration - standard local single-user installs and published sites that retain authentication are not exposed. Impact is limited to confidentiality (read-out of stored notes and metadata) with no data modification or service disruption described, and no public exploit has been identified at time of analysis, though the vendor has released a fix.
SQL injection in GLPI's history/logs tab allows an authenticated attacker who holds the READ right on logs to inject attacker-controlled values into a database query via crafted affected_fields filter parameters in the history-tab URL. The flaw affects GLPI releases from 9.4.0 up to but not including 10.0.26 and 11.0.8, and exploitation is gated by the READ-on-logs privilege, which is not held by ordinary or self-service users by default. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has released fixes in 11.0.8 and 10.0.26, and the issue is well-confirmed by the vendor advisory and two upstream fix commits.
Stored SQL injection in Piwigo photo gallery versions prior to 16.4.0 lets an authenticated administrator store a crafted image_order[] value that is later concatenated into ORDER BY clauses, enabling disclosure, modification, or disruption of database data. Exploitation requires a high-privileged admin account (PR:H per the assessed CVSS 3.1 vector, 7.2 High) and the precondition that at least one album contains at least one photo, so the injected expression is executed on a subsequent album or Batch Manager query rather than immediately. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 16.4.0.
Unauthenticated SQL injection in Piwigo's pending-database-upgrade authentication path lets a remote attacker bypass administrator credentials and trigger the upgrade routine on affected galleries. The flaw lives in check_upgrade_access_rights() (admin/include/functions_upgrade.php), which only applies addslashes() escaping when the legacy get_magic_quotes_gpc function exists; because that function was removed in PHP 8.0, any Piwigo instance prior to 16.4.0 running PHP 8 concatenates the submitted username straight into the upgrade authentication query. Exploitation is gated on a transient state - the instance must have a pending database upgrade so this code path is reachable - and requires a crafted query result that satisfies both the status and password checks to set PHPWG_IN_UPGRADE, which is why the assessed vector carries AC:H. There is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, and an upstream fix is available in Piwigo 16.4.0.
Unauthenticated SQL injection in Piwigo 17.0.0beta1 and earlier lets anonymous guests read arbitrary database contents through the public photo-search flow whenever the rating feature is enabled. An attacker calls pwg.images.filteredSearch.create with a crafted ratings[] value and then opens the returned search URL; because only the lower rating bound is integer-cast while the raw upper bound is concatenated directly into the SQL filter, error-based and blind extraction - plus database-dependent time delays - become possible over the network with no credentials or user interaction. The independent assessment rates confidentiality impact as High with no Integrity or Availability impact, and upstream fixes exist only as commits (9755d88, aede490) with no released patched version identified at time of analysis; no public exploit code or confirmed active exploitation was identified.
SQL injection in Piwigo's Batch Manager (admin/batch_manager.php) allows an authenticated administrator to inject time-based or other SQL expressions through unvalidated dimension (width, height, ratio) and filesize values supplied in the filter URL, potentially disclosing, modifying, or disrupting database contents. The flaw affects Piwigo versions prior to 16.4.0 and arises because the URL filter parser stores raw values in the bulk_manager_filter session state, which is later concatenated into SQL predicates, unlike the validated POST filter path. Exploitation requires an existing high-privileged administrator account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), and no public exploit code has been identified at time of analysis; the vendor-released patch is version 16.4.0.
SQL injection in InvoicePlane's tax-rate settings allows an authenticated administrator to inject arbitrary SQL fragments into the ALTER TABLE statement that rebuilds the ip_tax_rates schema, letting them alter or drop required database columns in every release prior to 1.7.2. Because the malicious value is changed through the admin-only Settings page, exploitation requires high privileges (CVSS PR:H); the outcome is persistent schema corruption affecting financial data structures and potential loss of application availability, with integrity and availability impact rated high. No public exploit code has been identified at time of analysis, and the issue is resolved by upgrading to 1.7.2.
Authenticated SQL injection in the PESI service of IBM Guardium Data Protection 12.2 allows a logged-in attacker with network reachability to the service to inject SQL through a parameter and read sensitive records from the product's internal database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability effects, and the prerequisite is a valid Guardium session - there is no pre-authentication path. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; IBM has published a vendor advisory covering the fix, making this a genuine but conditional priority that is most urgent for internet- or broadly reachable PESI deployments with many low-privilege accounts.
Unauthenticated SQL injection in the ServiceNow AI Platform allows remote attackers to execute arbitrary SQL statements against an instance's underlying database, potentially reading or altering instance data beyond its intended scope. ServiceNow has already remediated its hosted instances and shipped the update to partners and self-hosted customers, so residual exposure is confined to self-hosted or partner-managed deployments that have not yet moved to the patched release described in KB3159623. No public exploit code has been identified and the vendor states it is not aware of malicious exploitation at time of analysis, but the 9.3 CVSS 4.0 rating - along with a more conservative independent assessment that raises attack complexity to High and lowers availability impact - makes prompt patching of any remaining unpatched instance the priority.
SQL injection in phpMyFAQ versions prior to 4.1.6 lets an authenticated administrator inject arbitrary SQL through the stop-word management feature by supplying a crafted "word" value that breaks out of the string literal built in StopWords::add(). The flaw is confined to the add()/INSERT code path - the sibling update() method escapes the same input correctly - and because it requires a high-privileged admin session (PR:H) plus access to the stop-word UI, exposure is bounded to trusted operators or compromised admin credentials rather than unauthenticated attackers. Successful exploitation permits reading, modifying, or deleting arbitrary rows and tables within the phpMyFAQ database; no public exploit code has been identified at time of analysis, and the vendor-released patch is version 4.1.6.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
SQL injection in Delta Electronics DIAEnergie before version 1.11.00.022 allows an attacker holding a valid low-privileged account to read from and write to the platform's backend database, putting the confidentiality, integrity, and availability of its operational data at risk. The flaw is network reachable (AV:N), requires only a low-privileged session (PR:L), and needs no user interaction; it is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis. Delta released the fix in advisory PCSA-2026-00014 alongside a batch of related DIAEnergie flaws, including an authentication bypass (CVE-2026-78308) that could supply the very credentials this SQL injection depends on.
SQL injection in Delta Electronics DIAEnergie versions before 1.11.00.022 lets a remote attacker with any valid low-privileged account (CVSS PR:L) execute arbitrary SQL against the underlying database, resulting in full loss of confidentiality, integrity, and availability (CVE-2026-78309, CWE-89, base score 8.8). The flaw is network-reachable with low attack complexity and no user interaction, so it can be triggered directly over the DIAEnergie web interface, though valid credentials are required and the specific vulnerable parameter or endpoint has not been disclosed in the available data. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the immediate risk is highest for internet- or IT-network-exposed deployments where low-privileged accounts are broadly issued. The advisory from Delta covers this CVE alongside five siblings (CVE-2026-78308 through CVE-2026-78313).
PHP object injection in the wpForo Forum WordPress plugin before 3.1.6 lets an authenticated attacker with Subscriber-level access or higher submit a crafted serialized value into a user-supplied profile field that the plugin deserializes without restricting which classes may be instantiated, as rated CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the plugin ships no POP/gadget chain of its own, escalation to remote code execution, arbitrary file operations, or SQL injection depends on a compatible chain being present via another installed plugin or theme - the factor driving the high attack complexity - and absent such a chain the outcome is limited to object injection with no confirmed high-severity effect. Publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV, SSVC exploitation: none), and this is an incomplete fix of CVE-2026-49769.
Blind SQL injection in the WordPress plugin W4 Post List (versions through 3.0.6) allows an authenticated high-privilege user - an administrator or equivalent role with access to the plugin's functionality - to inject crafted SQL into a query and infer database contents one bit at a time. The attack is remote and low complexity over the network, but it is gated entirely by the PR:H authentication requirement, so unauthenticated and low-privilege visitors cannot reach the vulnerable code path; the primary security consequence is high confidentiality loss (arbitrary data disclosure), with no integrity or availability impact in our assessment. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied with the source data.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Unauthenticated SQL injection in the WordPress/WooCommerce plugin Product Filter by WBW (versions 3.1.7 and earlier) lets any remote visitor inject SQL through the plugin's public-facing product-filter functionality and read arbitrary data from the site's database, with no login and no victim interaction required. The reporting source (Patchstack) and ENISA EUVD both classify this as a high-severity SQLi, while the assessed vector constrains the impact to confidentiality only (C:H/I:N/A:N) rather than the scope-change-plus-availability model that produces the 9.3 headline score, so the practical effect is large-scale data disclosure rather than remote code execution or denial of service. No public exploit code has been identified and there is no evidence of active exploitation at time of analysis; exploitation depends solely on whether the affected plugin is installed, active, and reachable on a standard WordPress deployment.
Authenticated SQL injection in the WordPress plugin Ultimeter (versions through 3.0.8) lets a high-privileged account - Editor or Administrator level - inject arbitrary SQL through the plugin's editor functionality, exposing data held in the site's WordPress database. The flaw is scored CVSS 3.1 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), where the changed scope and high confidentiality impact reflect that the database is a security authority separate from the vulnerable plugin. No public exploit identified at time of analysis; because the vector requires PR:H, realistic risk is confined to malicious insiders or attackers who have already taken over a privileged WordPress account on a site running the affected plugin version.
SQL injection in the Tainacan WordPress plugin through version 1.2.0 lets an attacker with an authenticated Subscriber-level account inject arbitrary SQL into one of the plugin's database queries, potentially reading sensitive data from the underlying WordPress database. The prerequisite is meaningful: the site must permit low-privilege account creation (for example, WordPress self-registration enabled), which substantially narrows the exposure for sites with registration disabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's own vector (AC:H) indicates some crafting or precondition beyond a trivial payload, keeping this a genuine but bounded threat rather than an opportunistic mass-exploitation risk.
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.
Blind SQL injection in the Sirv WordPress plugin through version 8.2.5 allows an authenticated low-privilege user to execute crafted SQL queries against the underlying WordPress database, potentially exposing sensitive data. The attack is network-reachable, requires no user interaction, and is limited by the need for a valid low-privilege WordPress session and an active vulnerable plugin installation; the specific injectable parameter is not named in the available data. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor CVSS 3.1 score is 8.5.
Blind SQL injection in the Groundhogg WordPress plugin (versions through 4.8.3) allows an authenticated high-privilege user - an administrator, or any account granted Groundhogg admin capabilities - to inject SQL into a plugin query and extract data from the underlying WordPress database. The flaw is network-reachable with low attack complexity and requires no victim interaction, but the PR:H metric means an attacker must already hold elevated credentials, which sharply limits who can exploit it; there is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. The reporting source scored this 7.6, whereas independent assessment rates it lower (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, ~4.9) because the injection is blind, read-only in effect, and gated behind admin-level access - a genuine but conditional risk rather than a drop-everything emergency.
SQL injection in GouGuOA 6.0.5 and earlier allows an attacker who can reach the /home/message/rubbish endpoint to inject arbitrary SQL through the keywords parameter, yielding full compromise of confidentiality, integrity and availability of the backend database (CWE-89, CVSS 3.1 base 9.8 as reported). The MITRE-supplied vector rates it unauthenticated (PR:N/UI:N), but our independent assessment lowers the privilege metric to PR:L because /home/message/rubbish is a message trash/recycle-bin function that in typical OA deployments is only reachable after login, so a valid session may in practice be a prerequisite - this materially changes the realistic attack surface and should be verified against the referenced write-up. No public exploit code has been confirmed and the CVE is not listed in CISA KEV, though a public technical write-up exists at the referenced GitHub repository; no EPSS score was available in the input, so no probability estimate is asserted.
SQL injection in FineAdmin v1.0 allows attackers to reach the /Permissions/Button/List endpoint and inject crafted SQL through the field/order (sort) parameter handled by ButtonService.GetListByFilter(), exposing sensitive database contents. Publicly available exploit code exists (an author-published proof-of-concept write-up is referenced), but there is no confirmed active exploitation (CISA KEV), and EPSS is very low at 0.15% (4th percentile), reflecting the product's obscure, small deployment footprint. The vendor-supplied CVSS of 9.8 (PR:N) conflicts with the assessed vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, which assumes the attacker realistically needs an authenticated admin or back-office session because the affected function is an administrative permissions/button-management feature - that authentication prerequisite is the key limiting factor defenders should verify rather than the headline score.
Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.
Authenticated SQL injection in the Smart Manager - Advanced WooCommerce Bulk Edit & Inventory Management plugin (Pro edition) affects all versions up to and including 8.97.0, letting any account at subscriber level or above append arbitrary SQL to an existing query through the 'access_privileges' parameter and read sensitive data from the WordPress database. Exploitation is not unconditional: the site must also be in a non-default state where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, which causes the authorization filter to implicitly permit low-privilege users to reach the vulnerable handler. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); note that while the supplied CVSS 3.1 vector is 8.8 High (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), our independent assessment rates effective severity lower (AC:H, I:L, A:N) because default installations and correctly configured deny-lists are not exploitable, valid authentication is mandatory, and only Pro-edition sites are in scope.
Unauthenticated SQL injection in the WP Visitor Statistics (Real Time Traffic) WordPress plugin through 8.7 lets any remote client poison the wp_logVisit table by submitting a crafted referrer URL to the wmcTrack tracking endpoint; the injected SQL then fires inside the session of an administrator who opens the Traffic Sources dashboard, allowing extraction of sensitive data such as user password hashes and stored configuration secrets. The impact is confidentiality-only - no integrity or availability effect was assessed - and the attack is second-order, so it remains dormant until a privileged user views the affected report. This is a genuine but conditional risk rather than an emergency: no public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed vector (UI:R) reflects that a privileged victim must open the dashboard for the payload to execute.
Unauthenticated SQL injection in the SaveTo Wishlist Lite WordPress plugin before 1.1.5 allows remote attackers to append arbitrary SQL queries to the ORDER BY clause of a database query, enabling extraction of sensitive information from the WordPress database. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and there is no indication of active exploitation (CISA KEV not listed). The vendor has released a patch in version 1.1.5.
SQL injection in the GeoDirectory WordPress plugin (all versions up to and including 2.8.186) allows an attacker holding a Subscriber-level account or higher to store a crafted payload in a listing's latitude/longitude coordinate fields and then trigger it through the public wp_ajax_nopriv_geodir_widget_listings AJAX handler, resulting in arbitrary SQL being appended to existing queries and disclosure of sensitive database contents. Successful exploitation requires the attacker to create and own a listing (pending state) whose coordinates are saved without numeric validation or escaping, then request the handler with set_post=<their-listings-id> and sort_by=distance_asc; no victim interaction is needed. No public exploit code has been identified at the time of analysis, and the practical risk is conditional: sites that disable open user registration, thereby preventing attackers from obtaining Subscriber accounts, are substantially protected.
Authenticated JPQL injection in UTMStack SIEM deployments before 11.2.16 lets any holder of a low-privilege account read arbitrary database entities through the GET /api/utm-network-scans/searchPropertyValues endpoint, including sensitive credential tables such as jhi_user. The flaw is reachable by remote attackers (CVSS:4.0 AV:N/PR:L, assessed equivalently as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), so exploitation is confined to malicious insiders or attackers who have already obtained a valid credential - no unauthenticated internet path or non-default configuration is required beyond an authenticated session. No public exploit code has been identified and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis; the primary risk is direct confidentiality loss, not data integrity or availability, and vendor-released patch 11.2.16 is available.
Authenticated SQL injection in UTMStack before 11.2.16 lets any valid low-privilege logged-in user execute arbitrary SQL against the backend PostgreSQL database via the assetType and groupName parameters of GET /api/utm-asset-groups/searchGroupsByFilter. Because the database connection runs with DBA (PostgreSQL superuser-class) privileges, successful exploitation extends from full read and modification of stored data to potential filesystem access on the host. The vendor has released a fix in v11.2.16; no public exploit code has been identified at time of analysis, and the main practical constraint is that an authenticated session is required. Reported by VulnCheck, and tracked as CWE-89.
Authenticated SQL injection in GG Soft Software Services Inc.'s Paperwork (versions through 2026-09-09) lets a logged-in low-privileged user inject arbitrary SQL through network-reachable input, giving high confidentiality impact on stored data (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The PR:L prerequisite means the attacker must already hold a valid Paperwork account before the injection can be triggered, and the low integrity rating indicates limited write capability rather than broad database manipulation. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the flaw was reported by TR-CERT.
SQL injection in YesWiki before 4.6.7 allows an attacker with page-write access - which the supplied CVSS 4.0 vector (PR:N) rates as unauthenticated on default installations - to inject a UNION subquery through the Bazar nuagetag action's tags attribute, exfiltrating password hashes and arbitrary database table contents. The flaw carries a CVSS 4.0 score of 8.8, and an independent assessment confirms high confidentiality impact with low integrity and availability impact. No public exploit code and no confirmed active exploitation have been identified at time of analysis, but the vendor has released a patch (4.6.7) and public advisories are available.
Blind SQL injection in YesWiki before 4.6.7 allows unauthenticated remote attackers to read arbitrary database contents, including administrator password hashes from the yeswiki_users table, by planting a crafted option id in an anonymously editable Bazar list and then using {{newtextsearch}} requests as a boolean oracle. Successful exploitation depends on the deployment actually permitting anonymous editing of a Bazar list, and because the technique is blind, extraction is slow and noisy rather than a single-shot dump. Vendor severity is 8.7 (CVSS 4.0, AV:N/AC:L/PR:N/UI:N); our independent assessment, based on CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, confirms a high-confidentiality, no-integrity, no-availability impact with no authentication or user interaction required, and no public exploit code identified at time of analysis, with no evidence of confirmed active exploitation (CISA KEV).
Unauthenticated SQL injection in YesWiki before 4.6.7 allows remote attackers to read arbitrary database contents, including user password hashes, by saving crafted Bazar filtertags markup into a page. The Bazar filtertags action wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause, so a token ending in a backslash breaks quote parity under MySQL/MariaDB escaping and permits a five-column UNION subquery. Exploitation requires a MySQL-family backend and the ability to store filtertags markup - on default installations with open page editing no authentication or user interaction is required - and no public exploit code has been identified at time of analysis; the issue carries a CVSS 8.8 score and is a genuine high-priority flaw, not an inflated rating.
Second-order SQL injection in YesWiki before 4.6.7 allows a low-privileged authenticated user to read database contents and bypass read ACLs by self-registering an account whose username contains a double-quote SQL payload, which AclService::updateRequestWithACL later concatenates unescaped into the read-ACL LIKE clause when a non-admin ACL-filtered listing is loaded. Exploitation requires the instance to permit account self-registration and to accept a username carrying the payload, per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L vector, so instances with self-registration disabled or with strict username validation are substantially harder to attack, and no victim interaction is needed. Although the vendor has released a fix in 4.6.7, no public exploit code has been identified at time of analysis; impact is confined to database read-out and read-ACL bypass rather than write or remote code execution, making this a genuine but moderate-priority issue, not an emergency.
SQL injection in HAVELSAN's Sef - AI Chatbot Platform, affecting all releases prior to 2.1, lets an attacker who holds a valid low-privilege account feed crafted SQL metacharacters through a user-controllable input that is concatenated into a database query, yielding high confidentiality, integrity, and availability impact (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is network-reachable with low attack complexity and needs no user interaction, but the vector's PR:L means an attacker must first obtain platform credentials; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1241) does not disclose the specific vulnerable endpoint or parameter. This is a credible, actionable priority rather than a high-CVSS-but-low-risk issue, though real-world exposure is bounded by the narrow deployment base of this specific vendor product.
SQL injection in ClipBucket v5 (all versions through 5.5.3-#197) allows an authenticated user who holds the ad_manager_access permission to inject arbitrary SQL through the delete parameter in admin_area/ads_manager.php, which is concatenated unsanitized into the AdsManager::DeleteAd DELETE statement against the ads_data table. A successful attacker can run time-based blind payloads to extract user credentials and email addresses, or directly modify and delete arbitrary records, giving high confidentiality and integrity impact on the application database. Publicly available exploit code exists (a published HackMD write-up), and while the flaw is remotely reachable it is gated behind a privileged admin-area role, so real-world exposure is limited to deployments that hand ad-manager rights to additional or semi-trusted users; no confirmed active exploitation (CISA KEV) has been reported, and an upstream fix is available as a pull request.
Unauthenticated SQL injection in the WordPress File Upload plugin (nickboss) up to and including version 5.1.10 lets any remote attacker who can reach the site inject arbitrary SQL into the plugin's database queries, producing high confidentiality impact on data stored in the WordPress database with only limited integrity impact and no availability impact in our assessment. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms no authentication or user interaction is required and assumes a default installation, so any network-reachable site running the plugin at 5.1.10 or earlier with the injectable endpoint exposed is at risk. Exploitation status: no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; Patchstack, which reported the issue, rates it 9.3, higher than our independent assessment, chiefly because the supplied vector claims a scope change and an availability impact we did not substantiate.
Blind SQL injection in the Ultimate Member WordPress plugin (versions through 2.13.1) lets an authenticated high-privilege account - an administrator or an equivalently trusted Ultimate Member role - inject SQL into plugin-supplied input and read database contents one inference at a time. The flaw is network-reachable with low attack complexity and no user interaction, but the CVSS vector (PR:H) means it is realistically an insider-abuse or post-account-compromise scenario rather than an unauthenticated remote attack. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; confidentiality impact is high, while integrity and availability impact are limited to none/low.
Blind SQL injection in the WordPress plugin Captivate Sync (all versions through 3.3.2) allows an authenticated administrator-level user to inject crafted SQL into a plugin parameter and extract database contents through boolean- or time-based inference. The vendor-published score is 7.6, but our independent assessment rates the true impact lower: exploitation requires a high-privilege (PR:H) WordPress account, the injection is blind so no direct query output is returned, and the demonstrated consequence is read-only disclosure of backend data rather than data modification or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be triaged as a moderate-priority, access-gated issue despite the headline CVSS number. It is most relevant to multi-author or managed WordPress installations where untrusted or over-privileged accounts hold administrator rights.
Blind SQL injection in the VillaTheme BuildKit - Product Builder for WooCommerce - Custom PC Builder WordPress plugin (all versions through 1.0.28) lets an authenticated, low-privilege user on a WooCommerce site inject SQL into plugin-supplied queries and infer database contents one bit at a time. Because the injection is blind, extraction is slow but still permits disclosure of high-impact data such as WordPress user hashes, customer records, and WooCommerce order details. The flaw rates CVSS 3.1 8.5 (HIGH) with remote reachability, low attack complexity, and no user interaction, and the primary barrier is the requirement for a valid low-privileged account (PR:L). No public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the WordPress plugin Unlimited Elements for Elementor (Free Widgets, Addons, Templates) through version 2.0.20 allows an authenticated low-privilege user to read arbitrary data from the site's database by injecting SQL through an unsanitized plugin parameter. Exploitation is network-remote and requires no user interaction, though it does require an account with at least contributor/subscriber-tier privileges (PR:L); because the injection is blind, data extraction is iterative and slower than a direct UNION-based attack but remains reliably automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is concentrated on membership, e-commerce, and multi-author WordPress sites that hand out low-privilege accounts to untrusted users.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated filter injection in the n8n Supabase node's 'Filters (String)' mode allows attackers to manipulate PostgREST queries and read, update, or delete all records in connected Supabase tables in a single request. The flaw affects n8n versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0, but only when a workflow passes untrusted input to the vulnerable node. No public exploit code has been identified at time of analysis, though a vendor patch is available.
Blind SQL injection in the Grafana datasource endpoint of Pandora FMS 777 and later lets an authenticated console user inject arbitrary SQL through the unsanitized 'module' request parameter and read database contents. Because the endpoint does not return query results directly, exfiltration requires inference-based (boolean or time-based) techniques, and the CVSS 4.0 base score of 7.2 reflects a network-reachable, low-complexity attack with high confidentiality impact (database read) but only limited integrity and availability effects. Exploitation is gated by a valid Pandora FMS session with access to the Grafana datasource integration, so unauthenticated internet attackers cannot exploit a default login-protected deployment directly; no public exploit identified at time of analysis, and this CVE is not in CISA KEV.
Unauthenticated SQL injection in the Pro Like Button WordPress plugin (all versions before 2.0) allows any remote attacker to inject arbitrary SQL through an unsanitized request parameter, giving high-confidentiality read access to data the WordPress database user can reach - typically user credential hashes, private post content, and any other plugin or application tables on the same database. Exploitation needs no authentication, no user interaction, and no special configuration (AV:N/PR:N/UI:N/AC:L), so any site running the vulnerable plugin that is reachable from the internet is exposed; the main limiting factor is the plugin's niche install base rather than any technical obstacle. No public exploit code was identified at time of analysis, and the vendor has released version 2.0 as the fix, per the WPScan advisory, VulDB entry, and ENISA EUVD record.
Unauthenticated SQL injection in the Paytm Payment Gateway WordPress plugin (versions before 2.8.9) lets remote attackers inject arbitrary SQL through payment callback data that the plugin fails to escape before building a database query. Exploitation is conditional: the gateway must be enabled on the WordPress site without payment credentials configured, a specific deployment state in which the plugin's callback integrity/signature check can be forged, so an attacker can supply a crafted, seemingly valid callback. No authentication or user interaction is required once those conditions hold, and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N, 7.5 HIGH) reflects high attack complexity and database-scope impact; no public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV), though the pre-2.8.9 install base and internet-facing nature of WordPress sites warrant prompt patching.
Second-order SQL injection in Kiteworks Secure Data Forms (versions below 9.5.1) allows an authenticated, low-privilege user to influence a value derived from their stored account data that is later concatenated into a database query without sanitization, potentially exposing or manipulating data behind the application. Exploitation is condition-gated: the attacker needs a valid session, and only deployments where a specific optional feature is enabled are affected, so installs without that feature are not exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), which keeps this a mid-severity, moderate-priority issue; the vendor has released a fix in 9.5.1.
Stored SQL injection in Kiteworks Core before 9.5.0 allows an authenticated administrator to read sensitive data from the underlying database and to degrade availability of the service. Exploitation is only reachable through the affected administrative reporting feature and requires an existing, authenticated administrative account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the flaw is not exposed to unauthenticated or low-privileged users; no public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score accompanies this CVE. Our independent assessment rates the issue at moderate priority: confidentiality and availability impact are high, but integrity impact is limited (C:H/I:L/A:H), and the mandatory full administrative privilege sharply narrows the realistic attack surface to trusted insiders or attackers who have already compromised an admin session.
Unauthenticated SQL injection in the JCTables extension for Joomla (joomcode.com) through version 1.21.1 lets any remote attacker read and write arbitrary database content, because the extension's front-end CRUD API controller performs neither a Joomla token check nor any authentication check on any task. Table names, column names and values are taken directly from request parameters and concatenated into SQL, so a default install with the extension's front-end endpoint reachable is exploitable by an unauthenticated attacker with no user interaction and no non-default configuration (CVSS 4.0 base 10.0; our independent assessment concurs this is a top-tier priority rather than a high-score/low-risk case). Exposure is limited to Joomla sites that actually have this specific third-party extension installed, and no confirmed public exploit code was identified in the available intelligence at time of analysis, although public research describing a read/write SQLi-to-RCE chain has been published.
Unauthenticated SQL injection in Trex MES (all versions through 2026-09-29) lets a remote attacker reach the application over the network and inject arbitrary SQL into backend database queries, with the reported impact escalating to execution of operating-system commands. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any network-reachable instance of the MES web interface is directly in scope; the practical exposure limit is that this is niche manufacturing-execution software typically deployed on internal or OT-adjacent networks rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor patch version is specified in the available intelligence, so defenders should treat network isolation of the MES interface as the primary risk control while awaiting vendor guidance.
Blind SQL injection in WPTasty Business Directory plugin versions through 6.4.27 allows an authenticated attacker with high privileges to infer database contents without direct query output, using boolean- or time-based inference. The CVSS vector indicates network exploitability, no user interaction, and high confidentiality impact, but the PR:H requirement means the attacker must already hold a privileged WordPress account, so this is a plausible but not urgent priority. No public exploit has been identified at time of analysis, and KEV status is not indicated.
Unauthenticated SQL injection in Dolusoft SOPLOG affects every release before 2026.9.4.1, allowing a remote attacker who can reach a SOPLOG instance to inject arbitrary SQL into the application's backend queries, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N combined with high confidentiality, integrity, and availability impact producing a 9.8 Critical score. Because the vector carries PR:N and UI:N, no credentials, user interaction, or special configuration are required against a default deployment, so the practical limiting factor is exposure and prevalence rather than technical prerequisites - realistic risk is confined to organizations that actually run SOPLOG, and VPN-only, WAF-fronted, or non-internet-facing instances are substantially harder to reach. No public exploit identified at time of analysis, and the specific vulnerable parameter or endpoint has not been disclosed, which currently prevents defenders from scoping a precise detection or virtual-patch signature.
SQL injection in the WordPress plugin Media Library Assistant (version 3.41 and earlier) allows an authenticated Contributor-level account to inject arbitrary SQL into the plugin's media/attachment query handling, reading database content such as user password hashes, private or draft posts, and stored configuration secrets. The issue is remotely exploitable with low complexity and no user interaction, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) yields a base score of 8.5 (High), reflecting confidentiality-only impact plus a scope change that lets the injection reach tables outside the plugin itself. There is no public exploit identified at time of analysis and no CISA KEV entry, so the practical barrier to abuse is obtaining a Contributor account - realistic on sites with open registration, multi-author blogs, or guest-post/membership setups, but not on locked-down single-admin installs.
Authenticated SQL injection in the Event Tickets WordPress plugin through version 5.29.5 allows any account holding the Contributor role to inject arbitrary SQL through plugin-supplied input, giving read access to data well beyond what the plugin itself stores (CVSS 3.1: 8.5, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L). The practical barrier is the Contributor authentication requirement, which limits mass exploitation but is trivially satisfied on sites with open registration or large numbers of low-trust contributors; the Scope:Changed rating reflects that successful injection can expose the broader WordPress database, not just plugin tables. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so this is a genuine mid-to-high priority issue rather than an emergency.
SQL injection in the Category Discount WooCommerce WordPress plugin (slug woo-product-category-discount, CVE-2026-96828) affects all versions up to and including 5.18 and allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's admin-side functionality, yielding high-impact confidentiality exposure (CVSS 7.6, C:H/I:N/A:L, S:C). The PR:H prerequisite is the dominant limiting factor: only the highest-privilege role can reach the vulnerable code, so this is realistically a post-account-compromise or insider-abuse vector rather than an opportunistic unauthenticated attack. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; Patchstack is credited with reporting the flaw.
SQL injection in the Melapress Admin Notices Manager WordPress plugin (versions up to and including 1.6.0) allows an authenticated WordPress Administrator to inject arbitrary SQL into a plugin-handled parameter, giving the attacker read access to data outside the plugin's own tables. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L scores 7.6, but the PR:H requirement means exploitation presupposes top-tier site access; the practical threat model is multi-admin sites, delegated or agency-managed installs, or an attacker who has already escalated a lower-privilege foothold to administrator. No public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the available intelligence, so no exploit-probability estimate is asserted here.
Unauthenticated SQL injection in the WordPress Books Gallery plugin (wp-books-gallery) 4.8.3 and earlier lets a remote attacker read arbitrary data from the site's WordPress database over plain HTTP, with no credentials and no user interaction required. Exposure is limited to sites that actually have this low-adoption plugin installed and activated, and no public exploit code was identified at time of analysis; there is no CISA KEV entry for this issue. Because the assessed impact is high confidentiality with only a low availability effect, the realistic worst case is full database disclosure - user password hashes, private content and configuration secrets - rather than code execution or data tampering.
Authenticated SQL injection in the weDevs WP ERP plugin for WordPress, affecting all releases up to and including 1.17.9, allows an attacker with Author-level or higher WordPress privileges to inject arbitrary SQL and read data from the site's database. The vulnerability is network-reachable and requires no user interaction, and because the CVSS scope is marked as changed (S:C) with high confidentiality impact (C:H), a successful injection can reach data beyond the plugin's own tables, including other plugins' and core WordPress content. Exploitation is privilege-gated by the PR:H rating, so exposure concentrates on multi-author, membership or community sites where Author accounts are handed to third parties; there is no public exploit identified at time of analysis and no confirmed vendor patch version in the available intelligence, making this a genuine but privilege-gated risk.
SQL injection in the Estatik WordPress plugin (versions <= 4.3.5) allows an authenticated attacker with administrator privileges to read sensitive data from the WordPress database. The vulnerability is a CWE-89 SQL injection in an admin-side function, requiring high privileges (PR:H) but no user interaction. No public exploit code has been identified at the time of analysis, and the primary risk is in environments where administrator access is delegated or on multisite installations where raw database access is not otherwise available.
SQL injection in GamiPress WordPress plugin versions 8.0.2 and earlier allows unauthenticated attackers to read sensitive data from the database. Our independent assessment indicates no user interaction or authentication is required (PR:N), though the originally provided CVSS vector specifies PR:L, creating a discrepancy that should be verified with the vendor. No public exploit code has been identified at time of analysis.
Authenticated SQL injection in the Easy Pricing Tables WordPress plugin affects versions up to and including 4.1.2, allowing any account holding at least the Contributor role to inject arbitrary SQL into the site's database and read sensitive data such as user credential hashes, password reset tokens, and stored configuration. Exploitation requires a valid logged-in account with Contributor privileges, needs no user interaction, and is network-reachable; no public exploit code has been identified at time of analysis, and the issue is not reported as actively exploited. Realistic exposure is concentrated on multi-author sites, membership or community sites with open registration granting Contributor, or any site where an attacker can obtain low-privilege credentials, while single-admin sites with registration disabled are at substantially lower risk.
Authenticated SQL injection in the Quiz Cat WordPress plugin (versions 3.1.1 and earlier) allows an attacker holding at least the WordPress Author role to send crafted requests that are woven into backend SQL statements, giving read access to sensitive database contents such as user records and stored quiz data, with secondary potential to alter or disrupt data. Exploitation is remote and requires no user interaction, but it is gated behind the Author privilege, so the realistic exposure surface is multi-author, membership, and user-generated-content sites that hand Author accounts to untrusted or numerous users; anonymous visitors and Subscriber- or Contributor-only accounts cannot trigger it. No public exploit code has been identified at time of analysis. The reported CVSS is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment is slightly more conservative at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - both agree the dominant impact is confidentiality loss.
Unauthenticated SQL injection in the WordPress plugin WP Data Access affects all versions up to and including 5.5.84, allowing remote attackers to inject arbitrary SQL into the site's database queries without logging in or any user interaction (CVSS 8.2, AV:N/AC:L/PR:N/UI:N). The assessed impact is primarily to database confidentiality (C:H) with only limited integrity impact (I:L) and no availability effect, which confines the practical worst case to large-scale data disclosure rather than site takeover or denial of service. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though the low attack complexity and lack of authentication prerequisites make weaponization straightforward; EPSS data was not provided in the source intelligence. This is a genuine priority for any WordPress site running the plugin, since exploitation requires only that the affected version be installed and reachable, with no special configuration needed.
SQL injection in WP Activity Log 5.6.6 and earlier allows an authenticated WordPress administrator to inject SQL through an admin-accessible plugin function, potentially reading sensitive database contents and causing limited integrity or availability impact. The vulnerability requires a high-privileged admin account per the PR:H vector, so it is not exploitable by unauthenticated visitors or lower-privileged users; no public exploit code was identified at time of analysis. The supplied base CVSS is 7.6, and the independent assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L, while the provided NVD-style vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L.
Authenticated SQL injection in Moodle's question bank web service allows a low-privilege user to inject unsanitized input into database queries, potentially exposing, modifying, or deleting sensitive data in the underlying database. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid account that can reach the question bank web-service endpoint is a potential vector - exploitation by fully anonymous users is not possible, and the requirement for credentials and for the web service to be enabled/exposed are the main limiting factors. There is no public exploit identified at time of analysis, EPSS is low at 0.25% (14th percentile), and CISA SSVC rates exploitation as none with partial technical impact; this is a credible, exploitable issue but not an emergency.
SQL injection in Digiwin EasyFlow .NET allows an authenticated, low-privilege remote user to read arbitrary contents of the application's backend database. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), exploitation is network-reachable and low-complexity but requires a valid account (PR:L) and produces high confidentiality impact only - no integrity or availability effect, consistent with a read-only data-exfiltration primitive. The CVSS base score is 7.1; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and no EPSS score was provided with the source data.
Unauthenticated time-based blind SQL injection in the Motors - Car Dealership & Classified Listings plugin for WordPress (all versions up to and including 1.4.109) lets remote attackers inject SQL through the 'stm_lat' and 'stm_lng' parameters and infer sensitive database contents one timed request at a time. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no account, privileges, or user interaction are needed - only that the plugin is installed and the geo-location endpoint that consumes these latitude/longitude parameters is reachable, which is the case in default configurations. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); exploitation is viable but inherently slow and noisy, since each extracted bit requires a distinct delayed response, so the practical risk is slow, stealthy exfiltration of database contents (hashes, user data, listing records) rather than rapid mass compromise.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject SQL through the 'reportType' parameter of the product summary report in the balancing reports section, with data recovered indirectly by measuring database response delays rather than returned in the response. The issue is remotely reachable with no user interaction but is gated behind a privileged session (vendor CVSS:4.0 base 8.5; independent assessment CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L), so confidentiality is the primary exposure while integrity and availability impacts remain limited. Exploitation status: no public exploit identified at time of analysis, and the vendor addresses it by upgrading to TMS7 v7.8; taken together this is a genuine but access-gated data-confidentiality issue in a niche OT deployment rather than an internet-wide emergency.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated high-privilege user inject SQL through the 'screenID' parameter of the electronic transaction queue viewer in the manual transactions section, using response-time delays to infer database contents. Exploitation requires an existing high-privilege (PR:H) session on the affected web interface, so anonymous and low-privilege users are excluded, and the blind, inference-based technique makes data extraction slow rather than directly returned. No public exploit code has been identified at time of analysis and the issue is remediated in TMS7 version 7.8, so despite the vendor's CVSS 4.0 score of 8.5 the practical operational priority for most terminal operators is moderate.
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application lets an attacker who already holds a high-privileged session inject SQL through the 'pattern' query parameter and infer database contents from response timing. The vendor addressed the flaw in TMS7 version 7.8, so unpatched pre-7.8 deployments are the exposed population; TOPHAT is also listed in the affected CPE set. The issue requires authenticated high-privileged access (CVSS PR:H) and the product has a limited OT footprint, so this is a real but access-gated concern rather than an internet-scale emergency, and no public exploit identified at time of analysis.
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech Systems' TMS7 and TopHat terminal-automation platforms, confirmed affecting version 7.6.3, lets an attacker with an authenticated high-privilege session force the backend database to leak data through conditional response delays. Exploitation is access-gated rather than open: the independent assessment (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) aligns with the vendor's v4.0 vector (PR:H) in requiring a privileged, authenticated foothold, and the flaws sit in OT/terminal-management deployments that are normally segmented rather than internet-facing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped a fix in TMS7 v7.8.
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and earlier lets a high-privilege authenticated attacker inject SQL through the supplier_no parameter and infer database contents by measuring conditional query delays. The vendor fixed the issue in TMS7 v7.8, documented in CISA ICS advisory ICSA-26-272-02 and tracked as EUVD-2026-89428, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because exploitation requires a privileged authenticated session against the business allocation search endpoint, the issue is access-gated rather than broadly reachable, although the assessed confidentiality and availability impacts on the database are high.
Unauthenticated SQL injection in the third-party MediaWiki UserPageViewTracker extension allows any remote attacker who can reach a wiki running an affected version to read and exfiltrate arbitrary data from the MediaWiki database backend. The flaw is present in all versions of the extension before the vendor's fixed releases 1.46.1, 1.45.5, and 1.43.10, and per the CVSS vector (AV:N/AC:L/PR:N/UI:N) requires no authentication or user interaction; impact is confined to confidentiality (C:H) with no asserted integrity or availability effect. Publicly available exploit code exists according to the CISA SSVC assessment (Exploitation: poc), but there is no KEV listing and no confirmed active exploitation, and the EPSS score is low at 0.16% (5th percentile), consistent with a genuine but moderate-priority issue whose real-world exposure is limited by the fact that the extension is optional and absent from default MediaWiki installs.
Time-based blind SQL injection in ClipBucket v5 (all builds through 5.5.3-#197) allows an authenticated administrator holding the basic_settings permission to inject arbitrary SQL through the language_id parameter of the language update function, enabling extraction or modification of database contents. The flaw is reachable over the network with no user interaction, but the high-privilege prerequisite is the primary limiting factor: neither unauthenticated nor low-privilege users can trigger it, and builds patched after upstream commit ecbdf2d5 are not affected. Publicly available exploit code exists (a published HackMD write-up demonstrating the blind SQLi), though there is no confirmed active exploitation (no CISA KEV listing); EPSS-style urgency is moderate given the admin-level access required.
Time-based blind SQL injection in ClipBucket v5 (through 5.5.3-#197) allows an authenticated administrator who holds the video_moderation permission to inject arbitrary SQL through the videoid parameter of the admin video edit function, enabling extraction and partial modification of database contents. Exploitation requires a valid high-privilege admin session with that specific permission, so anonymous or low-privilege users cannot trigger it; once such an account is authenticated, no user interaction or non-default configuration is needed. Publicly available exploit code exists (a published two-blind-SQLi write-up), and an upstream fix is available as a commit that casts videoid to an integer; the issue is a real but modest-priority finding given the authentication prerequisite.
Unauthenticated SQL injection in Flowring Agentflow 4.0 lets remote attackers run arbitrary SQL commands against the application database through the id parameter of the /WebAgenda/SMBAjaxConfigProcess.do endpoint, giving full read/write access to back-end data as returned by the vulnerable query. Only deployments running a build older than the 2025/08/08 fixed release and exposing the WebAgenda API to the network are affected; the CVSS 4.0 base score of 9.3 and the parallel CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C/I/A:H) both reflect that no authentication, user interaction, or non-default configuration is required. No public exploit code has been identified at time of analysis, but the report originates from ZUSO ART and the endpoint is trivially reachable wherever WebAgenda is internet-exposed, so the practical risk for unsegmented deployments is high.
Unauthenticated SQL injection in Flowring Agentflow 4.0 allows any remote attacker who can reach the web interface to execute arbitrary SQL statements through the 'words' parameter of the /WebAgenda/SMBAjaxAutoComplete.do endpoint. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) and our independent CVSS 3.1 assessment (9.8-equivalent high confidentiality, integrity and availability impact) agree that exploitation requires no credentials, privileges, or user interaction - only network reachability and an instance built before the 2025/08/08 fixed release. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported by ZUSO ART and remains a high-priority target for rapid patching given its trivial, pre-auth exploitation profile.
SQL injection in Bytebase DBHub 1.2.0 allows unauthenticated remote attackers to submit crafted SQL statements that the /utils/sql-parser.ts component fails to classify correctly, bypassing the MCP server's parser-level read-only enforcement so the statement reaches the backend database and can expose sensitive database information. Only version 1.2.0 is confirmed affected, and there is no public exploit code identified at time of analysis and no CISA KEV confirmation of active exploitation; no EPSS score or vendor-published fix version was present in the available intelligence. The vendor rates this Critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), whereas independent assessment places the confidentiality impact higher and integrity/availability lower (C:H/I:L/A:L), and notes that real-world exposure is substantially reduced where the DBHub MCP server is run locally or behind a trusted MCP client rather than being network-reachable.
SiYuan versions before v3.8.4 contain a SQL injection vulnerability (CWE-89) in block query embed blocks that allows remote, unauthenticated attackers to execute arbitrary SQL against the local siyuan.db database, but exploitation requires the victim to import a malicious .sy document (UI:R). Successful exploitation enables high confidentiality impact (e.g., data exfiltration via VACUUM INTO) and low integrity impact (data tampering), with no availability impact, per the independent CVSS 3.1 assessment. No public exploit or CISA KEV entry is currently known, but a vendor patch (v3.8.4) is available.
Unauthenticated SQL injection in the OrdaSoft Book Library (Free) extension for Joomla, affecting all versions below 6.4.6, allows remote attackers to inject arbitrary SQL into an ORDER BY clause via the field and direction request parameters handled by the books() function in site/booklibrary.php. Because the injection lands in an unquoted ORDER BY position, the extension's keyword-blacklist filter (protectInjectionWithoutQuote()) can be defeated with a trailing decoy comment such as '-- xselect' that makes the filter merely quote the value instead of rejecting it, and exploitation requires only a prior request to prime session-stored sort defaults before the vulnerable code path is reached. Both the vendor's CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, high C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate a fully unauthenticated, low-complexity, network-reachable flaw with high confidentiality, integrity, and availability impact; no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Real Estate Manager (Free) extension for Joomla before 6.7.9 allows remote attackers to inject arbitrary SQL through the order_field parameter, which is concatenated unquoted into the ORDER BY clause of three public frontend property-listing queries (category browsing, search results, and full listing). Because the injection point is exposed on pre-authentication pages with no login, user interaction, or non-default configuration required, any reachable installation is at risk; the assessed impact is high confidentiality loss (blind extraction of database contents), while the ORDER BY sink constrains the attacker to data-read techniques rather than direct modification. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the only reference supplied is the vendor site, so patch status should be verified directly with OrdaSoft.
Unauthenticated SQL injection in the Vehicle Manager (Free) extension for Joomla versions prior to 6.5.8 allows remote attackers to inject SQL code via the order_field and order_direction parameters at three frontend entry points (category listing, search, and all-vehicles listing). Because the injection point is an unquoted ORDER BY clause, exploitation is constrained to blind/inferential techniques, but it can still lead to high confidentiality impact (e.g., extraction of sensitive database contents) with limited integrity and availability impact. No public exploit code has been identified, and the vulnerability requires no authentication or non-default configuration, making any public-facing installation a potential target; however, the overall real-world priority is moderate due to the product's footprint.
Authenticated SQL injection in Iron Mountain enVision builds prior to 260655 allows a network-based attacker holding a low-privilege account to inject arbitrary SQL through an improperly neutralized input parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects low-complexity exploitation with no user interaction and high impact across confidentiality, integrity, and availability, meaning an authenticated user could read, modify, or destroy database contents. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but the vendor reports a patch is available; discovery is credited to TR-CERT (Turkish national CERT).
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets remote attackers push arbitrary SQL into a query parameter that is concatenated into a SQL predicate, potentially exposing or altering backend payroll data. The published CVSS 4.0 score is 9.3 with PR:N and no user interaction, and the independent assessment agrees on high confidentiality and integrity impact with no availability impact, but exploitation is time-based blind, so it demands many timed requests and is slower and more detectable than direct exfiltration. The issue is confirmed only in version R2026.2.0 after unsuccessful vendor contact attempts; no public exploit code or confirmed active exploitation was identified at time of analysis, and because much of Dayforce is delivered as vendor-hosted SaaS the set of independently exploitable targets is narrower than the raw score implies.
Unauthenticated DQL injection in AzuraCast before 0.23.8 allows remote attackers to extract sensitive database information, including user credentials and station settings, via the sortOrder parameter in the search/list API. No authentication or user interaction is required (CVSS 4.0 PR:N/UI:N), though exploitation requires network reachability to the AzuraCast web interface. No public exploit identified at time of analysis, but the flaw is trivially exploitable and affects many internet-facing radio panel deployments.
Unauthenticated SQL injection exists in the lomart.fr UP Plugin for Joomla at versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29, letting remote attackers reach the plugin's vulnerable request handlers and inject arbitrary SQL into backend database queries; the vendor-assigned CVSS 4.0 vector (8.3, AV:N/AC:L/AT:P/PR:N/UI:N) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) both describe a network-reachable, no-authentication, no-user-interaction flaw capable of returning or altering stored data. Only Joomla sites that actually have this third-party extension installed and expose the affected endpoint are in scope, and the plugin's comparatively small install base limits the overall attack surface; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). Successful exploitation depends on the injectable feature being reachable in the target deployment, which is why the CVSS 4.0 vector carries the AT:P attack-requirement flag.
Unauthenticated SQL injection in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) lets remote attackers inject arbitrary SQL into read queries through the video search and sorting parameters of the public-facing gallery. No credentials, user interaction, or non-default configuration are required - only that the extension is installed and its video search/sorting front end is reachable, which is its normal deployment state. The CNA rates it 9.3 under CVSS 4.0, our independent assessment scores it as high severity with confidentiality impact dominant (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is bounded by deployment scope: core Joomla installations without this third-party extension are not affected, but any site that does run it is exposed to unauthenticated database disclosure.
Second-order SQL injection in Budibase Server (@budibase/server) before 3.45.0 can let an authenticated attacker with DDL rights on a connected MySQL or MSSQL datasource create a malicious column name that escapes identifier quoting, then execute injected SQL when a Budibase builder later renames that column through the UI. Because the MySQL connection is opened with multipleStatements:true in this default case, stacked statements can run as the datasource user and bypass Budibase's row/table permission model, enabling arbitrary reads, writes, or destructive operations. No public exploit identified at time of analysis; vendor-released patch: 3.45.0.
SQL injection in SiYuan's graph query endpoint, affecting all releases before v3.8.4, allows an unauthenticated remote attacker to read arbitrary database rows spanning every notebook on the instance. The issue is conditionally gated: it only becomes reachable when the deployment is running in published-site mode with authentication disabled, which is a non-default configuration - standard local single-user installs and published sites that retain authentication are not exposed. Impact is limited to confidentiality (read-out of stored notes and metadata) with no data modification or service disruption described, and no public exploit has been identified at time of analysis, though the vendor has released a fix.
SQL injection in GLPI's history/logs tab allows an authenticated attacker who holds the READ right on logs to inject attacker-controlled values into a database query via crafted affected_fields filter parameters in the history-tab URL. The flaw affects GLPI releases from 9.4.0 up to but not including 10.0.26 and 11.0.8, and exploitation is gated by the READ-on-logs privilege, which is not held by ordinary or self-service users by default. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has released fixes in 11.0.8 and 10.0.26, and the issue is well-confirmed by the vendor advisory and two upstream fix commits.
Stored SQL injection in Piwigo photo gallery versions prior to 16.4.0 lets an authenticated administrator store a crafted image_order[] value that is later concatenated into ORDER BY clauses, enabling disclosure, modification, or disruption of database data. Exploitation requires a high-privileged admin account (PR:H per the assessed CVSS 3.1 vector, 7.2 High) and the precondition that at least one album contains at least one photo, so the injected expression is executed on a subsequent album or Batch Manager query rather than immediately. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 16.4.0.
Unauthenticated SQL injection in Piwigo's pending-database-upgrade authentication path lets a remote attacker bypass administrator credentials and trigger the upgrade routine on affected galleries. The flaw lives in check_upgrade_access_rights() (admin/include/functions_upgrade.php), which only applies addslashes() escaping when the legacy get_magic_quotes_gpc function exists; because that function was removed in PHP 8.0, any Piwigo instance prior to 16.4.0 running PHP 8 concatenates the submitted username straight into the upgrade authentication query. Exploitation is gated on a transient state - the instance must have a pending database upgrade so this code path is reachable - and requires a crafted query result that satisfies both the status and password checks to set PHPWG_IN_UPGRADE, which is why the assessed vector carries AC:H. There is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis, and an upstream fix is available in Piwigo 16.4.0.
Unauthenticated SQL injection in Piwigo 17.0.0beta1 and earlier lets anonymous guests read arbitrary database contents through the public photo-search flow whenever the rating feature is enabled. An attacker calls pwg.images.filteredSearch.create with a crafted ratings[] value and then opens the returned search URL; because only the lower rating bound is integer-cast while the raw upper bound is concatenated directly into the SQL filter, error-based and blind extraction - plus database-dependent time delays - become possible over the network with no credentials or user interaction. The independent assessment rates confidentiality impact as High with no Integrity or Availability impact, and upstream fixes exist only as commits (9755d88, aede490) with no released patched version identified at time of analysis; no public exploit code or confirmed active exploitation was identified.
SQL injection in Piwigo's Batch Manager (admin/batch_manager.php) allows an authenticated administrator to inject time-based or other SQL expressions through unvalidated dimension (width, height, ratio) and filesize values supplied in the filter URL, potentially disclosing, modifying, or disrupting database contents. The flaw affects Piwigo versions prior to 16.4.0 and arises because the URL filter parser stores raw values in the bulk_manager_filter session state, which is later concatenated into SQL predicates, unlike the validated POST filter path. Exploitation requires an existing high-privileged administrator account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), and no public exploit code has been identified at time of analysis; the vendor-released patch is version 16.4.0.
SQL injection in InvoicePlane's tax-rate settings allows an authenticated administrator to inject arbitrary SQL fragments into the ALTER TABLE statement that rebuilds the ip_tax_rates schema, letting them alter or drop required database columns in every release prior to 1.7.2. Because the malicious value is changed through the admin-only Settings page, exploitation requires high privileges (CVSS PR:H); the outcome is persistent schema corruption affecting financial data structures and potential loss of application availability, with integrity and availability impact rated high. No public exploit code has been identified at time of analysis, and the issue is resolved by upgrading to 1.7.2.
Authenticated SQL injection in the PESI service of IBM Guardium Data Protection 12.2 allows a logged-in attacker with network reachability to the service to inject SQL through a parameter and read sensitive records from the product's internal database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with no integrity or availability effects, and the prerequisite is a valid Guardium session - there is no pre-authentication path. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; IBM has published a vendor advisory covering the fix, making this a genuine but conditional priority that is most urgent for internet- or broadly reachable PESI deployments with many low-privilege accounts.
Unauthenticated SQL injection in the ServiceNow AI Platform allows remote attackers to execute arbitrary SQL statements against an instance's underlying database, potentially reading or altering instance data beyond its intended scope. ServiceNow has already remediated its hosted instances and shipped the update to partners and self-hosted customers, so residual exposure is confined to self-hosted or partner-managed deployments that have not yet moved to the patched release described in KB3159623. No public exploit code has been identified and the vendor states it is not aware of malicious exploitation at time of analysis, but the 9.3 CVSS 4.0 rating - along with a more conservative independent assessment that raises attack complexity to High and lowers availability impact - makes prompt patching of any remaining unpatched instance the priority.
SQL injection in phpMyFAQ versions prior to 4.1.6 lets an authenticated administrator inject arbitrary SQL through the stop-word management feature by supplying a crafted "word" value that breaks out of the string literal built in StopWords::add(). The flaw is confined to the add()/INSERT code path - the sibling update() method escapes the same input correctly - and because it requires a high-privileged admin session (PR:H) plus access to the stop-word UI, exposure is bounded to trusted operators or compromised admin credentials rather than unauthenticated attackers. Successful exploitation permits reading, modifying, or deleting arbitrary rows and tables within the phpMyFAQ database; no public exploit code has been identified at time of analysis, and the vendor-released patch is version 4.1.6.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
SQL injection in Delta Electronics DIAEnergie before version 1.11.00.022 allows an attacker holding a valid low-privileged account to read from and write to the platform's backend database, putting the confidentiality, integrity, and availability of its operational data at risk. The flaw is network reachable (AV:N), requires only a low-privileged session (PR:L), and needs no user interaction; it is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis. Delta released the fix in advisory PCSA-2026-00014 alongside a batch of related DIAEnergie flaws, including an authentication bypass (CVE-2026-78308) that could supply the very credentials this SQL injection depends on.
SQL injection in Delta Electronics DIAEnergie versions before 1.11.00.022 lets a remote attacker with any valid low-privileged account (CVSS PR:L) execute arbitrary SQL against the underlying database, resulting in full loss of confidentiality, integrity, and availability (CVE-2026-78309, CWE-89, base score 8.8). The flaw is network-reachable with low attack complexity and no user interaction, so it can be triggered directly over the DIAEnergie web interface, though valid credentials are required and the specific vulnerable parameter or endpoint has not been disclosed in the available data. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV), so the immediate risk is highest for internet- or IT-network-exposed deployments where low-privileged accounts are broadly issued. The advisory from Delta covers this CVE alongside five siblings (CVE-2026-78308 through CVE-2026-78313).
PHP object injection in the wpForo Forum WordPress plugin before 3.1.6 lets an authenticated attacker with Subscriber-level access or higher submit a crafted serialized value into a user-supplied profile field that the plugin deserializes without restricting which classes may be instantiated, as rated CVSS 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the plugin ships no POP/gadget chain of its own, escalation to remote code execution, arbitrary file operations, or SQL injection depends on a compatible chain being present via another installed plugin or theme - the factor driving the high attack complexity - and absent such a chain the outcome is limited to object injection with no confirmed high-severity effect. Publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV, SSVC exploitation: none), and this is an incomplete fix of CVE-2026-49769.
Blind SQL injection in the WordPress plugin W4 Post List (versions through 3.0.6) allows an authenticated high-privilege user - an administrator or equivalent role with access to the plugin's functionality - to inject crafted SQL into a query and infer database contents one bit at a time. The attack is remote and low complexity over the network, but it is gated entirely by the PR:H authentication requirement, so unauthenticated and low-privilege visitors cannot reach the vulnerable code path; the primary security consequence is high confidentiality loss (arbitrary data disclosure), with no integrity or availability impact in our assessment. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and no EPSS score was supplied with the source data.
Authenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows a Joomla administrator to inject arbitrary SQL through the coupon bulk update task at administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate. The flaw is a genuine injection (reported as CWE-74, functionally classic CWE-89 SQLi) where coupon IDs are concatenated straight into raw SQL IN (...) clauses instead of being cast to integers or parameterized. Exploitation is confirmed to require high privilege (PR:H in the assessed CVSS:3.1 vector), and there is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.25% (14th percentile), so despite the 8.6 headline score the practical priority is moderate-to-low because Joomla administrators already hold broad database-level trust.
Unauthenticated SQL injection in the WordPress/WooCommerce plugin Product Filter by WBW (versions 3.1.7 and earlier) lets any remote visitor inject SQL through the plugin's public-facing product-filter functionality and read arbitrary data from the site's database, with no login and no victim interaction required. The reporting source (Patchstack) and ENISA EUVD both classify this as a high-severity SQLi, while the assessed vector constrains the impact to confidentiality only (C:H/I:N/A:N) rather than the scope-change-plus-availability model that produces the 9.3 headline score, so the practical effect is large-scale data disclosure rather than remote code execution or denial of service. No public exploit code has been identified and there is no evidence of active exploitation at time of analysis; exploitation depends solely on whether the affected plugin is installed, active, and reachable on a standard WordPress deployment.
Authenticated SQL injection in the WordPress plugin Ultimeter (versions through 3.0.8) lets a high-privileged account - Editor or Administrator level - inject arbitrary SQL through the plugin's editor functionality, exposing data held in the site's WordPress database. The flaw is scored CVSS 3.1 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), where the changed scope and high confidentiality impact reflect that the database is a security authority separate from the vulnerable plugin. No public exploit identified at time of analysis; because the vector requires PR:H, realistic risk is confined to malicious insiders or attackers who have already taken over a privileged WordPress account on a site running the affected plugin version.
SQL injection in the Tainacan WordPress plugin through version 1.2.0 lets an attacker with an authenticated Subscriber-level account inject arbitrary SQL into one of the plugin's database queries, potentially reading sensitive data from the underlying WordPress database. The prerequisite is meaningful: the site must permit low-privilege account creation (for example, WordPress self-registration enabled), which substantially narrows the exposure for sites with registration disabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's own vector (AC:H) indicates some crafting or precondition beyond a trivial payload, keeping this a genuine but bounded threat rather than an opportunistic mass-exploitation risk.
SQL injection in the Easy Digital Downloads WordPress plugin through version 3.7.0 lets an authenticated account with the Shop Manager role or higher inject arbitrary SQL into an admin-side database query reachable over the network, exposing sensitive stored data such as customer records, order and payment metadata, and user password hashes, while requiring no victim interaction. The real-world barrier is the credential requirement noted in the assessed vector (PR:H), so this is chiefly a compromised- or over-privileged-account and insider risk rather than an anonymous mass-exploitation path; confidentiality impact is high, integrity impact is none, and availability impact is low. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was included in the source reporting, so exploitation signal remains limited to the advisory disclosure by Patchstack.