SQL Injection

Privilege escalation through SQL injection in on-premises Arista VeloCloud Orchestrator lets any valid VCO account cross into operator-level access and impersonate the built-in superuser operator, reaching internal-only functions and potentially compromising the orchestrator host and managed data. The vendor rates the issue CVSS 9.4; hosted and Dedicated VCO deployments were affected and are reported already patched, so on-prem VCO is the remediation focus, and the supplied priority label is act_now. No public exploit identified at time of analysis, and no CISA KEV status is supplied in the provided intelligence.

A maximum-severity, network-reachable flaw (CVSS 3.1 base 10.0) in an as-yet-unnamed HPE product allows remote attackers to achieve high confidentiality, integrity and availability impact across a scope boundary without authentication or user interaction. The affected product line, feature, protocol and version range are not stated in the available data; the only authoritative source is HPE security bulletin hpesbnw05162en_us, which must be consulted to identify the exact product and fixed build. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the vulnerability is tagged 'Information Disclosure' while the assessed vector also scores high integrity and availability impact, so the true impact profile should be confirmed from the vendor bulletin. Vuln.today priority is act_now based on the assessed vector.

Unauthenticated network attackers can potentially achieve high confidentiality, integrity, and availability impact against an HPE networking product, based on the supplied CVSS 3.1 vector scoring 10.0 with scope change. The CVE has no description and no published affected version range; the HPE Security Bulletin hpesbnw05162en_us is the only reference, and the exact product feature, deployment mode, and trigger remain unverified. No public exploit is identified at time of analysis.

Blind SQL injection in AmentoTech Workreap Core before 3.4.4 allows an authenticated low-privileged user to extract data from the WordPress database; the risk picture is moderate and somewhat conflicting because exploitation requires a plugin account rather than anonymous access. No public exploit was identified at time of analysis, and the specific vulnerable endpoint or parameter is not described in the supplied sources.

SQL injection in the Lotus (uselotus/lotus) metering and billing platform through 0.10.2 lets an authenticated organization-level user smuggle SQL into usage-aggregation queries by registering a crafted subscription_filter_key that passes the keyword-only validator and is later rendered as an unquoted GROUP BY identifier. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the dominant impact is high-confidentiality disclosure of billing and usage data held in the shared multi-tenant database, with limited integrity impact and no availability effect; the reporter's CVSS 4.0 vector scores it 8.7. No CISA KEV entry or confirmed working exploit code was identified at time of analysis, though a public technical writeup is referenced, and vuln.today sequencing places this in the this-week remediation queue - the practical prerequisite is a valid tenant account on a deployment where aggregation queries span tenants.

SQL injection in Lotus through 0.10.2 lets authenticated organization users read and modify the shared multi-tenant database by embedding crafted SQL in billable metric property_name or categorical filter values, which are rendered unescaped into Jinja-generated counter, gauge and rate queries. Exploitation requires a valid account with metric-configuration access (PR:L) but no victim interaction; the CVSS 4.0 score is 8.7. No CISA KEV entry is present, and no working exploit code is confirmed in the supplied sources.

SQL injection in the Lotus billing platform through 0.10.2 allows an authenticated organization-level user to execute arbitrary stacked SQL statements through POST /app/metrics/, enabling cross-tenant reads and modifications of data in the shared database. The weakness bypasses first-statement-only validation because semicolon-appended statements are executed unfiltered. Exploitation requires a legitimate tenant account and access to the custom billable-metric query feature; no public exploit has been identified at time of analysis.

SQL injection in JSON-SCADA releases before 0.65-alpha lets an authenticated user inject arbitrary SQL through the OPC historian HistoryRead API implemented by opcApi() in src/server_realtime_auth/index.js, by supplying crafted NodeId.Id, StartTime or EndTime values in a HistoryReadRequest. Because stacked statements are accepted, an attacker with any valid account can read, modify or delete historian data across all locations irrespective of their assigned role, giving high confidentiality, integrity and availability impact to the historian. Exploitation requires network reach to the HistoryRead endpoint plus valid credentials (CVSS 4.0 PR:L, aligned with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit code is identified at time of analysis, the issue is not in CISA KEV, and VulnCheck reporting places remediation in the current weekly patch cycle rather than an emergency response.

SQL injection in mem0's Databricks vector store backend (mem0/vector_stores/databricks.py) affects versions 0.1.117 up to but not including 1.0.8, and lets remote unauthenticated attackers inject SQL that runs on the configured Databricks SQL warehouse by supplying crafted memory text, metadata values, or message names that reach unescaped string interpolation in the insert() and update() statements. Successful injection gives high confidentiality, integrity, and availability impact on the warehouse, though the assessed vector (AC:H/AT:P) indicates exploitation is not deterministic and requires the non-default Databricks backend to be configured; the trigger mechanics for reliably carrying a payload through mem0's ingestion pipeline are not described in the available sources. No public exploit code or CISA KEV entry was identified at time of analysis, the vendor has released the v1.0.8 fix, and the issue carries an act_now priority label with a CVSS 4.0 base score of 9.2.

Unauthenticated SQL injection in Weaver E-cology 8.0, 9.0, and 10.0 before 10.76 allows remote attackers to inject SQL through the doc_datefrom and doc_dateto fields of the /api/doc/out/more/list endpoint when srcType=2 and elementmore is used, then read query results through /api/ec/dev/table/counts to extract database information. The assessed vector requires only network reachability, with no privileges or user interaction, and instances upgraded to 10.76 or later are not affected. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-19, and a public PoC reference exists; it is not verified as working exploit code.

SQL injection in the TMS Amelia booking plugin for WordPress, affecting versions through 2.4.11, lets remote attackers influence SQL queries in the plugin, with the authoritative assessment emphasizing high confidentiality impact and lower integrity and availability impact. The vulnerable endpoint or parameter is not disclosed, and the provided data contains no public exploit code or CISA KEV entry. The reported CVSS is 9.3, while the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, indicating network-reachable, unauthenticated exploitation with no user interaction once a vulnerable Amelia installation is present.

Blind SQL injection in Frappe Framework before 16.33.0 allows any authenticated low-privilege user to submit crafted input to the frappe.desk.doctype.event.event.get_events method and infer sensitive database contents from application behavior. The defect is rated CVSS 7.1 (CVSS 4.0) and assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, meaning exploitation is network-reachable but requires a valid account and no administrator rights. No public exploit identified at time of analysis, and KEV status is not indicated.

SQL injection in Cisco Unified CM and related Cisco collaboration products (Emergency Responder, Unified CM IM&P, Unified CM SME, and Unity Connection) allows authenticated remote attackers with low privileges to execute arbitrary SQL against the underlying database, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The flaw is network-reachable, low-complexity, and requires no user interaction, but exploitation requires a valid low-privilege account on an affected web or administrative interface. No public exploit was identified at time of analysis.

Blind SQL injection in WPdreams Ajax Search Lite through version 4.14.6 allows unauthenticated remote attackers to extract sensitive data from the WordPress database by inferring query results. The plugin's public-facing search endpoint is exposed to anonymous visitors by design, so no authentication or user interaction is required. No public exploit code was identified at the time of analysis, but the vulnerability is fully automatable and high severity.

SQL injection in the Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 allows unauthenticated remote attackers to read arbitrary WordPress database contents by controlling a sort parameter that is placed directly into an SQL ORDER BY clause. The assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, so the practical impact is high confidentiality loss with no integrity or availability effect, and no authentication or user interaction is needed. Publicly available exploit code exists; exposure is limited to sites running an affected plugin version with the chat-widget request handler reachable.

Unauthenticated SQL injection in Click n Chat (Chat Widget Integration) before 1.1.3 allows remote attackers to influence SQL query structure by supplying a parameter that the plugin uses as a column identifier without validation, giving high confidentiality impact through database data exposure with no integrity or availability impact assessed. Publicly available exploit code exists, and only WordPress sites with this specific plugin below version 1.1.3 are exposed, making the affected population narrow. The independent assessment rates the issue as network-reachable, low-complexity, and unauthenticated with scope unchanged, while the supplied base score is 8.6.

Authenticated SQL injection in the Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before version 7.37.0 allows any logged-in user with Subscriber-level access or higher to append additional SQL clauses to an existing query and read sensitive data from the site's database. Only confidentiality is affected - the vulnerable code path provides no route to modify or delete data, and no user interaction is needed (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N per independent assessment). Publicly available exploit code exists, and the practical blast radius is largest on event, membership and community sites that permit open or self-service registration, where an attacker can simply sign up for a low-privilege account.

SQL injection in Trigger.dev before 4.5.6 lets an authenticated caller holding a project API key with read:runs scope read TaskRun records, including payloads and metadata, across organizations on a multi-tenant self-hosted instance by supplying malicious SQL in the tags query parameter of /realtime/v1/runs. The flaw is high severity but operationally meaningful primarily where multiple organizations share the same self-hosted deployment; single-tenant or SaaS-isolated deployments do not expose foreign tenant data in the same way. No public exploit identified at time of analysis.

Cross-tenant SQL injection in Trigger.dev's TSQL/TRQL query compiler (versions up to and including 4.5.5) allows any authenticated customer holding a valid API key to read other organizations' analytics data from the shared ClickHouse backend through the customer-facing POST /api/v1/query endpoint. The compiler applies its allowlists, identifier escaping, and per-tenant WHERE guard everywhere except the window-function name, which is concatenated raw into the generated SQL, so a backtick-quoted identifier can smuggle a raw subquery that sits outside the tenant guard. Exploitation requires authentication (PR:L) and a multi-tenant deployment for maximum impact; no public exploit code identified at time of analysis, and the issue is fixed in 4.5.6.

Tenant isolation bypass in Trigger.dev releases before 4.7.3 lets an authenticated user read run metadata and payloads belonging to other tenants by submitting crafted queries to POST /api/v1/query that reference tables through the 'FROM {database.table}' placeholder syntax, including inside subqueries. Only confidentiality is affected - the flaw exposes data but does not allow modification, deletion, or code execution - so the practical exposure is concentrated in shared SaaS or multi-tenant self-hosted deployments, while single-tenant installations have no other tenant data to disclose. Authentication with a valid account is required (CVSS PR:L), no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV; the assigned CVSS 4.0 score is 7.1, though an independent CVSS 3.1 assessment places it at 6.5 given the read-only impact.

Full takeover of Oracle Product Lifecycle Analytics 3.6.1 is possible for a low-privileged authenticated attacker who can reach the application over the network and deliver a SQL-based attack against its Installation Issues component, with high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit (AC:H) and assigns CVSS 3.1 score 7.5; exploitation requires valid credentials (PR:L) and favorable conditions beyond the attacker's direct control. No CISA KEV entry or public exploit code is identified in the provided intelligence, so this should be handled on the normal Oracle CPU cadence rather than as an emergency.

SQL injection in the Sgalinski Cookie Consent extension for TYPO3 allows authenticated backend users with access to the consent-history or statistics module to inject unvalidated sorting, grouping, and index options into a database query, enabling arbitrary database reads that can include backend and frontend password hashes. The issue is privilege-gated: it requires a backend account granted those specific module permissions and the review/statistics feature in use, and no public exploit code was identified at time of analysis.

Unauthenticated SQL injection in TYPO3 File Manager allows remote attackers to read database contents through crafted file-search terms, per the CVSS vector's PR:N/UI:N conditions. The extension wraps the search term in quotes but escapes only LIKE wildcards, so an unescaped quote can break out of the quoted value across every searchable field. Impact is confidentiality-only per the independent assessment, and no public exploit is identified at time of analysis; the TYPO3 advisory is the reference for affected and fixed releases.

SQL injection in YS-infoware BA-Workflow allows authenticated remote attackers with low privileges to read, modify, and delete arbitrary database contents. The CPE wildcard indicates all product versions are affected, and exploitation requires only a valid low-privilege session with no user interaction. No public exploit code was identified at time of analysis.

SQL injection in YS-infoware BA-Workflow lets authenticated remote attackers execute arbitrary SQL statements, enabling them to read, modify, and delete database contents. The issue is rated CVSS 8.7 and affects BA-Workflow deployments matching the version-agnostic CPE supplied by TW-CERT; exploitation requires a valid BA-Workflow account, which limits exposure to users who can authenticate. No public exploit code was identified at time of analysis, and the product's limited deployment base makes this a credible but second-tier priority rather than a broadly urgent Internet-wide threat.

SQL injection in BA-Workflow (YS-infoware) allows authenticated remote attackers with low privileges to inject arbitrary SQL statements and read, modify, or delete database contents. The CVSS 4.0 score is 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), reflecting network reachability, low complexity, no attack requirements, low-privilege authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.

Unauthenticated SQL injection in the EventON - Subscriber WordPress plugin (all versions up to and including 1.4.5) allows remote attackers to append arbitrary SQL clauses to the plugin's existing database queries through the 'email' parameter, enabling extraction of sensitive data such as user credentials, password hashes, and other site secrets. The defect is a classic CWE-89 input-handling failure - the parameter is neither escaped nor bound via prepared statements - and scores 7.5 with high confidentiality impact but no integrity or availability effect, reflecting a read-only exfiltration path. No public exploit code or confirmed active exploitation was identified at time of analysis, although the unauthenticated network vector, low attack complexity, and absence of user interaction make the flaw an attractive target for automated scanning against any internet-facing site with the add-on active.

SQL injection in NocoBase's @nocobase/plugin-collection-sql through 2.2.28 allows an authenticated user with the collection-sql snippet permission to bypass checkSQL() through the sqlCollection:setFields action and persist malicious SQL that executes when the collection reloads. The issue requires high privileges and a PostgreSQL backend for the described impact, where injected statements can read pg_shadow password hashes or invoke pg_read_file; no public exploit was identified at time of analysis. It is a conditional, high-privilege risk rather than an unauthenticated emergency.

SQL injection in Integratec's pre-authentication login endpoint (/login/ap_Login.aspx/start) allows remote unauthenticated attackers to read database contents-including credentials and user information-by supplying a crafted UNION-based payload in the sInfo POST parameter. The report carries an 8.8 CVSS score, and our independent assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, with no authentication or user interaction required; exploitation is limited mainly by whether the login interface is reachable from untrusted networks. No public exploit code was identified at time of analysis, but our independent assessment treats this as a credible, actionable priority rather than a paper-tiger high score.

SQL injection in SLiMS (Senayan Library Management System) Bulian 9.8.0 lets any authenticated staff user extract arbitrary database contents by supplying malicious SQL identifiers in the tableName and tableFields POST parameters of the admin AJAX endpoints admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php and admin/AJAX_vocabolary_control.php. The submitted CVSS of 9.8 with PR:N conflicts with the documented requirement for a valid staff login, so the realistic exposure is a post-authentication confidentiality breach (independently assessed as C:H/I:N/A:N) rather than a pre-auth compromise. EPSS is low at 0.33% (25th percentile), there is no CISA KEV entry, and no confirmed public exploit code was identified at time of analysis, although a GitHub repository named for this CVE appears in the references and warrants triage. No vendor-released patch version is confirmed in the available data.

SQL injection in SENAYAN Library Management System (SLiMS) Bulian 9.8.0 allows attackers who can reach the administrative reporting endpoint to manipulate SQL queries through the fileID parameter in admin/modules/reporting/customs/dl_detail.php, potentially exposing, modifying, or deleting library data. The supplied CVSS 3.1 vector rates this 9.8 with PR:N, but our assessed vector requires low privileges (PR:L) because the vulnerable script is under the /admin/ tree; authentication requirements should therefore be confirmed against the source. No CISA KEV entry or confirmed public exploit was identified at time of analysis.

SQL injection in SLiMS (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff/librarian account to extract arbitrary database contents through the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, exposing patron records, credentials, and catalogue data. The flaw is reachable by any staff user with access to the bibliography administration module (PR:L), so it is not anonymously exploitable, and the primary impact per our assessment is confidentiality loss rather than data tampering. Publicly available exploit code exists (including a dedicated PoC repository) and CISA SSVC flags exploitation as 'poc', but EPSS remains low at 0.20% (10th percentile) and no active exploitation has been confirmed.

SQL injection in JeecgBoot before 3.9.5 allows authenticated low-privilege users to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments, then send newline-separated payloads to endpoints such as /sys/dict/getDictItems to perform boolean- or time-based blind extraction of database contents, including administrator password hashes from sys_user. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, so the primary precondition is an authenticated session rather than user interaction or a non-default configuration. Vendor-released patch: 3.9.5; no public exploit identified at time of analysis and no CISA KEV entry was provided.

SQL injection in the WordPress plugin Support Genix (support-genix-lite) through version 1.4.54 allows an authenticated low-privilege user to inject SQL through plugin input and read sensitive database contents, with limited integrity impact. Exploitation requires the plugin to be installed and active and the attacker to hold valid low-privilege credentials; unauthenticated exploitation is not indicated by the assessed vector. No public exploit code or CISA KEV entry was provided at time of analysis.

SQL injection in the Arraytics Booktics WordPress plugin, affecting sites running versions through 1.0.29, allows remote attackers to influence SQL queries and access or alter backend database data. The assessed CVSS vector indicates network reachability, no required privileges or user interaction, high confidentiality impact, low integrity impact, and no availability impact, although the advisory does not name the vulnerable endpoint or parameter and authentication requirements should be verified. No public exploit identified at time of analysis.

SQL injection in Modern Events Calendar Lite and Pro versions before 7.37.0 allows authenticated users with Subscriber-level access or higher to read arbitrary data from the WordPress database. Publicly available exploit code exists, though CISA's SSVC assessment finds no active exploitation; the practical barrier is the requirement for a valid low-privilege account, making this a credible mid-tier priority rather than an emergency.

SQL injection in AipexBase through commit 690adb9 allows an authenticated low-privilege attacker to read other users' database rows and tables by injecting SQL through the order_by and group_by fields of the /api/data/invoke endpoint. The attacker can supply subqueries or MySQL error-based functions (EXTRACTVALUE/UPDATEXML) to bypass the SqlGuard denylist and row-level security, but impact is limited to confidentiality with no write or modification path described. No public exploit identified at time of analysis; CVSS 7.1 with PR:L indicates a moderate-severity issue requiring valid authentication and a MySQL-style backend.

Authenticated SQL injection in WebVella ERP through 1.8.8 allows any valid user account to read unauthorized entities, including user and role tables, by sending crafted single-quoted literals in WHERE clauses to the EQL query API at POST /api/v3/en_US/eql. The flaw is CWE-89 in EqlBuilder's unsanitized SQL string interpolation, and the CVSS vector confirms PR:L, so unauthenticated attackers cannot exploit it directly. No public exploit code was identified at time of analysis, and although CVSS 4.0 scores this 7.1, the independent assessment correctly frames it as a genuine but moderate-priority issue rather than an overstated high-CVSS finding.

Unauthenticated SQL injection in Thecosy IceCMS through 4.1.5 allows remote attackers to read arbitrary database contents by appending crafted SQL after the LIMIT clause that is concatenated into a MyBatis-Plus QueryWrapper for the num path parameter of /WebArticle/findarticlesbynum. Exploitation requires no authentication, no user interaction, and no special conditions beyond network reachability of the endpoint (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5); the supplied CVSS 4.0 vector scores 8.7 with the same confidentiality-only impact. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a public technical write-up describing the injection point is referenced, so exposure should be treated as a genuine high-priority data-disclosure risk for internet-facing instances that have not moved past 4.1.5.

Unauthenticated SQL injection in IceCMS (Thecosy IceCMS) through 4.1.5 lets any remote attacker who can reach the /WebResource/findresourcebynum endpoint read arbitrary data from the backend database by supplying a crafted 'num' path parameter. The parameter is concatenated after the SQL LIMIT clause via MyBatis-Plus QueryWrapper.last() with no parameterization, so union-based or blind injection can be used to exfiltrate table contents. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - no data modification, denial of service, or code execution - and no authentication, user interaction, or non-default configuration is required. The issue is not listed in CISA KEV and no confirmed active exploitation has been reported, but a detailed public write-up of the injection point exists, making the flaw straightforward to reproduce against network-reachable instances.

Authenticated SQL injection in ZR.Admin.NET through 3.8.2 allows any account holding the system:user:list permission to inject subquery or CASE expressions into the ORDER BY clause of the shared ToPage paging helper by supplying a crafted PagerInfo.Sort query parameter to GET /system/user/list, enabling blind extraction of database contents such as stored credentials. The flaw is read-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor-published CVSS 4.0 base of 7.1) and requires a valid low-privileged session with that specific list permission, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis, though a public technical writeup describing the ORDER BY injection path exists; a vendor patch is available.

SQL injection in Helical Insight through 7.0.0 allows authenticated users with at least viewer privileges to execute arbitrary SQL queries via crafted Numeric or String placeholder values sent to the /executeDatasource endpoint, bypassing the broken SqlDetect guard. This enables reading unexposed database tables and modifying data within the report's configured data source, with impact limited by the privileges of the database account used by the application. No public exploit code or active exploitation has been identified at time of analysis.

Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.

Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.

SQL injection in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) affects all versions through 8.16.1 and lets an authenticated low-privileged user, such as a subscriber, contributor or customer account, inject arbitrary SQL through the plugin's vulnerable request handling, exposing database contents. The issue is remotely reachable with low attack complexity and needs no victim interaction, but it does require a valid account on a site that both runs the affected plugin and permits untrusted low-privilege registration; sites that do not hand out such accounts face materially lower real-world exposure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is driven by the population of sites exposing low-privileged authenticated access to the plugin.

Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 lets a remote network attacker reach a backend cache API that lacks authentication and execute injected SQL against the underlying data store, carrying CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity and availability impact). Exploitation is primarily gated by exposure rather than by attacker capability: the vendor states the issue mainly threatens Kylin services directly reachable from the public internet, which it describes as uncommon, and in-house deployments kept on internal networks are largely unaffected. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.30% (21st percentile).

Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.

SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.

Blind SQL injection in the halfdata Green Popups WordPress plugin before 7.6.3 lets a remote attacker inject crafted SQL through an HTTP request and extract data from the site's database one inferred bit at a time. The vendor (Patchstack) rates this 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating network reachability, low complexity, a scope change, and high confidentiality impact, while our independent assessment scores it 9.3 as well but with PR:L instead of PR:N - meaning the true privilege prerequisite is not confirmed from the available data and pre-authentication exploitability cannot be assumed. There is no CISA KEV entry and no public exploit code identified at time of analysis, so this should be treated as a serious but not confirmed actively exploited issue; because it is blind, extraction is inference-based and slower than direct-output injection but still permits theft of user, configuration, and credential-adjacent data.

Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.

SQL injection in the Wheels CFML framework through 4.1.2 lets remote attackers manipulate SQL statements when an application feeds request data into inline-literal query paths - opt-in parameterize=false queries, IN lists, and developer-written where strings at positions the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. The flaw is reachable unauthenticated over the network (CVSS 3.1 9.8, PR:N) but only materialises on MySQL or MariaDB backends running with the default backslash-escaping behaviour (NO_BACKSLASH_ESCAPES absent), and only where the developer has constructed the vulnerable query form; bound/parameterized queries and whereBetween() as of 4.1.2 are not affected. No public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in Wheels 4.2.0.

SQL injection in Frappe HRMS 14.x (before 14.38.2), 15.x (before 15.64.0), and 16.x (before 16.18.0) allows any authenticated user, including a low-privilege account, to extract sensitive information from the database via crafted requests to endpoints that lack input validation. The flaw requires only a valid session (CVSS PR:L) and no user interaction, resulting in high confidentiality impact with scope change. Patched versions 14.38.2, 15.64.0, and 16.18.0 are available, and no public exploit code has been identified at time of analysis.

Authenticated SQL injection in Tianji before 1.31.29 allows any workspace member - even a read-only viewer - to execute arbitrary SQL against the shared PostgreSQL database by supplying a crafted timezone value through analytics request data or the timezone HTTP header. The getDateQuery() helper in src/server/utils/prisma.ts interpolates that value into raw SQL via Prisma.sql() without parameter binding, so an attacker can disclose or modify credentials, API keys and tenant data, or make the service unavailable. No public exploit code has been identified at time of analysis; the vendor-released fix is 1.31.29.

Boolean-based blind SQL injection in EspoCRM versions 8.1.0 through 9.3.7 allows an authenticated non-administrator to inject crafted expressions through the 'where' parameter of the GET entity streamAttachments endpoint, enabling extraction of arbitrary database contents - including active administrator session tokens - and subsequent full privilege escalation. The flaw requires a valid low-privilege session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, 7.6) and is not exploitable anonymously. Public exploit code exists for this issue, though it has not been confirmed as actively exploited (CISA KEV); EspoCRM 9.3.8 is the fixed release.

Blind SQL injection in the Link Whisper Free WordPress plugin (versions up to 0.9.7) enables remote attackers to extract sensitive information from the site's database by injecting crafted SQL commands into an unspecified request handler. The vulnerability is rated critical with a CVSS score of 9.3, and the supplied vector indicates network exploitability, low complexity, and no authentication or user interaction required (PR:N/UI:N); however, the independent assessment notes that the true authentication requirements are unconfirmed and may involve a low-privilege account, and the exact trigger parameter is not publicly documented. No public exploit code or confirmed active exploitation is identified at time of analysis.

SQL injection in the Mang Board WP WordPress plugin (Kitae Park) affects all versions through 2.4.4 and lets an attacker inject arbitrary SQL into the site's backend database queries, with the primary impact being high confidentiality loss (bulk read of user records, password hashes, and other stored data) plus a limited integrity effect. The vendor/Patchstack vector advertises a 9.3 score with scope change and no privileges required (PR:N/UI:N), but the independent assessment rates the issue as PR:L with unchanged scope (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so the authentication requirement should be treated as unconfirmed - the PR:N rating in the published vector is unusually permissive for a WordPress plugin SQLi and is not corroborated by the description text, which names no vulnerable parameter, endpoint, or feature. Only a Patchstack database entry is available: no vendor patch version is stated and no public exploit code has been identified at time of analysis.

Unauthenticated SQL injection in the TMS Amelia (ameliabooking) plugin for WordPress, affecting all versions through 2.4.10, allows remote attackers to inject arbitrary SQL into database queries executed by the plugin. Per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), no authentication, no user interaction, and no non-default configuration are required - the only prerequisites are that the plugin be installed and active at a version at or below 2.4.10 on a network-reachable WordPress instance, making exposure broad across unpatched booking sites. The impact is confidentiality-focused: the classification indicates high confidentiality impact with no integrity or availability impact, so the practical risk is large-scale extraction of data from the site's WordPress database rather than data destruction or code execution. No public exploit code has been identified at time of analysis and the vulnerability is not listed as confirmed actively exploited (CISA KEV); no EPSS score was available in the source data, but given the unauthenticated, pre-auth access path and the database-level target, this should be treated as high priority on paper.

SQL injection in QNAP Video Station before version 5.8.8 lets a remote attacker who already holds a valid Video Station user account inject arbitrary SQL into the application's database queries, exposing stored data with high confidentiality impact and a limited availability effect. The vendor-reported vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L, 7.1) and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) agree that the vulnerability is network-reachable, low complexity and requires no user interaction, but that the attacker must first authenticate as a Video Station user - this authentication prerequisite is the main limiting factor and rules out fully unauthenticated internet exploitation. There is no public exploit identified at time of analysis, and QNAP has already shipped a fix in Video Station 5.8.8 and later, so risk is highest for NAS devices that expose Video Station to untrusted networks and provision multiple or guest-level accounts.

SQL injection in QNAP Video Station (versions prior to 5.8.8) allows a remote attacker who already holds a valid NAS user account to read sensitive data from the application's backend database through the Video Station web interface. The flaw is an authenticated issue (CVSS PR:L), and the independent assessment bounds the impact to confidentiality only (C:H), meaning it does not by itself provide code execution or service disruption despite the description's broader wording. No public exploit code was identified at time of analysis, and the vendor has released a fix in Video Station 5.8.8 and later.

SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

Unauthenticated time-based blind SQL injection in the WordPress Link Library plugin (all versions up to and including 7.9.2) lets remote attackers append arbitrary SQL to the plugin's existing query via the 'link_url' parameter and use timing side-channels to extract sensitive information from the site's database. The injection is reached through the plugin's front-end link user-submission functionality - the code path the vendor patch modifies in usersubmission.php - so a site only becomes directly attackable if that submission form is enabled and publicly reachable, and no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) with impact limited to confidentiality (C:H/I:N/A:N, base 7.5). Because the technique is blind and time-based, extraction is slow and requires many timed requests, and no public exploit code has been identified at time of analysis; this is a moderate-priority issue rather than a top-tier emergency.

SQL injection in Znuny's ticket-search backend (versions through 7.3.6) allows an authenticated remote attacker with a valid agent or customer account to inject arbitrary SQL through the ContentSearch parameter, enabling theft or modification of ticketing data. The flaw requires the attacker to reach the search interface and supply a value for a parameter that the code expects to contain only the literal 'AND' or 'OR', yet concatenates verbatim into the generated query (CWE-89). No public exploit code was identified at the time of analysis and no CISA KEV listing applies; the assessed impact is high confidentiality and integrity loss with no confirmed availability impact.

SQL injection in the Wheels CFML framework versions 1.1.8 through 4.1.1 can let unauthenticated remote attackers alter SQL queries when applications pass caller-supplied string values into dynamic finders such as findOneByEmail, query-builder where(property, value) and where(property, operator, value), string/UUID-key lookup paths like findByKey, updateByKey, deleteByKey, findOrCreateBy..., or validatesUniquenessOf. The parser mishandles a doubled single quote by treating it as the end of a string literal, potentially exposing authentication, password-reset, and token lookups; the whereBetween() variant in 4.0.0 through 4.1.1 is additionally gated on MySQL/MariaDB running with backslash escaping enabled, and numeric-column values are not affected. The issue is fixed in 4.1.2, and no public exploit was identified at time of analysis.

SQL injection in the version 1 Microsoft SQL node of the n8n workflow automation platform lets unauthenticated external callers execute arbitrary SQL against a connected database whenever a workflow binds untrusted input (for example, webhook fields) into the node's Query field via an expression. Affected deployments are n8n before 2.41.4 and the 2.42.x line before 2.42.1; exploitation is strictly gated on that specific insecure workflow configuration (AT:P), so default installs and workflows that use parameterised inputs are not exposed. Injected statements run with the privileges of the credential stored in the node; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows remote attackers to execute arbitrary SQL against the underlying database by sending crafted POST data to the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint. Because the endpoint uses extract($_REQUEST) and interpolates user-supplied values directly into a raw INSERT statement, an attacker can read, modify, or delete billing, member, employee, permission, and credential data, or drop database tables, without authentication or user interaction. The vendor fixed the flaw in 3.8.6 with prepared statements and input validation; no public exploit code was identified at time of analysis.

Unauthenticated SQL injection in WeGIA prior to 3.8.6 lets any remote attacker who can reach the application read, alter, or destroy its MySQL database through the billing endpoint web/html/socio/sistema/cadastro_cobranca.php. Because that endpoint is reachable without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and passes the valor, valor_pago, id_pessoa, id_socio and id_sociotipo parameters straight into UPDATE, INSERT and SELECT statements, an attacker can exfiltrate billing records and credential data or truncate tables to cause application-wide data loss. No public exploit code was identified at time of analysis and there is no CISA KEV entry indicating active exploitation, but the low attack complexity and lack of authentication make prompt upgrading to 3.8.6 the priority action.

Authenticated SQL injection in WeGIA versions prior to 3.8.6 allows a user with access to the Material & Patrimônio module to inject arbitrary SQL through the id_produto parameter of web/html/matPat/restaurar_produto_desocultar.php, enabling extraction of sensitive database records and modification of institutional and inventory data. The flaw is rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privileged account plus module-level authorization, so anonymous visitors cannot trigger it. No public exploit identified at time of analysis; the vulnerable code path ships by default in affected releases and a vendor fix (3.8.6) is available.

Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows any remote attacker to read and modify the underlying database by sending a single POST request to web/html/socio/sistema/cadastro_cobranca.php. The codigo parameter is folded into the WHERE codigo= clause of an UPDATE statement without parameter binding, and supplying a quoted string defeats MariaDB's implicit numeric conversion on the VARCHAR column, permitting arbitrary SQL execution without a session. Exposed records include user credential hashes and billing entries in the cobrancas table; the issue is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.

Authenticated SQL injection in InvoiceShelf before 2.4.0 allows any logged-in user to inject arbitrary SQL expressions into the ORDER BY clause of invoice and other list endpoints, enabling boolean-based blind extraction of database contents. The flaw stems from the orderByField query parameter being passed unfiltered into Laravel Eloquent orderBy() calls across multiple model scopes, including Invoice::scopeApplyFilters; an attacker with a valid low-privilege account - potentially an untrusted outsider on deployments that permit self-registration or multi-tenancy - can therefore read data beyond their authorization. Exploitation is confirmed to require authentication, is limited to confidentiality impact (no writes or denial of service), and proceeds slowly through blind inference. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the vendor has released a fix in version 2.4.0.

Stored SQL injection in DataEase versions prior to 2.10.26 allows authenticated users to inject arbitrary SQL into backend queries by storing crafted binning values (FieldGroupDTO.min, .max, .startTime, .endTime) in dataset group-field definitions. The payload is only triggered when a chart that references the tainted field is rendered, giving an attacker with a valid DataEase account high-impact read/write/delete access to the configured backend database (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H). Exploitation requires a low-privileged authenticated account with dataset-editing rights; no public exploit code or confirmed active exploitation was identified at time of analysis.

SQL injection in DataEase's CalciteProvider allows authenticated users with access to a configured datasource to alter the metadata queries the platform builds for getSchema, validate, save, and update flows, executing attacker-controlled SQL against the connected backend database using the application's stored datasource credentials. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.7), reflecting high confidentiality, integrity, and availability impact on the backend database with no victim interaction required, though exploitation is constrained by the need for a valid DataEase account that has been granted datasource access and by the privileges of the application-held datasource account. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released v2.10.27, which introduces identifier quoting, literal escaping, and parameter binding in CalciteProvider.

Unauthenticated SQL injection in the e107 CMS alt_auth plugin allows a remote attacker to execute arbitrary SQL through a crafted login username whenever the plugin's otherdb or e107db authentication backend is configured against a live external database, affecting all e107 releases prior to 2.3.7. No authentication or user interaction is required once that configuration exists; the assessed impact is high on confidentiality and integrity, bounded by the privileges of the configured external database account, and failed queries can leak the generated SQL through the debug-message path to assist blind injection. No public exploit identified at time of analysis, and default e107 installations - which do not ship alt_auth enabled and do not point a backend at an external DB - are not exposed.

SQL injection in Redash (versions after 8.0.0 through 26.9.0) lets an authenticated user with view-only access to both the Query Results data source and a referenced data source inject arbitrary SQL that runs with the referenced data source's privileges. The flaw lives in redash/query_runner/query_results.py, where param_query_N_{key=value} parameters were substituted into the target query's SQL via replace_query_parameters() rather than through the ParameterizedQuery schema validator, and where the is_safe permission check was skipped; the vendor CVSS 4.0 base score is 8.7, and no public exploit code or CISA KEV entry was identified at time of analysis. Because exploitation requires valid credentials plus dual data-source access, this is realistically an insider or compromised-account risk, with the greatest exposure in deployments that grant low-privilege users view-only access to sensitive referenced data sources.

Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.

Authenticated SQL injection in Tenable Nessus lets any user with a valid low-privilege Nessus account read or modify data stored by the scanner through the web interface or API, affecting every instance running a version below 10.12.5. The flaw is rated CVSS v4.0 8.7 and maps to CWE-89; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Tenable has shipped a vendor patch in Nessus 10.12.5, and the issue is best treated as a credible, elevated-priority finding rather than an emergency, because exploitation requires pre-existing credentials plus network reachability to the Nessus interface.

SQL injection in the Custom Reports module of Progress MOVEit Transfer allows an authenticated low-privilege user to inject arbitrary SQL into report queries, potentially exposing or altering data in the underlying database. Versions before 2025.1.6 and 2026.0.0 through 2026.0.3 are affected; exploitation requires a valid account with access to Custom Reports (CVSS PR:L), no user interaction, and low attack complexity. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is 0.49% (40th percentile), indicating limited observed exploitation likelihood despite the high CVSS 8.8 impact.

Authenticated SQL injection in the Yiuman Citrus Java framework (versions through 0.15.0) allows any user with a valid low-privilege account to inject arbitrary SQL into the ORDER BY clause by tampering with the sortBy request parameter. The flaw lives in the citrus-support generic query helper and is reachable through any generic list route on controllers extending BaseQueryController or BaseQueryRestful, which means every application built on the framework that exposes such a route inherits the exposure. Impact is read-only database disclosure achieved through boolean- or time-based blind inference rather than direct record retrieval, and exploitation requires both valid credentials and a deployed, reachable generic query endpoint; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this should be treated as a moderate-severity, externally exploitable information-disclosure risk rather than an active campaign.

Authenticated SQL injection in Dromara Skyeye (all builds through commit 65d3ddcede70) lets any low-privileged user read arbitrary data from the backend database, including records belonging to other tenants, by sending crafted 'keyword' values to the queryWarehousingDetails and queryOutgoingDetails ERP statistics endpoints. The flaw is reachable over the network with only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor score 7.1 under CVSS 4.0), needs no user interaction, and impacts confidentiality only - there is no evidence of data modification or code execution. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; a detailed public technical writeup exists, and the issue is a genuine but moderate-priority finding whose main limiting factor is the authentication requirement.

Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.

Blind SQL injection in the Webnus Modern Events Calendar Lite plugin for WordPress (versions before 7.37.0) lets an authenticated low-privilege user inject SQL through a plugin endpoint that fails to neutralize special elements, allowing them to read arbitrary data from the site's database. The provided vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5 High) requires a valid low-privileged account, so sites that restrict registration or grant only minimal roles present a materially higher barrier; our independent assessment keeps the high confidentiality impact but scores scope as unchanged (S:U) and shifts the integrity/availability impact to a low integrity impact, which lowers the practical blast radius claimed by the vendor vector. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).

SQL injection in the Koha integrated library system's Most-circulated items report (reports/cat_issues_top.pl) allows an authenticated staff account holding the reports module permission - explicitly not requiring superlibrarian - to inject arbitrary SQL through the Criteria, Filter, and Limit request parameters and read any table reachable by the Koha database user, including borrower userids, bcrypt password hashes, two-factor secrets, api_keys, and sessions. The flaw is rated CVSS 7.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) and our independent assessment concurs it is a genuine, well-characterized CWE-89 injection that merits prompt patching but is not a drop-everything emergency, principally because the PR:L staff-authentication-plus-reports-permission gate blocks any unauthenticated path. No public exploit code has been identified at time of analysis: this CVE is not in CISA KEV and there is no confirmed active exploitation. Patched releases are available in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03.

Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.

Authenticated SQL injection in JTL-WMS lets any user holding a low-privileged session inject arbitrary T-SQL into the application's database queries, granting full read and write control over the backend Microsoft SQL Server data and opening a pivot path toward connected systems. The flaw (CWE-89) carries a CVSS score of 9.4 and is network-reachable with no user interaction, but exploitation requires valid credentials (CVSS PR:L) - fully anonymous attacks are not supported by the assessed vector, and exposure is further bounded by whether the instance is network-reachable to the attacker and whether the vulnerable code path is deployed. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a joint advisory covering this CVE together with CVE-2026-89309.

Unauthenticated SQL injection in the Fast Courier WordPress plugin (versions 5.0.0 through 5.2.3) lets any remote attacker who can reach the plugin's unauthenticated REST route inject arbitrary SQL and read data from the underlying WordPress database. No credentials or user interaction are required (CVSS vector PR:N/UI:N), and the impact is confidentiality-only - data can be read but not modified, and availability is unaffected (I:N/A:N). Publicly available exploit code exists and the finding is documented in a WPScan advisory, though EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, so this is a genuine but non-emergency, scope-limited issue that chiefly matters to sites running this niche plugin below 5.2.4. Vendor patch: 5.2.4.

Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.

Blind SQL injection in the 10Web Form Maker WordPress plugin (all versions up to and including 1.15.48) lets unauthenticated remote attackers append additional SQL to queries built from the 'inputs' parameter, allowing them to extract sensitive information from the site's database. The plugin's nonce check offers no real protection because the required nonce is emitted into the HTML source of every public page that renders a form, so the only practical prerequisite is that a Form Maker form be reachable by an anonymous visitor - the normal way a contact-form plugin is deployed. CVSS is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), no public exploit code has been identified at time of analysis, and the issue should still be treated as high priority given how trivially the vulnerable handler can be reached.

Unauthenticated attackers can inject SQL into the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) through the 'product.push' identity-linking endpoint, allowing blind, time-based extraction of data from the site's WordPress database. The flaw requires no credentials, no user interaction and no non-default configuration - only that the plugin is installed and its connector endpoint is reachable, which is its normal operating mode for JTL ERP synchronisation - and it fires during identity linking before ProductController::push() runs, so downstream validation never gets a chance to reject the request. Impact is limited to data disclosure (CVSS 7.5, C:H/I:N/A:N) and exploitation is slower than direct extraction because it relies on time-based inference, but it is fully automatable; no public exploit code was identified at time of analysis and there is no CISA KEV telemetry for this CVE. Overall this is a credible, high-priority issue for the narrow population of sites actually running the JTL-WooCommerce bridge.

Unauthenticated time-based blind SQL injection in the Gmedia Photo Gallery plugin for WordPress, affecting all versions up to and including 1.25.1, lets any remote attacker append arbitrary SQL to the plugin's existing query through the 'gmedia__in' parameter and extract sensitive data from the site's database. The plugin's mobile-app endpoint dispatches the 'library' action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, so no account or session of any kind is required, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). Impact is confidentiality-only and exploitation is blind and time-based, so extraction is slower and noisier than an error-based injection; no public exploit code and no confirmed active exploitation were identified at time of analysis.

Unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce (all versions up to and including 10.8.0) allows remote attackers to extract sensitive information from a WordPress site's database by forging the plugin's encrypted 'validate' parameter. The parameter is protected with AES-CTR, a malleable stream cipher, so an attacker who abandons a cart using an email address they control can harvest one legitimate token, recover the keystream, and re-encrypt arbitrary SQL; the HMAC integrity check introduced in 10.4.1 is enforced only when the wcap_nonce parameter is present, and omitting that parameter skips the check entirely. CVSS 3.1 scores this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting unauthenticated, remote, confidentiality-only impact; no public exploit code and no confirmed active exploitation were identified at time of analysis, though the attack requires only a token-harvest and keystream-recovery step rather than a one-shot injection.

Unauthenticated SQL injection in the Abandoned Cart Pro for WooCommerce plugin (≤10.8.0) allows remote attackers to execute arbitrary SQL commands via attacker-controlled guest checkout fields, leading to database information disclosure and modification of WordPress user metadata. Exploitation can escalate an arbitrary account to administrator by injecting a malicious wp_capabilities row, and the vulnerability is exploitable without authentication or user interaction (CVSS 9.8). No public exploit code has been identified at time of analysis, but the flaw is considered high-priority due to its severe impact and default exposure on public-facing stores with the vulnerable guest cart persistence feature enabled.