SQLi

Unauthenticated SQL injection in the Maps Marker Pro WordPress plugin (all versions up to and including 4.32) lets remote attackers inject arbitrary SQL against the site database without any credentials or user interaction. Reported by Patchstack and rated CVSS 9.3, the flaw exposes the backing WordPress database to unauthenticated extraction. No public exploit has been identified at the time of analysis and the CVE is not listed in CISA KEV.

SQL injection in Community by PeepSo versions up to and including 9.0.5.2 is reachable by any subscriber-level authenticated user, enabling network-based extraction of sensitive database contents with a changed scope. Classified under CWE-89, the flaw requires only low-privilege WordPress credentials and no user interaction, lowering the exploitation barrier to any registered site member. No public exploit code or CISA KEV listing is identified at time of analysis, but the minimal privilege requirement and high confidentiality impact make this a high-priority finding for sites with open registration.

SQL injection in YITH WooCommerce Membership Premium versions 2.33.0 and below allows authenticated subscribers to execute arbitrary SQL queries against the underlying database. Exploitation requires only a low-privilege WordPress subscriber account - the lowest registered user role - making the attack surface broad on any membership-enabled site. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate that successful exploitation can expose data beyond the plugin itself, including sensitive user and order records stored in the WordPress database. No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated SQL injection in the Product Shortlist WordPress plugin (versions through 1.0.4) allows any remote attacker to query the underlying MySQL database without credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects trivial network exploitation with a scope change, meaning data accessible extends beyond the plugin's own tables to the shared WordPress database. No public exploit identified at time of analysis, and the EPSS score of 0.19% (9th percentile) suggests limited observed exploitation activity consistent with a niche plugin install base.

Unauthenticated SQL injection and unauthorized data destruction affect the Dinatur WordPress plugin through version 1.18. The same vulnerable request handler accepts unsanitized user input directly into SQL queries and also executes a full database table truncation with no authorization check - meaning any unauthenticated visitor can both exfiltrate WordPress database contents and irreversibly wipe the plugin's stored data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier exploitation (no credentials, no special configuration) makes this a high-urgency finding for any site running the affected plugin.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_menu` endpoint to remote unauthenticated database manipulation via an unsanitized `id` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AV:N), no authentication or user interaction is required, enabling any network-reachable attacker to read, modify, or delete database contents. A public proof-of-concept exploit exists on GitHub, making this immediately actionable; no patch has been identified at time of analysis.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes backend database contents through the unsanitized ID parameter of the /admin/ajax.php?action=save_menu endpoint, permitting remote attackers to read, modify, or delete application data. The CVSS 4.0 vector assigns PR:N, suggesting the admin-area endpoint may be reachable without authentication - a pattern common in SourceCodester educational applications - though this should be independently verified. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified as confirmed actively exploited by CISA KEV at time of analysis), meaningfully lowering the barrier to opportunistic attacks against any internet-exposed deployment.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the unauthenticated admin login endpoint /admin/ajax.php?action=login to remote exploitation via the unsanitized Username parameter. A publicly available proof-of-concept exploit has been published on GitHub, reducing the bar for exploitation to near-zero skill level. The CVSS 4.0 vector confirms no authentication, privileges, or user interaction are required, though impact is limited to partial confidentiality, integrity, and availability compromise of the underlying database.

SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis.

SQL injection in Bottinelli Informatica Vedo Suite 1.2.5 lets a remote attacker with low-level authentication inject malicious SQL through the utente_chat parameter of the api_vedo/chat endpoint, which is reported to escalate to arbitrary code execution on the host. The flaw carries a CVSS 9.9 (scope-changed) rating, but with no public exploit identified at time of analysis and a low EPSS probability (0.29%, 22nd percentile). It affects a niche Italian business-suite product, so risk is concentrated among its specific customer base rather than broadly internet-wide.

Second-order SQL injection in Froxlor (versions before 2.3.8) enables an authenticated administrator with the change_serversettings=1 privilege to store a UNION-based SQL payload in the panel_admins.ip column via Admins.add or Admins.update, which executes without further victim interaction when IpsAndPorts.listing is called by the poisoned account, returning all administrator login names and bcrypt password hashes. A confirmed, publicly available proof-of-concept demonstrates the complete two-step store-then-trigger chain against a live instance, enabling full database exfiltration and privilege escalation from reseller admin to super-admin. No active exploitation is confirmed in CISA KEV, though the working PoC and the specific threat model of multi-admin hosting deployments materially elevate real-world risk.

SQL injection in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows remote authenticated attackers to manipulate the sourcePath argument within the ModuleController.java Move Operations component, enabling unauthorized database query execution. The vulnerability carries limited confidentiality, integrity, and availability impact per the CVSS 4.0 assessment, though a publicly available proof-of-concept exploit (E:P) elevates the practical risk above its low CVSS score alone suggests. No vendor patch has been issued; the project was notified via a GitHub issue report but has not responded.

SQL injection in the Readabler WordPress accessibility plugin (by Merkulove) before version 2.0.18 lets unauthenticated remote attackers inject arbitrary SQL against the site database. The CVSS 3.1 score is 9.3 with a scope change, reflecting that a low-privilege network request can reach and read backend data. No public exploit has been identified at time of analysis, and it is not in CISA KEV.

Unauthenticated SQL injection in the Super Store Finder WordPress plugin (versions 7.8 and earlier, vendor 'highwarden'/superstorefinder-wp) lets remote attackers inject arbitrary SQL through unsanitized input reachable without authentication. The CVSS 3.1 base score is 9.3 and the flaw was catalogued by Patchstack under CWE-89; no public exploit code and no active-exploitation listing were identified at time of analysis. Because no login is required (PR:N) and the injection point is network-reachable, an attacker can extract WordPress database contents such as user records and password hashes.

SQL injection in the JetAppointment (JetAppointments Booking) WordPress plugin by Crocoblock lets remote unauthenticated attackers inject arbitrary SQL through the booking workflow in all versions up to and including 2.5.2. Rated CVSS 9.3 (CWE-89), it enables extraction of sensitive database contents such as user records and credentials without any login. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated SQL injection in the WordPress plugin Affiliates Manager (by wp.insider) through version 2.9.53 lets remote attackers inject crafted SQL through affiliate-facing input without any authentication (PR:N), enabling extraction of sensitive database contents such as user records, affiliate payout data, and WordPress secrets. The high CVSS base score of 9.3 is driven by network reach, low complexity, and a scope change (S:C) reflecting impact on the wider WordPress database beyond the plugin's own tables. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but SQLi in a public-facing WordPress plugin is a well-understood and easily weaponized class.

SQL injection in License Manager for WooCommerce (versions ≤ 3.0.18) enables authenticated customers to execute arbitrary SQL queries against the underlying WordPress database, achieving a scope change that exposes high-confidentiality data across the shared database - including license keys, customer PII, WooCommerce order records, and hashed WordPress credentials. Exploitation requires only a low-privilege customer account, making the attack surface broad on stores with open registration. No public exploit code or CISA KEV listing has been identified at time of analysis, though SQL injection in WordPress plugins is a historically well-understood attack class that lowers the barrier to POC development post-disclosure.

SQL injection in the Modern Events Calendar WordPress plugin (versions prior to 7.35.0 by Webnus Inc.) allows unauthenticated remote attackers to inject arbitrary SQL through user-supplied input, enabling extraction of sensitive database contents such as user credentials and secrets. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely reachable with no authentication or user interaction, making it a high-priority patch. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

SQL injection in the Sticky Chat Widget WordPress plugin (by gingerplugins) affects all versions up to and including 1.4.2, allowing remote unauthenticated attackers to inject arbitrary SQL and read sensitive database contents. Rated CVSS 9.3 with a scope-changed vector, it requires no authentication or user interaction, making it directly reachable on any site running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated SQL injection in the Depicter Slider WordPress plugin (versions <= 4.8.0) allows remote attackers to query the underlying WordPress database without any credentials. The scope-changed CVSS vector (S:C, C:H) indicates the attack reaches beyond the WordPress application layer into the database tier, enabling high-confidentiality data extraction including user credentials and sensitive site content. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature of the flaw substantially lowers the bar for exploitation.

SQL injection exploitable by authenticated subscribers in Gravity Forms Bookings Premium versions through 2.1 enables remote database extraction from affected WordPress installations. The CVSS 8.5 rating reflects network accessibility, low attack complexity, subscriber-level privilege requirements, and a scope change that extends confidentiality impact to the underlying database layer beyond the plugin itself. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege threshold significantly broadens the realistic attacker pool on sites with open user registration.

SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.

SQL injection in PHPGurukul Complaint Management System 1.0 exposes the user/check_availability.php endpoint to remote unauthenticated database manipulation via a crafted email parameter, enabling unauthorized data read, write, and limited availability disruption against the backend database. A public proof-of-concept exploit is confirmed available on GitHub, lowering the skill bar for opportunistic exploitation. No CISA KEV listing at time of analysis, but the CVSS 4.0 vector includes E:P confirming exploit code exists publicly.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.

SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.

SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject1.php` endpoint to unauthenticated remote attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the underlying database. The vulnerability carries a CVSS 4.0 score of 6.9 with no authentication or user interaction required, and a proof-of-concept exploit has been publicly disclosed via GitHub. No KEV listing exists, but the public POC materially lowers the barrier to exploitation for opportunistic attackers targeting exposed instances.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject2.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites. Public exploit code exists per the referenced GitHub issue, lowering the skill bar for attackers, though no CISA KEV listing confirms widespread active exploitation at time of analysis.

SQL injection in ERPNext's Inactive Customers report allows any authenticated user to manipulate raw database queries via an unvalidated doctype filter parameter. Affected versions prior to 15.116.0 (v15 branch) and 16.23.0 (v16 branch) interpolate user-supplied input directly into f-string SQL in get_sales_details and get_last_sales_amt, enabling exfiltration of sensitive ERP data and limited database manipulation. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.

SQL injection in Budibase's PostgreSQL datasource connector allows an authenticated administrator to execute arbitrary DDL and DML statements against the connected PostgreSQL database by supplying a crafted schema name containing embedded double quotes. The vulnerable code in packages/server/src/integrations/postgres.ts interpolates the schema field directly into a SET search_path statement using the simple query protocol, which permits semicolon-delimited multi-statement execution. Impact includes full database read and write access - including extraction of pg_shadow password hashes and potential OS-level file reads via pg_read_file(). No public exploit or CISA KEV listing identified at time of analysis; however, the GHSA advisory provides a complete, step-by-step reproduction procedure making this trivially reproducible. Fixed in version 3.39.19.

SQL injection in SourceCodester Pet Grooming Management Software 1.0 exposes the /admin/get_barcode_data.php endpoint to remote attackers who can manipulate the unsanitized 'barcode' parameter to read, alter, or corrupt the underlying database. The CVSS 4.0 vector assigns no authentication or user-interaction requirement, and a publicly available proof-of-concept lowers the exploitation bar to script-level effort. No CISA KEV listing exists, but the combination of a network-exposed attack surface and published exploit code makes this a higher practical priority than the nominal Medium score implies for any internet-facing deployment.

SQL injection in Page Builder CK for Joomla (versions before 3.6.5) lets attackers manipulate database queries through the extension's styles model, exposing the underlying database to unauthorized read and write. The flaw is exploitable remotely without authentication per the CVSS 4.0 vector (AV:N/PR:N/UI:N), with the frontend attack surface closed in 3.6.4 and the backend surface closed in 3.6.5. No public exploit identified at time of analysis, but the CWE-89 root cause and the reported 9.3 severity make this a high-priority patch for affected Joomla sites.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewprescriptionrecord.php endpoint to authenticated remote attackers who can manipulate the `delid` parameter to execute arbitrary SQL commands against the underlying database. Publicly available exploit code exists on GitHub, confirmed by the CVSS 4.0 E:P modifier, though no CISA KEV listing indicates active widespread exploitation at time of analysis. Given the healthcare context, the combination of public exploit availability and sensitive patient data makes this a higher-priority remediation than the low CVSS 4.0 score of 2.1 alone suggests.

Blind SQL injection in Google SecOps (Chronicle SOAR) versions before 6.3.85 lets an authenticated user abuse a crafted request parameter in a legacy dashboard widget API to run arbitrary blind SQL queries against the backend database. CVSS 4.0 rates it 9.4 (critical) with a low-privilege network vector; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Because the platform is a Google Cloud-managed SaaS, the fix was deployed by the vendor and no customer action is required.

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter in /viewpaymentreport.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any reachable instance. The CVSS 4.0 vector confirms low-privilege authentication is required (PR:L), and impact is rated partial across confidentiality, integrity, and availability - though SQL injection primitives can often be escalated beyond initial scoring to achieve broader data extraction.

SQL injection in itsourcecode Hospital Management System 1.0 exposes patient management functionality to low-privileged authenticated attackers who can manipulate the `delid` parameter in /viewpatient.php to alter or extract database records. Successful exploitation allows unauthorized read, modification, or deletion of patient data, carrying significant regulatory and privacy consequences in healthcare environments. A proof-of-concept exploit has been publicly disclosed via GitHub, materially lowering the bar for opportunistic attacks against unpatched instances; the vulnerability is not currently listed in the CISA KEV catalog.

SQL injection in Qcms 6.0.6 lets remote attackers inject arbitrary SQL through the backend tableField action, enabling database compromise and, per the advisory tagging, escalation toward arbitrary code execution. The flaw is documented in a white-box audit write-up but is not listed in CISA KEV, and its EPSS probability is low (0.20%, 10th percentile), indicating no evidence of widespread automated exploitation yet. Qcms is a niche PHP content-management system, so real-world exposure is limited despite the high CVSS score.

SQL injection in Stud.IP (an open-source learning management system widely used in German-speaking higher education) affects the 6.0.x branch before 6.0.3 and the 5.4.x branch before 5.4.12, where unsanitized input reaching store() persistence functions lets a remote attacker read and manipulate database contents and, per the researcher's write-up, escalate to arbitrary code execution. The flaw carries a CVSS 9.1 (C:H/I:H) rating with a public technical write-up available from the reporting researcher; there is no public exploit identified as weaponized and no CISA KEV listing at time of analysis. Organizations running the affected LMS branches should treat this as high priority given the confidentiality and integrity impact combined with the RCE claim.

SQL injection in Brainformatik CRM+ through version 2025.6 allows remote unauthenticated attackers to inject arbitrary SQL via the appointment conflict-checking AJAX endpoint (index.php?module=Appointments&action=CheckConflictOfDates), enabling full database compromise. The flaw is time-based (blind) but scores CVSS 9.8 with total technical impact; a public proof-of-concept exists (CISA SSVC: exploitation=poc) though it is not yet in CISA KEV. EPSS is low (0.16%, 6th percentile), indicating no widespread automated exploitation observed to date despite the critical severity.

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privilege escalation because the `azuracast:restore` command runs the extracted `db.sql` file verbatim, with no content validation. The flaw carries a critical 9.8 CVSS from the reporter and has publicly available exploit code, though its EPSS probability is low (0.23%, 14th percentile) and it is not on CISA KEV. The real-world attack surface hinges on who can supply and trigger restoration of a crafted backup archive.

SQL injection in Phoca Cart, an e-commerce extension for Joomla, allows unauthenticated remote attackers to extract the entire database via the public shop items page. Versions 5.0.0 through 6.1.16 concatenate the a[] (attribute) and s[] (specification) GET array parameters directly into SQL WHERE clauses, so an attacker can dump credentials and order data using time-based blind techniques. No public exploit identified at time of analysis, but the flaw is trivially reachable and rated CVSS 4.0 9.3 (Critical).

SQL injection in the Gallery by BestWebSoft WordPress plugin (all versions through 4.7.9) allows Editor-level or higher authenticated attackers to exfiltrate or manipulate the entire WordPress database by injecting arbitrary SQL via crafted array key names in the `_gallery_order_{post_id}` POST parameter. The `gllr_save_postdata()` function writes these unsanitized array keys directly into post meta without escaping or prepared statements, and downstream SQL queries consume them verbatim. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.

SQL injection in the WC Vendors WordPress plugin (all versions through 2.7.0) enables authenticated shop managers to exfiltrate arbitrary records from the WordPress database via the 'status' parameter across multiple REST API admin endpoints. The flaw exploits a sanitization bypass specific to the WordPress REST API: WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before registered sanitize callbacks execute, stripping WordPress's magic-quotes protection while leaving SQL metacharacters intact; sanitize_text_field then removes HTML but passes quotes and comment sequences through to the underlying SQL query unchanged. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the high confidentiality impact and the fact that multivendor marketplaces routinely grant shop manager access to untrusted third-party sellers elevate real-world risk for this plugin's typical deployment.

SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Second-order SQL Injection in the Slider Hero with Video Background, Animation WordPress plugin (versions up to and including 9.1.7) allows authenticated administrators to exfiltrate arbitrary data from the WordPress database. The vulnerability arises in the slide-duplication workflow: slide fields are safely parameterized on write, but re-read as raw strings and concatenated directly into an INSERT statement without any escaping when an administrator invokes the heroduplicateslider action. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

SQL injection in the User Login History WordPress plugin (all versions ≤2.1.7) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'blog_id' parameter, exposing the full WordPress database to read access. The vulnerability is constrained to WordPress multisite deployments and requires Administrator-level credentials, limiting its real-world attack surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis; a code-level fix appears to have been committed upstream per the plugin repository changeset.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.

SQL Injection in the Quiz and Survey Master (QSM) WordPress plugin versions up to and including 11.2.1 allows authenticated attackers with custom-level access or above to extract sensitive data from the underlying WordPress database. The flaw resides in the 'randon_category' Quiz Option parameter, where insufficient escaping and improper SQL query preparation permit arbitrary SQL to be appended to existing queries. No public exploit code or active KEV listing has been identified at time of analysis; however, the targeted parameter is accessible to any user holding a custom or higher WordPress role, broadening the realistic attacker pool beyond just administrators.

SQL Injection in the Fullscreen Galleria WordPress plugin (all versions through 1.6.12) allows authenticated attackers holding contributor-level access or higher to append arbitrary SQL subqueries via an unsanitized 'href' attribute in post content, enabling full read-access to the WordPress database. Multiple vulnerable sinks in galleria-fs.php (lines 68, 74, 146, 1074, 1078) were identified and disclosed by Wordfence; upstream fix commits have been published to the WordPress plugin repository. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this at moderate real-world priority, elevated for sites with open contributor registration.

Second-order SQL injection in NEX-Forms - Ultimate Forms Plugin for WordPress (versions through 9.2.4) enables authenticated attackers with admin-level access to extract arbitrary data from the WordPress database by abusing insufficient escaping on the 'additional_params' parameter. The attack is staged: a malicious payload is first stored via the submission_report2 AJAX handler, which notably lacks a nonce check and whose required capability can be configured down to subscriber-level, then the injection fires when an administrator triggers a CSV export. No public exploit or active exploitation has been confirmed at time of analysis, but the privilege-downgrade path on the AJAX handler meaningfully complicates the PR:H framing of the official CVSS vector.

SQL injection in Evergreen's open-ils.fielder OpenSRF Service, exposed via the /osrf-gateway-v1 HTTP gateway endpoint, affects all actively maintained branches through 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The CVSS 4.0 vector confirms network-accessible, unauthenticated exploitation with low attack complexity, yielding partial confidentiality, integrity, and availability impact against the underlying database. A public proof-of-concept has been disclosed and patched releases (3.14.12, 3.15.12, 3.16.6, 3.17-beta2) are available, making delayed remediation difficult to justify given the exploit's public availability.

SQL injection in SourceCodester Stock Management System 1.0 exposes the `/classes/Master.php?f=delete_supplier` endpoint to database manipulation by authenticated high-privileged users. The `id` parameter is passed unsanitized to the backend SQL query, enabling an attacker to read, modify, or delete database records. A publicly available exploit exists on GitHub, though exploitation is bounded by the high-privilege authentication requirement and the CVSS 4.0 base score of 2.0 reflects limited real-world blast radius. No active exploitation (CISA KEV) has been confirmed.

SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.

SQL injection in the `cat_id` parameter of `/homeaction.php` in code-projects Online Shopping System 1.0 exposes the backend database to remote attackers holding low-privilege authenticated sessions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms low-complexity network exploitation with a public proof-of-concept documented on GitHub, lowering the skill bar for abuse. Successful exploitation yields limited read, write, and availability impact against the application's database; no public active exploitation (KEV) has been confirmed.

SQL injection in code-projects Online Shopping System 1.0 exposes the `/action.php` endpoint to database manipulation via the unsanitized `proId` parameter. Attackers with low-privilege application access can send crafted HTTP requests over the network to read, alter, or corrupt backend database contents - impacting confidentiality, integrity, and availability. Publicly available exploit code exists per the GitHub disclosure, significantly lowering the skill barrier for opportunistic attackers despite the low CVSS 4.0 base score of 2.1.

SQL injection in code-projects Online Shopping System 1.0 allows remote unauthenticated attackers to manipulate the email parameter on the /login.php endpoint, potentially bypassing authentication and reading or modifying backend database contents. A public proof-of-concept exploit has been published on GitHub, confirming practical exploitability. No patch is available at time of analysis, and the product is a low-prevalence academic/demo codebase with no indication of CISA KEV listing.

SQL injection in code-projects Online Food Order System 1.0 allows remote authenticated attackers to manipulate the `checkbox` parameter in delete_food_items1.php to inject arbitrary SQL into the backend database. A proof-of-concept exploit has been publicly published on GitHub, and the CVSS 4.0 score of 2.1 reflects bounded confidentiality, integrity, and availability impact limited to the application's data scope. No CISA KEV listing and no vendor patch have been identified; this appears to be a researcher-reported vulnerability in niche academic software with negligible enterprise deployment.

SQL injection in Jinher OA 1.0 exposes the attendance approval endpoint to unauthenticated remote attackers via the unvalidated `httpOID` parameter in `/C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx`. Publicly available exploit code exists, lowering the bar for exploitation significantly. The vendor was notified prior to disclosure but did not respond, meaning no official patch has been issued.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_teacher.php` endpoint to unauthenticated remote exploitation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated, network-accessible exploitation with partial confidentiality, integrity, and availability impact. A public proof-of-concept exploit exists (E:P in CVSS 4.0 threat metrics); no vendor-released patch has been identified at time of analysis.

SQL Injection in WPML Multilingual CMS for WordPress allows authenticated attackers holding translator-level access or above to extract sensitive information from the underlying database on all plugin versions through 4.9.5. The vulnerable code resides in the Translation Manager REST API's job-ordering logic - specifically the unsanitized 'sorting' parameter processed by OrderQueryHelper - where user-supplied input is appended to existing SQL queries without adequate escaping or prepared-statement protections. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the translator role is routinely provisioned on multilingual WordPress sites, making the authenticated barrier lower than it may appear from the CVSS score alone.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.

SQL injection in AppFlowy Cloud's qcuiknote feature enables authenticated users to exfiltrate arbitrary data from the underlying database. Affecting all tracked versions of cpe:2.3:a:appflowy-io:appflowy-cloud, this vulnerability carries a CVSS 4.0 score of 7.1 driven by high confidentiality impact and network reachability at low complexity. A proof-of-concept exploit is publicly available from Project Black (PRJBLK), materially elevating real-world risk; no vendor-released patch has been identified at time of analysis.

SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.

SQL Injection in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin through version 4.5.1 exposes sensitive healthcare database contents to authenticated low-privilege users. The unsanitized 'searchTerm' parameter in SettingsController/ListingData.php (lines 69, 442, 456) is interpolated directly into SQL queries without parameterization, enabling arbitrary data extraction from the underlying WordPress database - including patient records, clinical data, and credential hashes. Exploitation is constrained to KiviCare custom roles bearing the 'settings_view' permission (e.g., Doctor, Receptionist), limiting but not eliminating insider-threat and compromised-account scenarios. No public exploit identified at time of analysis and no CISA KEV listing confirmed.

SQL injection in the Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms WordPress plugin (all versions through 5.1) exposes WordPress database contents to authenticated attackers holding editor-level or higher roles. The 'key' parameter in plugin admin functionality lacks sufficient escaping and prepared-statement handling, allowing appended SQL to read arbitrary database tables. No public exploit exists and the vulnerability is not listed in CISA KEV; exploitation is constrained by the high privilege requirement, keeping real-world risk moderate despite the high confidentiality impact.

Second-order SQL injection in the Contest Gallery WordPress plugin (all versions through 30.0.7) allows authenticated attackers with author-level access to append arbitrary SQL into backend queries via the `cgRealId` parameter within the `cg_multiple_files_for_post` upload mechanism. The injected payload is first stored in the database without adequate sanitization and later executed unsafely by backend AJAX handlers in `ajax/ajax-functions-backend.php` and gallery administration scripts, enabling extraction of sensitive information from the WordPress database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.

SQL injection in the Groundhogg WordPress CRM plugin (versions through 4.5.14) permits authenticated attackers holding vendor-level or higher access to append arbitrary SQL to database queries via the insufficiently escaped 'tag_query' parameter, resulting in full read-access to the WordPress database. The exploitation path is non-trivial: the attacker must deliberately force execution into the deprecated Legacy_Contact_Query handler by submitting an unknown filter type that triggers a FilterException, bypassing the modern query handler's protections. No public exploit has been identified at time of analysis, and the vendor has issued a code fix (SVN changeset 3643654), though the exact patched release version is not independently confirmed in available data.

Unauthenticated SQL injection in the Object Sync for Salesforce WordPress plugin exposes any site running the plugin to full database read access via its publicly accessible REST push endpoint. The vulnerable route `/wp-json/object-sync-for-salesforce/push/` imposes no capability check or nonce validation, and the `wordpress_object_type` parameter is concatenated directly into a raw SQL query without `$wpdb->prepare()` parameterization, enabling time-based blind injection. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication and only a valid post ID, making exploitation trivially accessible to any remote attacker with network reach to the target.

SQL injection in the Image Uploader for Welcart WordPress plugin (all versions up to and including 1.4.6) allows authenticated attackers holding author-level access or above to exfiltrate sensitive data from the WordPress database by appending arbitrary SQL to queries constructed around the unsanitized 'post_title' parameter. The root cause is the absence of both input escaping and prepared statement usage in the plugin's database interaction code, confirmed by Wordfence with direct source code references. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low authentication bar makes this a credible risk on any multi-author Welcart installation.

SQL injection in iCagenda, a Joomla event calendar extension by icagenda.com, affects all versions prior to 4.0.11 and allows authenticated backend operators with iCagenda access permissions to execute arbitrary SQL through an unescaped numeric filter parameter. Successful exploitation yields full database confidentiality, integrity, and availability compromise - enabling data exfiltration, modification, or destruction of the underlying Joomla database. No public exploit or CISA KEV listing has been identified at time of analysis, and the PR:H requirement limits the realistic attacker pool to trusted insiders or compromised admin accounts.

SQL injection in the iCagenda event-management extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through the mod_icagenda_calendar calendar module, which is reachable via Joomla's com_ajax endpoint without any session, CSRF token, or user account. Affected versions run from 4.0.0 through 4.0.11, and the CVSS 4.0 base score of 9.2 (Critical) reflects high confidentiality impact with additional integrity and availability effects. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial reachability makes it a strong patch priority.

SQL injection in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote authenticated attackers to bypass security restrictions by injecting special elements into SQL commands, yielding limited confidentiality and integrity impact (C:L/I:L per CVSS). The CVSS medium score of 5.4 reflects the authentication barrier (PR:L) and bounded scope - no availability impact and no scope change. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available via IBM advisory node/7283359.

SQL injection in LimeSurvey Community Edition 7.0.5 exposes the Central Participant Database (CPDB) token-copy workflow to authenticated database exfiltration. An attacker with survey-level access can inject malicious SQL through unsanitized `participantId`, `surveyId`, `tokenFieldname`, and `participantAttributeId` parameters in `Participant.php`, achieving high-confidence read access to the underlying database with limited write impact. No public exploit identified at time of analysis; a vendor fix is available as a GitHub commit but a formally versioned patched release is not independently confirmed.

SQL injection in Emlog 2.6.20 and earlier exposes the database to full compromise through the queryDatabase function in ai.php, a component of the platform's AI feature set. The CVSS 4.0 vector (PR:H) confirms exploitation requires high-privilege authenticated access, yet the resulting impact is rated High across confidentiality, integrity, and availability of the vulnerable system. No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated SQL injection in Metacat 2.0.0 through 3.4.0 lets remote attackers read, modify, and delete the entire backing PostgreSQL database via the nodeId parameter of the /cn/v1/object and /cn/v2/object REST endpoints. Because SQL errors are mirrored back inside Metacat's XML error responses, an attacker can use error-based extraction (e.g. PostgreSQL CAST) to exfiltrate arbitrary data with no credentials. Full working proof-of-concept exploits have been developed and verified by the reporter, though there is no public exploit identified and no CISA KEV listing at time of analysis.

SQL injection in Tenable Security Center exposes unauthorized database records to authenticated low-privilege users over the network. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N vector confirms straightforward network exploitation with high confidentiality impact and limited integrity exposure. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor has published advisory TNS-2026-22.

SQL injection in Tenable Security Center permits an authenticated administrator to execute arbitrary SQL queries against the underlying database, exposing sensitive data including stored credentials. The CVSS vector (PR:H) confirms exploitation requires existing administrator-level access, placing this squarely in the insider threat and compromised-admin scenario space. No public exploit code or active exploitation has been identified at time of analysis, but the 'Authentication Bypass' tag signals that extracted credentials could enable downstream privilege escalation or lateral movement into connected systems managed by Security Center.

SQL injection in SourceCodester Simple Client Management System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized `ID` parameter in `/classes/Master.php?f=save_service`. The vulnerability allows arbitrary SQL query manipulation, enabling data exfiltration and potential data modification against the backend database. A publicly disclosed proof-of-concept exploit exists (referenced in GitHub issue lyf3273/CVE/issues/3), elevating near-term exploitation risk for any internet-exposed instances despite the limited prevalence of this product.

SQL injection in SiYuan's backlink/mention search (kernel/model/backlink.go) lets unauthenticated attackers execute arbitrary SQL against the self-hosted note-taking application through v3.7.2. Because the search routine escapes only double quotes and leaves single quotes intact, a crafted keyword or malicious stored block metadata breaks out of the SQL string literal on the primary read-write siyuan.db handle, enabling cross-notebook read and write. VulnCheck reports the flaw (CVSS 4.0 base 9.9); no public exploit identified at time of analysis, and it is fixed in v3.7.4.

SQL injection in the Paymob for WooCommerce WordPress plugin (versions before 4.1.9) allows unauthenticated remote attackers to read arbitrary data from the WordPress database - including user credentials and application secrets - by submitting a crafted payment callback request. The critical design flaw is that the unsanitized client-supplied identifier is passed directly into a SQL query before the plugin validates the payment provider's HMAC signature, entirely bypassing the intended authentication gate. Both in-band (reflected) and time-based blind extraction techniques are viable, maximizing attacker flexibility. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, though the unauthenticated, low-complexity attack vector makes this a high-priority patching target for any site running this plugin.

Time-based SQL injection in the affiliate-toolkit WordPress plugin (all versions up to and including 3.8.8) enables authenticated administrators to blindly enumerate and extract arbitrary data from the WordPress database by manipulating the unsanitized `orderby` parameter in template administrative pages. The impact is limited to confidentiality - database modification and denial-of-service are not achievable via this vector. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, consistent with the high authentication barrier (PR:H) that substantially constrains real-world exploitability.

SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared `data[queryCondition]` parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; remediation urgency is driven by data sensitivity rather than observed threat activity.

SQL injection in SourceCodester Air Cargo Management System 1.0 exposes the `/classes/Master.php?f=save_cargo_type` endpoint to database manipulation via a crafted `id` argument. Exploitation requires high-privilege authenticated access (CVSS 4.0 PR:H), constraining the realistic attacker pool to compromised or shared administrator accounts. A public proof-of-concept is available on GitHub, confirmed by VulDB reporting; no patch has been identified at time of analysis.

Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized `table` parameter in `modules/Students/includes/Medical.inc.php`. While `DBEscapeIdentifier()` prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.

Unauthenticated SQL injection in Raisecom Communication Command and Dispatch Management Platform (versions up to 7.6.5) exposes backend database contents via the `sip` parameter in `/app/users/getpwd.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, zero-prerequisite exploitation, and a public proof-of-concept exploit is already available. The vendor did not respond to disclosure, leaving no patch available and no official guidance for affected operators.

SQL injection via MySQL backtick escape failure in Budibase's schema discovery feature allows an attacker with MySQL table-creation privileges to achieve arbitrary SQL execution on the underlying database. Affected versions prior to 3.39.18 interpolate raw table names into DESCRIBE queries while the MySQL connection has multipleStatements enabled, meaning a maliciously named table breaks out of the backtick-quoted identifier and executes attacker-controlled SQL when a Budibase administrator next triggers schema introspection. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the GHSA advisory provides a detailed step-by-step reproduction sufficient for exploit development.

SQL injection in Budibase's Oracle datasource connector (versions before 3.40.0) exposes the underlying Oracle database to arbitrary read and write operations by authenticated platform users. The post-write row lookup query concatenates table names into SQL identifiers without escaping double-quote characters, enabling injection of arbitrary SQL that executes under the datasource's Oracle database user account. No public exploit code or CISA KEV listing has been identified; the CVSS 4.0 score of 8.8 reflects high C/I/A impact but is tempered by significant access preconditions including high privilege requirements and an atypical table-naming condition.