SQLi
Monthly
SQL injection in the WP Directory Kit WordPress plugin before 1.5.5 lets unauthenticated attackers inject arbitrary SQL through an unsanitised, unescaped request parameter, exposing the entire WordPress database. Reported by WPScan and rated CVSS 9.1 (high confidentiality and integrity impact), it affects any site running the vulnerable versions. There is no public exploit identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), suggesting no observed mass exploitation yet.
SQL injection in the Iptanus File Upload WordPress plugin (all versions before 5.1.8) enables unauthenticated remote attackers to query the underlying WordPress database without any credentials or user interaction. The CVSS scope-change indicator (S:C) reflects that the injection can reach data beyond the plugin's own tables - including WordPress core tables containing admin password hashes, user emails, and site configuration. No public exploit identified at time of analysis, and EPSS at 0.18% (7th percentile) suggests exploitation has not yet been observed at scale, though the unauthenticated attack surface makes it an attractive target as awareness grows.
SQL injection in the CubeWP Framework WordPress plugin (all versions before 1.1.31) allows any authenticated user with Subscriber-level access or above to execute arbitrary SQL queries against the WordPress database via a crafted AJAX action. The vulnerability is compounded by a missing capability check on the affected AJAX endpoint, meaning the lowest-privilege WordPress user role can reach and exploit it without restriction. EPSS is low at 0.16% (5th percentile) and no public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication bar makes mass exploitation feasible on sites with open registration.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
SQL injection in Plesk Obsidian up to version 18.0.80 on Linux and Windows allows any authenticated panel user to read arbitrary data from the underlying control panel database. The CVSS scope change (S:C) reflects that the injected queries cross the application boundary into the database tier, and the high confidentiality impact (C:H) is consistent with a hosting control panel whose database contains cross-tenant customer records, credentials, and configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
SQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenticated user, including low-privilege Subscribers. Two compounding weaknesses drive this: a missing capability check on an AJAX action allows unprivileged users to reach a sensitive endpoint, and unsanitized attacker-controlled input is then passed directly into a raw SQL query. A publicly available POC exists via WPScan, and SSVC rates the technical impact as total, though EPSS remains low at 0.16%, suggesting no widespread automated exploitation at time of analysis.
SQL injection in FineAdmin V1.0 (FineAdmin.Mvc) lets remote attackers inject arbitrary SQL through the `field` and `order` parameters of paginated list endpoints, where user input is concatenated into an ORDER BY clause that cannot be safely parameterized. NVD rates it CVSS 9.8 with full confidentiality, integrity, and availability impact, and public GitHub write-ups documenting the ORDER BY-clause injection exist, though EPSS remains low at 0.40% (33rd percentile) and it is not in CISA KEV - so no public exploit is confirmed as weaponized. The 'RCE' tag reflects theoretical escalation from SQLi to code execution (e.g. via stacked queries), but the demonstrated impact is database compromise.
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. A publicly available proof-of-concept exists via WPScan, raising the practical exploitation risk significantly beyond what CVSS base score alone conveys.
SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions 1.6.0 through 1.6.3, letting remote attackers inject arbitrary SQL through an application that relies on this DBD backend for query construction or escaping. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it allows unauthorized reading and modification of Oracle-backed data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is reachable by unauthenticated remote attackers (CVSS 9.3, AV:N/PR:N). Because the CVSS scope is Changed with high confidentiality impact, a crafted request can coerce the plugin into executing attacker-controlled SQL, exposing WordPress database contents such as user records and secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Patchstack.
SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.6) is exploitable by any authenticated subscriber-level user, the lowest WordPress role available to registered users. The CVSS scope change (S:C) indicates the injection escapes the plugin's own query context and can reach the broader WordPress database, yielding high confidentiality impact against data owned by other plugins or core tables. No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar significantly lowers the effective exploitation threshold on sites with open user registration.
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers to execute arbitrary SQL against the WordPress database. The CVSS scope change (S:C) indicates the injection can reach database resources beyond the plugin's own tables, including WordPress user credentials, private posts, and configuration data. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Qode Tours WordPress plugin (versions up to and including 3.1.3.1) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's tour/booking functionality. Because no authentication or user interaction is required (CVSS 9.3, PR:N/UI:N) and the scope is changed, an attacker can extract sensitive data from the WordPress database, such as user records and credential hashes. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
SQL injection in Loca Software Informatics Technology Ltd. Co. CMS (all versions up to and including build 06082026) allows remote unauthenticated attackers to inject arbitrary SQL through improperly neutralized input, per CVSS PR:N. Disclosed by Turkey's national CERT (TR-CERT/USOM), the flaw carries a critical 9.8 score with full confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor was contacted but did not respond, so no fix is available.
SQL injection in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitised parameter, exposing the WordPress database. Reported by WPScan with publicly available exploit code, this flaw is notable for affecting a code path distinct from the previously patched CVE-2024-44004, indicating an incomplete prior fix. Despite a CVSS 9.1 and public POC, the EPSS score is low (0.18%, 7th percentile) and the CVE is not on CISA KEV, so there is no public exploit identified as actively exploited in the wild.
SQL injection in Directus before 12.1.0 enables an authenticated administrator to execute arbitrary SQL against the underlying PostgreSQL database during collection creation by embedding attacker-controlled SQL syntax within a geometry field type value. The attack is gated behind two non-default prerequisites - administrator-level credentials and a PostgreSQL backend with the PostGIS extension installed - which together constrain the realistic threat surface to insider risk or compromised admin accounts. A vendor patch is confirmed available in v12.1.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Subrion CMS's admin grid sorting helper exposes virtually all admin grid endpoints to authenticated SQL injection via a raw, unescaped `sort` GET parameter interpolated directly into an ORDER BY clause. Any valid admin session can exploit approximately 29 grid controllers - most of which carry no or incomplete column whitelists - using error-based (EXTRACTVALUE) or time-based (SLEEP) techniques to exfiltrate full database contents, including administrator password hashes. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected endpoints and straightforward technique make exploitation trivial for any attacker holding admin credentials.
SQL injection in Koha's guided report builder (`reports/guided_reports.pl`) allows any authenticated staff member holding the low-privilege `create_reports` or `execute_reports` permission to perform time-based blind SQL injection against the Koha database, which stores patron PII, borrowing history, and staff/LDAP credentials. The `order_by` and dynamically-named `{order}_ovalue` CGI parameters are concatenated verbatim into an ORDER BY clause by `C4::Reports::Guided` with no allowlist, escaping, or prepared-statement binding - a structural defect, since SQL placeholders cannot parameterize column names. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack technique is well-understood and the affected permission is routinely granted to non-admin library staff.
Time-based blind SQL injection in Cacti's ORDER BY handling allows any authenticated user - regardless of privilege level - to extract, modify, or destroy the Cacti database by supplying a crafted `sort_column` GET parameter to at least four administrative endpoints. The root cause is a regex-based sanitization allowlist in `sanitize_sql_column()` (lib/functions.php) that explicitly permits parentheses to support SQL expressions like `COUNT(id)`, inadvertently passing payloads such as `SLEEP(5)` through unmodified before they are concatenated into unparameterized ORDER BY clauses. No public exploit code or KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a credible priority for any organization running Cacti.
SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated `format` HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's `fmt.Sprintf()` in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Inventory-Management-System-PHP application (Harsh21Patel GitHub project) allows unauthenticated attackers to fully bypass authentication and destructively manipulate the product database. login.php concatenates raw POST email/password into its query, so a payload like email=' OR 1=1 LIMIT 1-- - logs in as the first user, while delete.php runs a DELETE on an unsanitized GET id parameter with no auth check, enabling arbitrary row deletion and blind SQLi. No public exploit identified at time of analysis, though the advisory itself publishes working payloads; the flaw carries CVSS 9.8 and is not listed in CISA KEV.
SQL injection in Mautic's `getLeadIdsByFieldValueAction` endpoint allows any authenticated user to extract arbitrary database contents by supplying a malicious `field` parameter that is concatenated directly into a SQL query as an unvalidated column identifier. The flaw is rooted in Doctrine ORM's structural inability to parameterize SQL identifiers - the only sanitizer applied, `InputHelper::clean()`, HTML-entity-encodes quotes and angle brackets but leaves the spaces, parentheses, and SQL keywords needed for injection entirely intact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low authentication barrier (any valid session) makes this a meaningful risk for organizations with untrusted or externally provisioned Mautic accounts.
Authentication bypass and database exfiltration in Miantang's IoT-PHP application via SQL injection in the login handler. The POST /userlogin route in index.php concatenates the unsanitized $_POST['pwd'] value directly into a MySQL query, letting an unauthenticated attacker log in as any user with a payload like pwd=' OR '1'='1 and use UNION-based injection to read arbitrary database contents. No public exploit identified at time of analysis, though the technique is trivial and well-documented; no EPSS or KEV data was supplied.
Authentication bypass and data exfiltration in IOTSmartHome's login component allow an unauthenticated attacker to submit a base64-encoded SQL injection payload via the lastLogin cookie, defeating login checks and reading arbitrary database contents including user credentials. The checkCookie() function in gui/login.php decodes the client-supplied cookie with URL-safe base64 (safe_decode()) and concatenates the result directly into a SQL query without sanitization. No public exploit is identified at time of analysis, but the trivial injection path (base64("' OR '1'='1")) and network reachability make weaponization straightforward.
Authentication bypass in mrswapnilsahu's Stock-Inventory-Management-System (PHP) lets an unauthenticated remote attacker log in as any user by injecting SQL through the login form. The login.php script concatenates raw POST username/password into the auth query (CWE-89) and also ships hardcoded admin credentials (admin/neola), giving two independent full-bypass paths. No public exploit identified at time of analysis, though the trivial ' OR '1'='1 payload is described directly in the disclosure.
Blind SQL injection in the TableOn - WordPress Posts Table Filterable plugin (versions ≤ 1.0.5.1) exposes WordPress user credentials to unauthenticated remote attackers via a public AJAX endpoint. The `filter_data[comment_count]` parameter is split on a colon delimiter and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()` sanitization, enabling blind query appending. A researcher confirmed extraction of database metadata, all WordPress usernames, and password hashes; the fix is available in version 1.0.6, and no public exploit code has been identified at time of analysis.
SQL injection in the Ajax Load More WordPress plugin before 8.0.1 lets unauthenticated attackers inject into an unsanitised parameter used in a database query, enabling time-based blind extraction of sensitive data such as user credentials and secrets. Reported by WPScan with publicly available exploit detail and a vendor patch in 8.0.1; scored CVSS 9.1 with an unauthenticated network vector. EPSS is low (0.19%, 9th percentile), indicating limited observed exploitation despite the critical rating.
Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.
SQL injection in Atals-Livre exposes its database to manipulation by authenticated high-privileged users through an unsanitized GET parameter in the supp() deletion helper function. Exploitation enables unauthorized SQL operations including arbitrary record deletion and data extraction against any database instance backing the application. A public Gist writeup exists that appears to document reproduction steps; no CISA KEV listing confirms active exploitation at time of analysis.
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the network. The CVSS 4.0 vector records high subsequent-system confidentiality, integrity, and availability impact (SC:H/SI:H/SA:H), indicating the backend database contains infrastructure-sensitive data - backup job configurations, managed-system credentials, or topology records - whose compromise extends well beyond the Veeam ONE console itself. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.27% (18th percentile), consistent with SSVC exploitation status of 'none'.
Stored (second-order) SQL injection in OpenMeter (v1.0.0-beta.218 through v1.0.0-beta.231) lets an actor who can create or update a customer plant a malicious payload in the usageAttribution.key or usageAttribution.subjectKeys fields, which is later concatenated unsanitized into a ClickHouse WITH map(...) expression when the customer is referenced in a meter or event query. The delayed execution means the injection fires during downstream analytics/metering operations rather than at input time, giving an attacker read/manipulation access to the ClickHouse backend that stores usage and billing telemetry. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 9.3 (Critical).
SQL injection in Koha's circulation statistics report (reports/issues_stats.pl) exposes the entire Koha database to authenticated staff members holding the reports module permission. The vulnerability arises from direct string concatenation of at least six user-controlled HTTP parameters - PeriodTypeSel, PeriodDaySel, PeriodMonthSel, multiple Filter slots, and the Line and Column report-dimension identifiers - into raw SQL with no parameterized binding or whitelist validation, enabling extraction of the borrowers table (password hashes, two-factor TOTP secrets, personal data), api_keys, and active session tokens. No public exploit has been identified at time of analysis and SSVC rates exploitation as none, but vendor-released patches are available across all four active Koha release branches.
SQL injection in Koha's staff-facing report endpoint `reports/bor_issues_top.pl` enables any authenticated staff member holding the reports module permission to extract arbitrary data from the underlying database, including patron password hashes, two-factor authentication secrets, personal identifying information, API keys, and active session tokens. The vulnerability spans four concurrent release branches (24.11.x, 25.05.x, 25.11.x, 26.05.x) and is addressable by upgrading to patched releases issued by the Koha community. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as 'none' and the attack as non-automatable.
SQL injection in Koha's reports module allows an authenticated staff user with the reports permission to execute arbitrary SQL against the Koha database via `reports/issues_avg_stats.pl`. The `Line` and `Column` HTTP parameters are inserted verbatim into SQL identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY) and Filter slots are concatenated raw into comparison predicates without parameterized queries, exposing the full Koha database to read and potential write operations. Sensitive tables including `borrowers` (password hashes, two-factor secrets, patron PII), `api_keys`, and `sessions` are all reachable; no public exploit identified at time of analysis and CISA KEV does not list this CVE.
SQL injection in Koha's reports/catalogue_stats.pl allows an authenticated staff user with the reports module permission to read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. Affected releases span all Koha branches prior to 24.11.17, 25.05.12, 25.11.06, and 26.05.01, with vendor-released fixes now available. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the SSVC framework rates exploitation status as none and automatable as no, reflecting the authenticated staff-account prerequisite.
SQL injection in Koha's acquisitions statistics module exposes sensitive library patron data to authenticated staff. The reports/acquisitions_stats.pl endpoint interpolates nine user-controlled Filter parameters directly into SQL WHERE fragments without prepared-statement binding, giving any staff account holding the reports permission arbitrary read access to the Koha database - including borrower password hashes, two-factor secrets, API keys, and active session tokens. No public exploit or active exploitation has been identified, but the attack is straightforward for any insider or compromised staff account.
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human Resources platform in versions 26.0 up to (but not including) 26.1, allowing remote attackers to compromise the underlying database and recover sensitive HR data that is stored without encryption. Rated CVSS 9.8 by TR-CERT with a fully remote, unauthenticated network vector and high impact to confidentiality, integrity, and availability. Currently there is no public exploit identified at time of analysis and no EPSS or KEV signal provided in the source data.
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that escalate to arbitrary code execution in the context of the current user, per Adobe advisory APSB26-120. The CVSS 3.1 base score is a maximum 10.0 with a changed scope, reflecting network reachability, no privileges, no user interaction, and full confidentiality/integrity/availability impact spilling into adjacent components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum severity and unauthenticated network vector make this a top-priority patch.
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user without any user interaction. Because unsanitized input reaches an SQL command (CWE-89), an attacker with minimal access can pivot from database manipulation to code execution, and the CVSS scope change (S:C) indicates the impact extends beyond the vulnerable component itself. No public exploit identified at time of analysis, but the 9.9 base score and Adobe's own advisory (APSB26-120) mark this as a top-priority enterprise marketing-platform flaw.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided.
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitrary SQL through the unescaped keyword parameter of the /api/filetree/searchDocs endpoint. Because the query runs on a read-write SQLite handle that permits stacked statements, an attacker can both read and tamper with content across every cleartext notebook, and the endpoint is reachable unauthenticated when publish mode runs with Publish.Auth.Enable=false. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and the CVSS 4.0 score is 9.9.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements verbatim to the primary read-write siyuan.db handle via the /api/search/searchEmbedBlock endpoint. Because the endpoint is gated only by CheckAuth, it is reachable with the low-privilege publish RoleReader token - and by fully anonymous users when publish authentication is disabled - and the driver's support for stacked statements allows both reading and modifying content across all opened cleartext notebooks. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a critical 9.9 CVSS 4.0 score; it is fixed in v3.7.3.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish RoleReader tokens execute arbitrary SQL against the read-write asset-content database in all versions before v3.7.3. Because the endpoint is reachable without authentication and the database is writable, attackers can read, alter, or delete data across notebooks - not merely exfiltrate it. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.9.
SQL injection in the LogMyTrip WordPress plugin (≤1.9) lets unauthenticated remote attackers extract data from the underlying WordPress database by injecting malicious SQL through an unsanitized cookie value on any page rendering a plugin shortcode. A proof-of-concept is publicly available via WPScan, and the CVSS Scope:Changed rating reflects the injection crossing the application boundary into the database tier. Despite high CVSS (8.6) and a public exploit, EPSS sits at 0.19% (9th percentile) and SSVC records no observed exploitation, suggesting limited real-world targeting consistent with this plugin's niche footprint.
SQL injection in the sm page duplicator WordPress plugin (versions through 1.0.0) allows authenticated users holding the Editor role or above to execute arbitrary SQL against the WordPress database by exploiting an unsanitized stored value consumed during the page duplication workflow. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) signals limited observed exploitation activity and the vulnerability is not listed in CISA KEV. The high CVSS score of 8.1 reflects the potential for full database read and write access, tempered in practice by the requirement for a privileged authenticated account.
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. There is no public exploit identified as being used in active campaigns at time of analysis.
Unauthenticated SQL injection in the Link Library WordPress plugin before 7.9.3 allows remote attackers to inject arbitrary SQL through an unsanitised, unescaped user-supplied value used directly in a database query. Publicly available exploit code exists (published by WPScan), and CISA's SSVC assessment rates the flaw as automatable with total technical impact, though the EPSS probability remains low at 0.18%. A vendor patch is available in version 7.9.3.
SQL injection in Z-BlogPHP 1.7.5 enables authenticated low-privilege attackers to execute arbitrary SQL commands against the underlying database via the unsanitized `id` parameter in the CommentBat feature. Successful exploitation yields high-severity confidentiality and integrity impact - including extraction of password hashes, user data, and arbitrary record manipulation - with no availability impact indicated. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 5th percentile, suggesting limited real-world exploitation activity despite the high CVSS score.
SQL injection in FastAdmin v1.6.1.20250430 lets remote attackers inject arbitrary SQL through the application/common/controller/Backend.php component, with the vendor advisory characterizing the impact as extending to arbitrary code execution. The flaw is tagged RCE/SQLi/PHP and carries a CVSS 9.8 rating with total technical impact per CISA's SSVC framework, though publicly available exploit code exists rather than confirmed active exploitation. EPSS is low (0.14%, 4th percentile), suggesting exploitation is not yet widespread despite the critical severity.
SQL injection in PyAthena before 3.35.4 lets remote unauthenticated attackers break out of parameterized string literals in DELETE and CTAS (CREATE TABLE ... AS SELECT) statements because DefaultParameterFormatter.format() routes these to the Hive escaper, which backslash-escapes single quotes instead of doubling them. Since Athena/Trino treat backslashes as ordinary characters inside string literals, a single quote in attacker-supplied input terminates the literal early and injects arbitrary SQL, enabling data exfiltration via UNION SELECT, destructive statement execution, and attacker-controlled CTAS output. There is no public exploit identified at time of analysis, but a fixing commit and vendor advisory are public.
Unauthenticated SQL injection in AcyMailing WordPress plugin (versions before 10.11.1) allows remote attackers to read sensitive data from the underlying database and perform limited data modification without any credentials. Reported by WPScan and assigned CVSS 8.2, the flaw is network-exploitable with no user interaction required. A publicly available proof-of-concept exists; however, EPSS sits at 0.19% (8th percentile), indicating minimal observed exploitation activity at time of analysis despite the public PoC, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the Participants Database WordPress plugin before 2.7.8.4 lets remote unauthenticated attackers inject arbitrary SQL through an improperly sanitized user-supplied parameter, exposing and tampering with the WordPress database. Publicly available exploit code exists (disclosed by WPScan), though EPSS remains low at 0.18% and the flaw is not on CISA KEV. The high 9.1 CVSS reflects full read/write database compromise without authentication.
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to preserve the active SQL mode, permitting a low-privileged authenticated hosting user to have SQL executed with root-level database privileges (CWE-89). This carries a CVSS 4.0 base score of 9.4 with a scope change to subsequent systems, and no public exploit has been identified at time of analysis. It is fixed in the cPanel 138 release series per the vendor advisory.
SQL injection sandbox escape in pgAdmin 4's AI Assistant (versions 9.13 through 9.16) lets an attacker break out of the read-only transaction wrapper on the execute_sql_query tool and run arbitrary write or OS commands on the backend PostgreSQL server. The flaw is an incomplete fix for CVE-2026-12045: the sqlparse-based validator disagrees with PostgreSQL over backslash-before-quote string escaping, so a crafted SELECT parses as one statement to the guard but executes as four statements (including a smuggled COMMIT) on the database. Delivery is via indirect prompt injection, and detailed PoC payloads exist publicly in the vendor's regression tests; there is no public exploit identified as used in the wild and no KEV listing, with EPSS data not provided.
SQL injection in pgAdmin 4 through an incomplete remediation of CVE-2026-12044 allows a low-privileged authenticated user to execute arbitrary SQL in a higher-privileged victim's database session. By creating a PostgreSQL object - table, index, publication, or subscription - with an apostrophe in its name (a character PostgreSQL legally permits in quoted identifiers), the attacker plants a payload that fires the moment any other pgAdmin user opens the object's Statistics or Dependencies tab, triggering raw Jinja2 template interpolation in coll_stats.sql, dependencies.sql, and get_position.sql without the qtLiteral escaping applied by the prior fix. The cross-user injection escalates impact well beyond the attacker's own database privileges, with the injected SQL executing under the victim's session credentials. No public exploit has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
SQL injection in PHP Jabbers PHP Poll Script (versions prior to 4.1) allows an authenticated attacker with administrative access to inject arbitrary SQL through the pjAdminPolls.controller.php endpoint, where user-supplied input is not properly neutralized before being used in database queries. Successful exploitation can expose or modify poll and backend database contents (CVSS 4.0 base 8.6, high confidentiality/integrity impact). There is no public exploit identified at time of analysis and no active-exploitation (KEV) listing; the fix landed in version 4.1.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
SQL injection in CodeIgniter4's Query Builder deleteBatch() method (versions 4.3.0 through 4.7.3) allows user-controlled where() condition values to be interpreted as executable SQL because bound values are substituted into the generated DELETE statement while their escape flags are ignored. Only the deleteBatch() batch-delete path is affected; ordinary delete() operations escape their binds correctly. No public exploit was identified at time of analysis, and the flaw is resolved in version 4.7.4.
SQL injection in UMAI Vision Traffic Analysis System (versions 29/30 up to but not including 34) lets remote unauthenticated attackers inject arbitrary SQL commands through unsanitized input, enabling full database compromise. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector, the flaw was reported by Turkey's national CERT (TR-CERT) and has a vendor patch available. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the PHP interpreter's string-escaping routine affects PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9, where backslashes in attacker-controlled parameters are improperly escaped, allowing malicious input to break out of quoted SQL string literals. Any web application relying on PHP's built-in escaping to sanitize user data before database queries can be subverted, enabling trivial injection. This is a CWE-89 flaw reported by the PHP project (advisory GHSA-7qpv-r5mr-78m4); no public exploit identified at time of analysis, and CVSS 4.0 rates it 8.1 with exploitation marked automatable.
Authentication bypass in Eaton's Tripp Lite series PADM power-distribution management firmware (all versions through 20) lets an unauthenticated remote attacker gain privileged user access to the device. The flaw is rooted in improper input validation in the authentication component and is tagged as SQL injection (CWE-89), meaning a crafted login input can subvert the auth check itself. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack profile combined with the product now being end-of-life makes this a serious exposure for anyone still running affected units.
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inject crafted SQL and read arbitrary data from the Plesk database (CWE-89), which the vendor states leads to full compromise of the panel. All Plesk builds prior to 18.0.79.4 are affected, and WebPros has released a fixed version. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the very high 9.9 CVSS and scope-change to full panel takeover make this a high-priority patch.
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary files from the underlying host by exploiting an SQL injection flaw (CWE-89) that reaches file-system read primitives. Because the CVSS scope is changed and no user interaction is required, a single crafted request against an exposed ACC instance can leak sensitive memory and file contents (CVSS 8.6). There is no public exploit identified at time of analysis, but the network vector and low attack complexity make this a high-priority patch.
SQL injection in LG Electronics SmartShare (all versions through 2.3.1712.1202 on Windows 10 and earlier) lets an adjacent-network attacker inject crafted SQL into the application's database queries, primarily exposing sensitive data (CVSS 4.0 base 7.1, VC:H). The flaw was reported by LG's own product security team (product.security@lge.com) and requires no authentication or user interaction, but is constrained to the local/adjacent network. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protected from their account. The flaw lives in the DriveLock web service listening on TCP port 4568 by default, where a user-supplied string is concatenated into a SQL query without proper validation (CWE-89), and it carries a CVSS 8.8. There is no public exploit identified at time of analysis and it is not on CISA KEV, though it was discovered and coordinated through the Zero Day Initiative (ZDI-CAN-28726 / ZDI-26-286).
SQL injection in the Coverity Connect SOAP API (versions 2024.6.0 through 2026.3.0 inclusive) lets an authenticated attacker submit a crafted SOAP payload to read the entire backing database and issue other unauthorized SQL commands. Rated CVSS 4.0 8.7 (High) and reported through a Black Duck product security advisory, it requires only low-privilege authentication and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated SQL injection in Balbooa's Gridbox extension for Joomla (versions before 2.20.2) lets remote attackers inject malicious SQL through multiple untrusted input vectors without any login. The flaw carries a CVSS 4.0 base score of 9.2 (Critical) and can expose database contents including Joomla user credentials and session data. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a strong patching priority.
SQL injection in Frappe's ERPNext (ERPNext 15.107.0, Frappe framework 15.107.2) lets an authenticated low-privilege user run arbitrary SQL by placing SQL metacharacters in the name (docname) of a Supplier record, which is later interpolated into a query via str.format() instead of being parameterized. Because the injected query runs with the application's database privileges, an attacker can bypass Frappe's DocPerm access controls and read data they should not see, including fragments of the administrator's password hash, stored credentials, integration tokens, and financial records. Per the CVSS 4.0 vector the flaw is network-reachable with low attack complexity and only low privileges (PR:L), and there is no public exploit identified at time of analysis.
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object injection through the manual mark assessment endpoint to poison data reaching unserialize(), drop a webshell into a web-accessible path, and run arbitrary commands on the host. The chained SQLi-to-deserialization-to-webshell path yields total system compromise (CVSS 9.9, scope change). There is no public exploit identified at time of analysis, EPSS is low (0.30%), and CISA SSVC currently rates exploitation as none.
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization, ultimately executing arbitrary commands on the server. The vulnerability is reachable via the assessment overall answer endpoint and permits writing a webshell to a publicly accessible location. No active exploitation (KEV) or public exploit code has been confirmed at this time.
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization through the assessment reinforcement endpoint, resulting in webshell upload and full server compromise. The vulnerability, tracked as CVE-2026-63232, requires low-privileged access but leads to complete takeover of the server. No public exploit or active exploitation has been identified at time of analysis.
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoint as a SQL oracle to exfiltrate the entire application database, including valid JWT tokens that enable full account takeover. Rated CVSS 8.1 with high confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is low at 0.25% (17th percentile). SSVC scores technical impact as total but exploitation as none, indicating no observed use so far.
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, including user credentials and JWT tokens that may enable account takeover. The vulnerability, reported through Singapore’s CSA, affects the SCORM report endpoint and does not require prior authentication. No public exploit code or active exploitation data (KEV, EPSS) has been observed at the time of analysis, but the high CVSS score and low attack complexity make it a serious risk if the endpoint is exposed.
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, including credentials and JWT tokens, through its SSO OAuth endpoint without user interaction. This critical flaw (CVSS 9.1) can lead to full account takeover, but no public exploit or active exploitation has been confirmed at this time.
SQL injection in ClickHouse Server versions 26.3.9.8 and earlier lets remote attackers inject arbitrary SQL through the CREATE DICTIONARY functionality, which the advisory claims can escalate to arbitrary code execution. Publicly available exploit code exists (GitHub repository CVE-2026-51992), but there is no CISA KEV listing and no EPSS score in the provided data, so no confirmed active exploitation. The provided CVSS is 9.1, though the description's reference to the CREATE DICTIONARY operation suggests an authenticated privilege may actually be required, which conflicts with the PR:N in the supplied vector.
SQL injection in @hypequery/clickhouse before version 2.0.2 allows unauthenticated remote attackers to inject arbitrary SQL commands through a trailing backslash in a query parameter. All users passing user-controlled input are affected, and the vulnerability can lead to full disclosure, modification, or destruction of the database. A vendor patch is available, and there is no evidence of active exploitation in the wild.
SQL injection in the Giving Reports functionality of Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases. All versions of both products are affected; the class credit field is the injection point. A detailed technical write-up with exploit details is publicly available, though no active exploitation has been reported through CISA KEV.
SQL injection in IBM Sterling B2B Integrator and File Gateway allows authenticated remote attackers to view, add, modify, or delete database contents. Affects versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation (KEV) known at time of analysis.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
SQL injection in PROCON-WEB SCADA's GetGridData endpoint allows remote unauthenticated attackers to execute arbitrary SQL commands, compromising the SCADA system's confidentiality, integrity, and availability. No evidence of active exploitation or public exploit code was found at time of analysis, but the vulnerability's network-accessible, low-complexity nature makes exploitation trivial once exposed.
SQL injection in the Web Directory Free WordPress plugin up to version 1.7.13 allows unauthenticated attackers to extract sensitive database information via the 'levels' parameter. The vulnerability has a high CVSS score of 7.5, but no active exploitation (CISA KEV) or public proof-of-concept has been identified at this time.
SQL injection in PickPlugins Question Answer for WordPress up to 1.2.73 permits unauthenticated remote attackers to extract sensitive database information via the unsanitized 'id' GET parameter. The vulnerability is automatable, requires no user interaction, and exposes confidential data. No public exploit code or active exploitation is known at this time, but the high CVSS score and low attack complexity warrant prompt attention.
SQL injection in the WP Directory Kit WordPress plugin before 1.5.5 lets unauthenticated attackers inject arbitrary SQL through an unsanitised, unescaped request parameter, exposing the entire WordPress database. Reported by WPScan and rated CVSS 9.1 (high confidentiality and integrity impact), it affects any site running the vulnerable versions. There is no public exploit identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), suggesting no observed mass exploitation yet.
SQL injection in the Iptanus File Upload WordPress plugin (all versions before 5.1.8) enables unauthenticated remote attackers to query the underlying WordPress database without any credentials or user interaction. The CVSS scope-change indicator (S:C) reflects that the injection can reach data beyond the plugin's own tables - including WordPress core tables containing admin password hashes, user emails, and site configuration. No public exploit identified at time of analysis, and EPSS at 0.18% (7th percentile) suggests exploitation has not yet been observed at scale, though the unauthenticated attack surface makes it an attractive target as awareness grows.
SQL injection in the CubeWP Framework WordPress plugin (all versions before 1.1.31) allows any authenticated user with Subscriber-level access or above to execute arbitrary SQL queries against the WordPress database via a crafted AJAX action. The vulnerability is compounded by a missing capability check on the affected AJAX endpoint, meaning the lowest-privilege WordPress user role can reach and exploit it without restriction. EPSS is low at 0.16% (5th percentile) and no public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication bar makes mass exploitation feasible on sites with open registration.
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticated WordPress user - including low-privilege Subscribers - to query the underlying database and exfiltrate sensitive data. The AJAX action omits both authorization and nonce checks, collapsing what should be a privileged operation to the lowest authenticated tier. A public proof-of-concept exists per WPScan, though EPSS at 0.16% (6th percentile) indicates no widespread automated exploitation at time of analysis; this is not listed in CISA KEV.
SQL injection in Plesk Obsidian up to version 18.0.80 on Linux and Windows allows any authenticated panel user to read arbitrary data from the underlying control panel database. The CVSS scope change (S:C) reflects that the injected queries cross the application boundary into the database tier, and the high confidentiality impact (C:H) is consistent with a hosting control panel whose database contains cross-tenant customer records, credentials, and configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
SQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenticated user, including low-privilege Subscribers. Two compounding weaknesses drive this: a missing capability check on an AJAX action allows unprivileged users to reach a sensitive endpoint, and unsanitized attacker-controlled input is then passed directly into a raw SQL query. A publicly available POC exists via WPScan, and SSVC rates the technical impact as total, though EPSS remains low at 0.16%, suggesting no widespread automated exploitation at time of analysis.
SQL injection in FineAdmin V1.0 (FineAdmin.Mvc) lets remote attackers inject arbitrary SQL through the `field` and `order` parameters of paginated list endpoints, where user input is concatenated into an ORDER BY clause that cannot be safely parameterized. NVD rates it CVSS 9.8 with full confidentiality, integrity, and availability impact, and public GitHub write-ups documenting the ORDER BY-clause injection exist, though EPSS remains low at 0.40% (33rd percentile) and it is not in CISA KEV - so no public exploit is confirmed as weaponized. The 'RCE' tag reflects theoretical escalation from SQLi to code execution (e.g. via stacked queries), but the demonstrated impact is database compromise.
Unauthenticated SQL injection in the Creative Mail WordPress plugin (versions 1.6.5-1.6.9) allows remote attackers to read the entire WordPress database without credentials. The vulnerability resides in an unsanitized parameter processed during abandoned cart email handling - a core feature of the plugin - making it exploitable against any site where the plugin is installed and that feature is active. A publicly available proof-of-concept exists via WPScan, raising the practical exploitation risk significantly beyond what CVSS base score alone conveys.
SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions 1.6.0 through 1.6.3, letting remote attackers inject arbitrary SQL through an application that relies on this DBD backend for query construction or escaping. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it allows unauthorized reading and modification of Oracle-backed data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in the WordPress File Upload plugin (by nickboss) affects all versions up to and including 5.1.7 and is reachable by unauthenticated remote attackers (CVSS 9.3, AV:N/PR:N). Because the CVSS scope is Changed with high confidentiality impact, a crafted request can coerce the plugin into executing attacker-controlled SQL, exposing WordPress database contents such as user records and secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Patchstack.
SQL injection in the WP Job Portal WordPress plugin (versions up to and including 2.5.6) is exploitable by any authenticated subscriber-level user, the lowest WordPress role available to registered users. The CVSS scope change (S:C) indicates the injection escapes the plugin's own query context and can reach the broader WordPress database, yielding high confidentiality impact against data owned by other plugins or core tables. No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar significantly lowers the effective exploitation threshold on sites with open user registration.
SQL injection in Creative Mail by Constant Contact (WordPress plugin, versions ≤1.6.9) allows authenticated subscribers to execute arbitrary SQL against the WordPress database. The CVSS scope change (S:C) indicates the injection can reach database resources beyond the plugin's own tables, including WordPress user credentials, private posts, and configuration data. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Qode Tours WordPress plugin (versions up to and including 3.1.3.1) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's tour/booking functionality. Because no authentication or user interaction is required (CVSS 9.3, PR:N/UI:N) and the scope is changed, an attacker can extract sensitive data from the WordPress database, such as user records and credential hashes. Reported by Patchstack; no public exploit identified at time of analysis and not listed in CISA KEV.
SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis.
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.
SQL injection in Loca Software Informatics Technology Ltd. Co. CMS (all versions up to and including build 06082026) allows remote unauthenticated attackers to inject arbitrary SQL through improperly neutralized input, per CVSS PR:N. Disclosed by Turkey's national CERT (TR-CERT/USOM), the flaw carries a critical 9.8 score with full confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor was contacted but did not respond, so no fix is available.
SQL injection in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitised parameter, exposing the WordPress database. Reported by WPScan with publicly available exploit code, this flaw is notable for affecting a code path distinct from the previously patched CVE-2024-44004, indicating an incomplete prior fix. Despite a CVSS 9.1 and public POC, the EPSS score is low (0.18%, 7th percentile) and the CVE is not on CISA KEV, so there is no public exploit identified as actively exploited in the wild.
SQL injection in Directus before 12.1.0 enables an authenticated administrator to execute arbitrary SQL against the underlying PostgreSQL database during collection creation by embedding attacker-controlled SQL syntax within a geometry field type value. The attack is gated behind two non-default prerequisites - administrator-level credentials and a PostgreSQL backend with the PostGIS extension installed - which together constrain the realistic threat surface to insider risk or compromised admin accounts. A vendor patch is confirmed available in v12.1.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Subrion CMS's admin grid sorting helper exposes virtually all admin grid endpoints to authenticated SQL injection via a raw, unescaped `sort` GET parameter interpolated directly into an ORDER BY clause. Any valid admin session can exploit approximately 29 grid controllers - most of which carry no or incomplete column whitelists - using error-based (EXTRACTVALUE) or time-based (SLEEP) techniques to exfiltrate full database contents, including administrator password hashes. No public exploit code or CISA KEV listing has been identified at time of analysis, though the breadth of affected endpoints and straightforward technique make exploitation trivial for any attacker holding admin credentials.
SQL injection in Koha's guided report builder (`reports/guided_reports.pl`) allows any authenticated staff member holding the low-privilege `create_reports` or `execute_reports` permission to perform time-based blind SQL injection against the Koha database, which stores patron PII, borrowing history, and staff/LDAP credentials. The `order_by` and dynamically-named `{order}_ovalue` CGI parameters are concatenated verbatim into an ORDER BY clause by `C4::Reports::Guided` with no allowlist, escaping, or prepared-statement binding - a structural defect, since SQL placeholders cannot parameterize column names. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack technique is well-understood and the affected permission is routinely granted to non-admin library staff.
Time-based blind SQL injection in Cacti's ORDER BY handling allows any authenticated user - regardless of privilege level - to extract, modify, or destroy the Cacti database by supplying a crafted `sort_column` GET parameter to at least four administrative endpoints. The root cause is a regex-based sanitization allowlist in `sanitize_sql_column()` (lib/functions.php) that explicitly permits parentheses to support SQL expressions like `COUNT(id)`, inadvertently passing payloads such as `SLEEP(5)` through unmodified before they are concatenated into unparameterized ORDER BY clauses. No public exploit code or KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a credible priority for any organization running Cacti.
SQL injection in Magistrala's message-readers API exposes PostgreSQL and TimescaleDB backends to arbitrary query manipulation by any authenticated platform user. The unvalidated `format` HTTP query parameter is interpolated directly into raw SQL at the table-name identifier position via Go's `fmt.Sprintf()` in both readers/postgres/messages.go and readers/timescale/messages.go, enabling exfiltration of database contents with high confidentiality impact (CVSS C:H). The wildcard CPE (cpe:2.3:a:absmach:magistrala:*) indicates all known versions are affected; no vendor-released patch has been confirmed in available references, and no public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in the Inventory-Management-System-PHP application (Harsh21Patel GitHub project) allows unauthenticated attackers to fully bypass authentication and destructively manipulate the product database. login.php concatenates raw POST email/password into its query, so a payload like email=' OR 1=1 LIMIT 1-- - logs in as the first user, while delete.php runs a DELETE on an unsanitized GET id parameter with no auth check, enabling arbitrary row deletion and blind SQLi. No public exploit identified at time of analysis, though the advisory itself publishes working payloads; the flaw carries CVSS 9.8 and is not listed in CISA KEV.
SQL injection in Mautic's `getLeadIdsByFieldValueAction` endpoint allows any authenticated user to extract arbitrary database contents by supplying a malicious `field` parameter that is concatenated directly into a SQL query as an unvalidated column identifier. The flaw is rooted in Doctrine ORM's structural inability to parameterize SQL identifiers - the only sanitizer applied, `InputHelper::clean()`, HTML-entity-encodes quotes and angle brackets but leaves the spaces, parentheses, and SQL keywords needed for injection entirely intact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low authentication barrier (any valid session) makes this a meaningful risk for organizations with untrusted or externally provisioned Mautic accounts.
Authentication bypass and database exfiltration in Miantang's IoT-PHP application via SQL injection in the login handler. The POST /userlogin route in index.php concatenates the unsanitized $_POST['pwd'] value directly into a MySQL query, letting an unauthenticated attacker log in as any user with a payload like pwd=' OR '1'='1 and use UNION-based injection to read arbitrary database contents. No public exploit identified at time of analysis, though the technique is trivial and well-documented; no EPSS or KEV data was supplied.
Authentication bypass and data exfiltration in IOTSmartHome's login component allow an unauthenticated attacker to submit a base64-encoded SQL injection payload via the lastLogin cookie, defeating login checks and reading arbitrary database contents including user credentials. The checkCookie() function in gui/login.php decodes the client-supplied cookie with URL-safe base64 (safe_decode()) and concatenates the result directly into a SQL query without sanitization. No public exploit is identified at time of analysis, but the trivial injection path (base64("' OR '1'='1")) and network reachability make weaponization straightforward.
Authentication bypass in mrswapnilsahu's Stock-Inventory-Management-System (PHP) lets an unauthenticated remote attacker log in as any user by injecting SQL through the login form. The login.php script concatenates raw POST username/password into the auth query (CWE-89) and also ships hardcoded admin credentials (admin/neola), giving two independent full-bypass paths. No public exploit identified at time of analysis, though the trivial ' OR '1'='1 payload is described directly in the disclosure.
Blind SQL injection in the TableOn - WordPress Posts Table Filterable plugin (versions ≤ 1.0.5.1) exposes WordPress user credentials to unauthenticated remote attackers via a public AJAX endpoint. The `filter_data[comment_count]` parameter is split on a colon delimiter and both halves are interpolated directly into a `posts_where` SQL clause without `intval()` casting or `$wpdb->prepare()` sanitization, enabling blind query appending. A researcher confirmed extraction of database metadata, all WordPress usernames, and password hashes; the fix is available in version 1.0.6, and no public exploit code has been identified at time of analysis.
SQL injection in the Ajax Load More WordPress plugin before 8.0.1 lets unauthenticated attackers inject into an unsanitised parameter used in a database query, enabling time-based blind extraction of sensitive data such as user credentials and secrets. Reported by WPScan with publicly available exploit detail and a vendor patch in 8.0.1; scored CVSS 9.1 with an unauthenticated network vector. EPSS is low (0.19%, 9th percentile), indicating limited observed exploitation despite the critical rating.
Unauthenticated SQL injection in the VikAppointments Service Booking Calendar WordPress plugin allows remote, unauthenticated attackers to read arbitrary data from the site's database - including WordPress user credential hashes - by manipulating the sort-order parameter on the public reviews list endpoint. The vulnerability stems from unsanitized user-controlled input passed directly into a database ORDER BY clause in lib.vikappointments.php (lines 5907 and 6011), reachable through both the servicesearch and employeesearch public views. No public exploit has been identified at time of analysis, though the unauthenticated network vector and high confidentiality impact make this a credible priority for WordPress sites running this plugin.
SQL injection in Atals-Livre exposes its database to manipulation by authenticated high-privileged users through an unsanitized GET parameter in the supp() deletion helper function. Exploitation enables unauthorized SQL operations including arbitrary record deletion and data extraction against any database instance backing the application. A public Gist writeup exists that appears to document reproduction steps; no CISA KEV listing confirms active exploitation at time of analysis.
SQL injection in Veeam ONE ≤ 13.0.2 allows any authenticated low-privileged user to extract database contents over the network. The CVSS 4.0 vector records high subsequent-system confidentiality, integrity, and availability impact (SC:H/SI:H/SA:H), indicating the backend database contains infrastructure-sensitive data - backup job configurations, managed-system credentials, or topology records - whose compromise extends well beyond the Veeam ONE console itself. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.27% (18th percentile), consistent with SSVC exploitation status of 'none'.
Stored (second-order) SQL injection in OpenMeter (v1.0.0-beta.218 through v1.0.0-beta.231) lets an actor who can create or update a customer plant a malicious payload in the usageAttribution.key or usageAttribution.subjectKeys fields, which is later concatenated unsanitized into a ClickHouse WITH map(...) expression when the customer is referenced in a meter or event query. The delayed execution means the injection fires during downstream analytics/metering operations rather than at input time, giving an attacker read/manipulation access to the ClickHouse backend that stores usage and billing telemetry. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 9.3 (Critical).
SQL injection in Koha's circulation statistics report (reports/issues_stats.pl) exposes the entire Koha database to authenticated staff members holding the reports module permission. The vulnerability arises from direct string concatenation of at least six user-controlled HTTP parameters - PeriodTypeSel, PeriodDaySel, PeriodMonthSel, multiple Filter slots, and the Line and Column report-dimension identifiers - into raw SQL with no parameterized binding or whitelist validation, enabling extraction of the borrowers table (password hashes, two-factor TOTP secrets, personal data), api_keys, and active session tokens. No public exploit has been identified at time of analysis and SSVC rates exploitation as none, but vendor-released patches are available across all four active Koha release branches.
SQL injection in Koha's staff-facing report endpoint `reports/bor_issues_top.pl` enables any authenticated staff member holding the reports module permission to extract arbitrary data from the underlying database, including patron password hashes, two-factor authentication secrets, personal identifying information, API keys, and active session tokens. The vulnerability spans four concurrent release branches (24.11.x, 25.05.x, 25.11.x, 26.05.x) and is addressable by upgrading to patched releases issued by the Koha community. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as 'none' and the attack as non-automatable.
SQL injection in Koha's reports module allows an authenticated staff user with the reports permission to execute arbitrary SQL against the Koha database via `reports/issues_avg_stats.pl`. The `Line` and `Column` HTTP parameters are inserted verbatim into SQL identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY) and Filter slots are concatenated raw into comparison predicates without parameterized queries, exposing the full Koha database to read and potential write operations. Sensitive tables including `borrowers` (password hashes, two-factor secrets, patron PII), `api_keys`, and `sessions` are all reachable; no public exploit identified at time of analysis and CISA KEV does not list this CVE.
SQL injection in Koha's reports/catalogue_stats.pl allows an authenticated staff user with the reports module permission to read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. Affected releases span all Koha branches prior to 24.11.17, 25.05.12, 25.11.06, and 26.05.01, with vendor-released fixes now available. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the SSVC framework rates exploitation status as none and automatable as no, reflecting the authenticated staff-account prerequisite.
SQL injection in Koha's acquisitions statistics module exposes sensitive library patron data to authenticated staff. The reports/acquisitions_stats.pl endpoint interpolates nine user-controlled Filter parameters directly into SQL WHERE fragments without prepared-statement binding, giving any staff account holding the reports permission arbitrary read access to the Koha database - including borrower password hashes, two-factor secrets, API keys, and active session tokens. No public exploit or active exploitation has been identified, but the attack is straightforward for any insider or compromised staff account.
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human Resources platform in versions 26.0 up to (but not including) 26.1, allowing remote attackers to compromise the underlying database and recover sensitive HR data that is stored without encryption. Rated CVSS 9.8 by TR-CERT with a fully remote, unauthenticated network vector and high impact to confidentiality, integrity, and availability. Currently there is no public exploit identified at time of analysis and no EPSS or KEV signal provided in the source data.
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that escalate to arbitrary code execution in the context of the current user, per Adobe advisory APSB26-120. The CVSS 3.1 base score is a maximum 10.0 with a changed scope, reflecting network reachability, no privileges, no user interaction, and full confidentiality/integrity/availability impact spilling into adjacent components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum severity and unauthenticated network vector make this a top-priority patch.
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user without any user interaction. Because unsanitized input reaches an SQL command (CWE-89), an attacker with minimal access can pivot from database manipulation to code execution, and the CVSS scope change (S:C) indicates the impact extends beyond the vulnerable component itself. No public exploit identified at time of analysis, but the 9.9 base score and Adobe's own advisory (APSB26-120) mark this as a top-priority enterprise marketing-platform flaw.
Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from the underlying database across all tenants. The unvalidated `direction` value of the `orderBy` query parameter flows unsanitized into a Doctrine QueryBuilder ORDER BY clause, enabling time-based, boolean-oracle, and error-based extraction of long URLs, visitor records, IP addresses, geolocation data, user agents, and hashed API key secrets. A public proof-of-concept exploit is available on GitHub, no public exploit identified at time of analysis as confirmed actively exploited, but the low barrier to exploitation - any valid API key suffices - makes this a genuine remediation priority for Shlink operators.
SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided.
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Blind SQL injection in Krayin CRM's leads DataGrid allows any authenticated user with leads access to exfiltrate the entire database, including credential hashes, CRM records, and application configuration data. The flaw exists in LeadDataGrid.php where the rotten_lead[in] query parameter is unsafely concatenated directly into a Laravel havingRaw() call without parameterized binding, enabling time-based and boolean-based blind injection. A public exploit writeup is available (jivasecurity.com), and the vendor has released a confirmed fix in v2.2.4; no CISA KEV listing at time of analysis, but the low exploitation barrier for any authenticated user makes this an urgent upgrade priority.
SQL injection in SiYuan personal knowledge-management software (all versions before v3.7.3) lets attackers inject arbitrary SQL through the unescaped keyword parameter of the /api/filetree/searchDocs endpoint. Because the query runs on a read-write SQLite handle that permits stacked statements, an attacker can both read and tamper with content across every cleartext notebook, and the endpoint is reachable unauthenticated when publish mode runs with Publish.Auth.Enable=false. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and the CVSS 4.0 score is 9.9.
SQL injection in SiYuan personal knowledge management (versions <= v3.7.2) lets attackers pass arbitrary SQL statements verbatim to the primary read-write siyuan.db handle via the /api/search/searchEmbedBlock endpoint. Because the endpoint is gated only by CheckAuth, it is reachable with the low-privilege publish RoleReader token - and by fully anonymous users when publish authentication is disabled - and the driver's support for stacked statements allows both reading and modifying content across all opened cleartext notebooks. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a critical 9.9 CVSS 4.0 score; it is fixed in v3.7.3.
SQL injection in SiYuan's fullTextSearchAssetContent endpoint lets unauthenticated attackers and holders of publish RoleReader tokens execute arbitrary SQL against the read-write asset-content database in all versions before v3.7.3. Because the endpoint is reachable without authentication and the database is writable, attackers can read, alter, or delete data across notebooks - not merely exfiltrate it. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and carries a CVSS 4.0 base score of 9.9.
SQL injection in the LogMyTrip WordPress plugin (≤1.9) lets unauthenticated remote attackers extract data from the underlying WordPress database by injecting malicious SQL through an unsanitized cookie value on any page rendering a plugin shortcode. A proof-of-concept is publicly available via WPScan, and the CVSS Scope:Changed rating reflects the injection crossing the application boundary into the database tier. Despite high CVSS (8.6) and a public exploit, EPSS sits at 0.19% (9th percentile) and SSVC records no observed exploitation, suggesting limited real-world targeting consistent with this plugin's niche footprint.
SQL injection in the sm page duplicator WordPress plugin (versions through 1.0.0) allows authenticated users holding the Editor role or above to execute arbitrary SQL against the WordPress database by exploiting an unsanitized stored value consumed during the page duplication workflow. A publicly available exploit exists via WPScan, though EPSS at 0.16% (5th percentile) signals limited observed exploitation activity and the vulnerability is not listed in CISA KEV. The high CVSS score of 8.1 reflects the potential for full database read and write access, tempered in practice by the requirement for a privileged authenticated account.
SQL injection in the Super Store Finder WordPress plugin (versions through 7.8) lets unauthenticated remote attackers inject arbitrary SQL via an unsanitized parameter in an AJAX action, enabling extraction of arbitrary database contents. Reported by WPScan with publicly available exploit code, the flaw carries a 9.1 CVSS and CISA SSVC rates it automatable with total technical impact, though EPSS remains low at 0.19% and it is not in CISA KEV. There is no public exploit identified as being used in active campaigns at time of analysis.
Unauthenticated SQL injection in the Link Library WordPress plugin before 7.9.3 allows remote attackers to inject arbitrary SQL through an unsanitised, unescaped user-supplied value used directly in a database query. Publicly available exploit code exists (published by WPScan), and CISA's SSVC assessment rates the flaw as automatable with total technical impact, though the EPSS probability remains low at 0.18%. A vendor patch is available in version 7.9.3.
SQL injection in Z-BlogPHP 1.7.5 enables authenticated low-privilege attackers to execute arbitrary SQL commands against the underlying database via the unsanitized `id` parameter in the CommentBat feature. Successful exploitation yields high-severity confidentiality and integrity impact - including extraction of password hashes, user data, and arbitrary record manipulation - with no availability impact indicated. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 5th percentile, suggesting limited real-world exploitation activity despite the high CVSS score.
SQL injection in FastAdmin v1.6.1.20250430 lets remote attackers inject arbitrary SQL through the application/common/controller/Backend.php component, with the vendor advisory characterizing the impact as extending to arbitrary code execution. The flaw is tagged RCE/SQLi/PHP and carries a CVSS 9.8 rating with total technical impact per CISA's SSVC framework, though publicly available exploit code exists rather than confirmed active exploitation. EPSS is low (0.14%, 4th percentile), suggesting exploitation is not yet widespread despite the critical severity.
SQL injection in PyAthena before 3.35.4 lets remote unauthenticated attackers break out of parameterized string literals in DELETE and CTAS (CREATE TABLE ... AS SELECT) statements because DefaultParameterFormatter.format() routes these to the Hive escaper, which backslash-escapes single quotes instead of doubling them. Since Athena/Trino treat backslashes as ordinary characters inside string literals, a single quote in attacker-supplied input terminates the literal early and injects arbitrary SQL, enabling data exfiltration via UNION SELECT, destructive statement execution, and attacker-controlled CTAS output. There is no public exploit identified at time of analysis, but a fixing commit and vendor advisory are public.
Unauthenticated SQL injection in AcyMailing WordPress plugin (versions before 10.11.1) allows remote attackers to read sensitive data from the underlying database and perform limited data modification without any credentials. Reported by WPScan and assigned CVSS 8.2, the flaw is network-exploitable with no user interaction required. A publicly available proof-of-concept exists; however, EPSS sits at 0.19% (8th percentile), indicating minimal observed exploitation activity at time of analysis despite the public PoC, and the vulnerability is not listed in the CISA KEV catalog.
SQL injection in the Participants Database WordPress plugin before 2.7.8.4 lets remote unauthenticated attackers inject arbitrary SQL through an improperly sanitized user-supplied parameter, exposing and tampering with the WordPress database. Publicly available exploit code exists (disclosed by WPScan), though EPSS remains low at 0.18% and the flaw is not on CISA KEV. The high 9.1 CVSS reflects full read/write database compromise without authentication.
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to preserve the active SQL mode, permitting a low-privileged authenticated hosting user to have SQL executed with root-level database privileges (CWE-89). This carries a CVSS 4.0 base score of 9.4 with a scope change to subsequent systems, and no public exploit has been identified at time of analysis. It is fixed in the cPanel 138 release series per the vendor advisory.
SQL injection sandbox escape in pgAdmin 4's AI Assistant (versions 9.13 through 9.16) lets an attacker break out of the read-only transaction wrapper on the execute_sql_query tool and run arbitrary write or OS commands on the backend PostgreSQL server. The flaw is an incomplete fix for CVE-2026-12045: the sqlparse-based validator disagrees with PostgreSQL over backslash-before-quote string escaping, so a crafted SELECT parses as one statement to the guard but executes as four statements (including a smuggled COMMIT) on the database. Delivery is via indirect prompt injection, and detailed PoC payloads exist publicly in the vendor's regression tests; there is no public exploit identified as used in the wild and no KEV listing, with EPSS data not provided.
SQL injection in pgAdmin 4 through an incomplete remediation of CVE-2026-12044 allows a low-privileged authenticated user to execute arbitrary SQL in a higher-privileged victim's database session. By creating a PostgreSQL object - table, index, publication, or subscription - with an apostrophe in its name (a character PostgreSQL legally permits in quoted identifiers), the attacker plants a payload that fires the moment any other pgAdmin user opens the object's Statistics or Dependencies tab, triggering raw Jinja2 template interpolation in coll_stats.sql, dependencies.sql, and get_position.sql without the qtLiteral escaping applied by the prior fix. The cross-user injection escalates impact well beyond the attacker's own database privileges, with the injected SQL executing under the victim's session credentials. No public exploit has been identified at time of analysis, and this CVE has not been added to the CISA KEV catalog.
SQL injection in PHP Jabbers PHP Poll Script (versions prior to 4.1) allows an authenticated attacker with administrative access to inject arbitrary SQL through the pjAdminPolls.controller.php endpoint, where user-supplied input is not properly neutralized before being used in database queries. Successful exploitation can expose or modify poll and backend database contents (CVSS 4.0 base 8.6, high confidentiality/integrity impact). There is no public exploit identified at time of analysis and no active-exploitation (KEV) listing; the fix landed in version 4.1.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
SQL injection in CodeIgniter4's Query Builder deleteBatch() method (versions 4.3.0 through 4.7.3) allows user-controlled where() condition values to be interpreted as executable SQL because bound values are substituted into the generated DELETE statement while their escape flags are ignored. Only the deleteBatch() batch-delete path is affected; ordinary delete() operations escape their binds correctly. No public exploit was identified at time of analysis, and the flaw is resolved in version 4.7.4.
SQL injection in UMAI Vision Traffic Analysis System (versions 29/30 up to but not including 34) lets remote unauthenticated attackers inject arbitrary SQL commands through unsanitized input, enabling full database compromise. Rated CVSS 9.8 with a network, no-privilege, no-interaction vector, the flaw was reported by Turkey's national CERT (TR-CERT) and has a vendor patch available. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the PHP interpreter's string-escaping routine affects PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9, where backslashes in attacker-controlled parameters are improperly escaped, allowing malicious input to break out of quoted SQL string literals. Any web application relying on PHP's built-in escaping to sanitize user data before database queries can be subverted, enabling trivial injection. This is a CWE-89 flaw reported by the PHP project (advisory GHSA-7qpv-r5mr-78m4); no public exploit identified at time of analysis, and CVSS 4.0 rates it 8.1 with exploitation marked automatable.
Authentication bypass in Eaton's Tripp Lite series PADM power-distribution management firmware (all versions through 20) lets an unauthenticated remote attacker gain privileged user access to the device. The flaw is rooted in improper input validation in the authentication component and is tagged as SQL injection (CWE-89), meaning a crafted login input can subvert the auth check itself. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack profile combined with the product now being end-of-life makes this a serious exposure for anyone still running affected units.
SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inject crafted SQL and read arbitrary data from the Plesk database (CWE-89), which the vendor states leads to full compromise of the panel. All Plesk builds prior to 18.0.79.4 are affected, and WebPros has released a fixed version. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the very high 9.9 CVSS and scope-change to full panel takeover make this a high-priority patch.
SQL injection in the Online Scheduling and Appointment Booking System WordPress plugin before version 27.8 lets unauthenticated attackers extract sensitive database contents, including WordPress user password hashes, through the plugin's public-facing booking request handler. The flaw stems from a user-supplied parameter being neither sanitized nor properly type-cast before use in a SQL query, and is reachable pre-authentication over the network. Publicly available exploit code exists (reported by WPScan), a vendor patch is available, and the EPSS score is low (0.20%) despite the high CVSS of 8.6.
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary files from the underlying host by exploiting an SQL injection flaw (CWE-89) that reaches file-system read primitives. Because the CVSS scope is changed and no user interaction is required, a single crafted request against an exposed ACC instance can leak sensitive memory and file contents (CVSS 8.6). There is no public exploit identified at time of analysis, but the network vector and low attack complexity make this a high-priority patch.
SQL injection in LG Electronics SmartShare (all versions through 2.3.1712.1202 on Windows 10 and earlier) lets an adjacent-network attacker inject crafted SQL into the application's database queries, primarily exposing sensitive data (CVSS 4.0 base 7.1, VC:H). The flaw was reported by LG's own product security team (product.security@lge.com) and requires no authentication or user interaction, but is constrained to the local/adjacent network. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation in DriveLock via SQL injection lets authenticated remote attackers reach resources normally protected from their account. The flaw lives in the DriveLock web service listening on TCP port 4568 by default, where a user-supplied string is concatenated into a SQL query without proper validation (CWE-89), and it carries a CVSS 8.8. There is no public exploit identified at time of analysis and it is not on CISA KEV, though it was discovered and coordinated through the Zero Day Initiative (ZDI-CAN-28726 / ZDI-26-286).
SQL injection in the Coverity Connect SOAP API (versions 2024.6.0 through 2026.3.0 inclusive) lets an authenticated attacker submit a crafted SOAP payload to read the entire backing database and issue other unauthorized SQL commands. Rated CVSS 4.0 8.7 (High) and reported through a Black Duck product security advisory, it requires only low-privilege authentication and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated SQL injection in Balbooa's Gridbox extension for Joomla (versions before 2.20.2) lets remote attackers inject malicious SQL through multiple untrusted input vectors without any login. The flaw carries a CVSS 4.0 base score of 9.2 (Critical) and can expose database contents including Joomla user credentials and session data. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a strong patching priority.
SQL injection in Frappe's ERPNext (ERPNext 15.107.0, Frappe framework 15.107.2) lets an authenticated low-privilege user run arbitrary SQL by placing SQL metacharacters in the name (docname) of a Supplier record, which is later interpolated into a query via str.format() instead of being parameterized. Because the injected query runs with the application's database privileges, an attacker can bypass Frappe's DocPerm access controls and read data they should not see, including fragments of the administrator's password hash, stored credentials, integration tokens, and financial records. Per the CVSS 4.0 vector the flaw is network-reachable with low attack complexity and only low privileges (PR:L), and there is no public exploit identified at time of analysis.
Remote code execution in Koollab LMS 5.3.2 lets an authenticated attacker chain SQL injection (CWE-89) and PHP object injection through the manual mark assessment endpoint to poison data reaching unserialize(), drop a webshell into a web-accessible path, and run arbitrary commands on the host. The chained SQLi-to-deserialization-to-webshell path yields total system compromise (CVSS 9.9, scope change). There is no public exploit identified at time of analysis, EPSS is low (0.30%), and CISA SSVC currently rates exploitation as none.
Remote code execution in Koollab LMS allows authenticated attackers to chain SQL injection with unsafe deserialization, ultimately executing arbitrary commands on the server. The vulnerability is reachable via the assessment overall answer endpoint and permits writing a webshell to a publicly accessible location. No active exploitation (KEV) or public exploit code has been confirmed at this time.
Remote code execution in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe deserialization through the assessment reinforcement endpoint, resulting in webshell upload and full server compromise. The vulnerability, tracked as CVE-2026-63232, requires low-privileged access but leads to complete takeover of the server. No public exploit or active exploitation has been identified at time of analysis.
Error-based SQL injection in Koollab LMS 5.3.2 lets an authenticated attacker abuse the face-to-face runs update endpoint as a SQL oracle to exfiltrate the entire application database, including valid JWT tokens that enable full account takeover. Rated CVSS 8.1 with high confidentiality and integrity impact; there is no public exploit identified at time of analysis and EPSS is low at 0.25% (17th percentile). SSVC scores technical impact as total but exploitation as none, indicating no observed use so far.
Error-based SQL injection in Koollab LMS allows unauthenticated attackers to exfiltrate sensitive database contents, including user credentials and JWT tokens that may enable account takeover. The vulnerability, reported through Singapore’s CSA, affects the SCORM report endpoint and does not require prior authentication. No public exploit code or active exploitation data (KEV, EPSS) has been observed at the time of analysis, but the high CVSS score and low attack complexity make it a serious risk if the endpoint is exposed.
Blind SQL injection in Koollab LMS enables unauthenticated attackers to exfiltrate sensitive database contents, including credentials and JWT tokens, through its SSO OAuth endpoint without user interaction. This critical flaw (CVSS 9.1) can lead to full account takeover, but no public exploit or active exploitation has been confirmed at this time.
SQL injection in ClickHouse Server versions 26.3.9.8 and earlier lets remote attackers inject arbitrary SQL through the CREATE DICTIONARY functionality, which the advisory claims can escalate to arbitrary code execution. Publicly available exploit code exists (GitHub repository CVE-2026-51992), but there is no CISA KEV listing and no EPSS score in the provided data, so no confirmed active exploitation. The provided CVSS is 9.1, though the description's reference to the CREATE DICTIONARY operation suggests an authenticated privilege may actually be required, which conflicts with the PR:N in the supplied vector.
SQL injection in @hypequery/clickhouse before version 2.0.2 allows unauthenticated remote attackers to inject arbitrary SQL commands through a trailing backslash in a query parameter. All users passing user-controlled input are affected, and the vulnerability can lead to full disclosure, modification, or destruction of the database. A vendor patch is available, and there is no evidence of active exploitation in the wild.
SQL injection in the Giving Reports functionality of Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases. All versions of both products are affected; the class credit field is the injection point. A detailed technical write-up with exploit details is publicly available, though no active exploitation has been reported through CISA KEV.
SQL injection in IBM Sterling B2B Integrator and File Gateway allows authenticated remote attackers to view, add, modify, or delete database contents. Affects versions 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation (KEV) known at time of analysis.
SQL injection in pglogical's queue mechanism allows a publisher to execute arbitrary SQL as superuser on the subscriber, potentially breaking tenant isolation in shared deployments. An attacker who can direct a PostgreSQL subscription to an endpoint they control sends crafted DDL queue messages that the subscriber’s apply worker executes without sanitization, escalating from a role permitted to use pglogical to full superuser. Exploitation requires non-default delegation of subscription creation in managed environments, as default installations restrict this to superusers.
SQL injection in PROCON-WEB SCADA's GetGridData endpoint allows remote unauthenticated attackers to execute arbitrary SQL commands, compromising the SCADA system's confidentiality, integrity, and availability. No evidence of active exploitation or public exploit code was found at time of analysis, but the vulnerability's network-accessible, low-complexity nature makes exploitation trivial once exposed.
SQL injection in the Web Directory Free WordPress plugin up to version 1.7.13 allows unauthenticated attackers to extract sensitive database information via the 'levels' parameter. The vulnerability has a high CVSS score of 7.5, but no active exploitation (CISA KEV) or public proof-of-concept has been identified at this time.
SQL injection in PickPlugins Question Answer for WordPress up to 1.2.73 permits unauthenticated remote attackers to extract sensitive database information via the unsanitized 'id' GET parameter. The vulnerability is automatable, requires no user interaction, and exposes confidential data. No public exploit code or active exploitation is known at this time, but the high CVSS score and low attack complexity warrant prompt attention.