SQL Injection

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/view_order.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no user interaction required. A public exploit has been released - referenced via GitHub and VulDB - materially raising near-term opportunistic exploitation risk despite the moderate overall score.

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.

SQL injection in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the ID parameter in /delete.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, enabling exploitation from the network. A public proof-of-concept exploit has been disclosed via GitHub, making this immediately actionable for opportunistic attackers targeting deployments of this PHP application.

Unauthenticated SQL injection in the ThemeGoods 'Capella' WordPress theme (versions 2.5.5 and earlier) lets remote attackers inject arbitrary SQL through an unsanitized parameter, exposing backend database contents including the wp_users table. Reported by Patchstack and rated CVSS 9.3 with a scope change, the flaw needs no authentication or user interaction; no public exploit code and no active exploitation have been reported at time of analysis.

SQL injection in amirsanni Mini-Inventory-and-Sales-Management-System 0.1 allows authenticated remote attackers to manipulate the orderBy and orderFormat parameters of the Transaction::getAll function to inject arbitrary SQL and read or modify database contents. The project maintainer has not responded to responsible disclosure, leaving the vulnerability unpatched. A public exploit exists via GitHub issue #101; no confirmed active exploitation (not in CISA KEV), but the low bar for exploitation given POC availability elevates near-term risk for any deployed instances.

SQL injection in code-projects Assessment Management 1.0 exposes the `/welcome.php` endpoint to remote unauthenticated database manipulation via the `userid` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public exploit is documented (E:P, GitHub PoC at github.com/niaoniaollll/cve/issues/8). Impact is rated Low across confidentiality, integrity, and availability, but the zero-barrier exploitation path and available PoC make this immediately actionable for any operator running this software.

SQL injection in DeDeCMS 53_1_UTF8 exposes the `/plus/advancedsearch.php` endpoint to remote unauthenticated database manipulation via an unsanitized `sql` argument. The flaw (CWE-89) allows attackers to craft malicious SQL statements that interact directly with the backend database, yielding limited but real confidentiality, integrity, and availability impact. A public exploit has been disclosed (CVSS 4.0 E:P), lowering the skill barrier for exploitation; no CISA KEV listing has been identified at time of analysis.

SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the `mailuid` parameter at the Admin Login Endpoint (`/process/aprocess.php`). Successful exploitation can result in authentication bypass, credential extraction, or partial data manipulation depending on database user privileges. A public proof-of-concept exploit is available, materially lowering the technical barrier for opportunistic attacks.

SQL injection in Splunk SOAR below version 8.6.0 enables users holding the "Automation Engineer" role to execute arbitrary SQL statements against the SOAR database by embedding injection payloads in custom list names referenced within playbooks, granting full create, read, update, and delete access to all data the database contains. The root cause is unsanitized string concatenation: Splunk SOAR builds the custom list lookup query by inserting the user-supplied list name directly rather than using parameterized (bound) values, a textbook CWE-74 injection pattern. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; vendor-released patch version 8.6.0 is available.

SQL injection in Splunk SOAR below version 8.6.0 enables authenticated users holding the "Automation Engineer" role to execute arbitrary SQL statements against the SOAR backend database by supplying crafted values through custom function results. The root cause (CWE-89) is Splunk SOAR concatenating the user-supplied name directly into the database lookup query rather than using parameterized, bound SQL values. Successful exploitation allows full read access to all data stored in the SOAR database - including playbook configurations, incident records, and integration credentials - and can affect database integrity; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

SQL injection in Splunk Enterprise's Data Orchestration jobs endpoint allows any authenticated low-privilege user - explicitly excluding the need for 'admin' or 'power' roles - to execute arbitrary SQL against the underlying Data Orchestration database, exposing all job records across all users and stored connection credentials. Affected version branches are 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. Reported by Cisco; no KEV listing or public exploit code identified at time of analysis, though the credential exposure component significantly elevates real-world impact beyond the moderate 6.5 CVSS score suggests.

SQL injection in Splunk Enterprise's REST API allows low-privileged authenticated users to embed attacker-controlled SQL fragments into backend database queries, potentially exposing data beyond their authorized scope. Four actively maintained version branches are affected - 9.4.x, 10.0.x, 10.2.x, and 10.4.x - with patched releases available across all branches per the vendor advisory SVD-2026-0801. The CVSS score of 4.3 reflects a read-only confidentiality impact (C:L/I:N/A:N) with no public exploit identified at time of analysis, though the attack pattern is well-understood and the REST API is network-accessible by default.

Unauthenticated SQL injection in code-projects Hospital Information System 1.0 exposes the login endpoint to remote database manipulation via the unsanitized `email` parameter in `UsersController.php`. The flaw allows network-accessible attackers to alter authentication query logic, potentially bypassing login controls or extracting sensitive records such as patient data and credentials. No CISA KEV listing exists, but a published proof-of-concept exploit is referenced in the intelligence feed, materially lowering the barrier to exploitation.

Blind SQL injection in vsDesk (vsdesk.ru) exposes database contents and can render the application unresponsive via unauthenticated network requests. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-friction remote exploitation requiring no privileges or user interaction, with high confidentiality and availability impact. No active exploitation or public proof-of-concept has been identified at time of analysis; a vendor-released patch is available in version 14.0101 and later.

Blind SQL injection in Cisco Unified Intelligence Center's web-based management interface allows an authenticated low-privilege user to extract the full contents of the internal database over the network. The flaw (CWE-89) stems from insufficient input validation in a network-accessible endpoint, confirmed by Cisco in advisory cisco-sa-cuic-sql-inject-2qbfWSm5. No active exploitation has been identified and no public exploit code is known at time of analysis.

Wildcard injection in phpMyFAQ before 4.1.7 allows unauthenticated attackers to cause denial of service via the public FAQ search form when the application is running against PostgreSQL through PHP's native pgsql extension. The underlying defect is a character mismatch in LIKE escape handling: Search/Database/Pgsql.php declares '=' as the LIKE ESCAPE character but escapeLikeWildcards() prefixes user input with '|', making wildcard sanitization entirely inert. Submitted % and _ characters pass through as active SQL wildcards, forcing PostgreSQL into maximally broad sequential table scans. No public exploit has been identified at time of analysis, and the vulnerability explicitly does not enable SQL injection or data exfiltration.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_menu` endpoint to remote unauthenticated database manipulation via an unsanitized `id` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AV:N), no authentication or user interaction is required, enabling any network-reachable attacker to read, modify, or delete database contents. A public proof-of-concept exploit exists on GitHub, making this immediately actionable; no patch has been identified at time of analysis.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes backend database contents through the unsanitized ID parameter of the /admin/ajax.php?action=save_menu endpoint, permitting remote attackers to read, modify, or delete application data. The CVSS 4.0 vector assigns PR:N, suggesting the admin-area endpoint may be reachable without authentication - a pattern common in SourceCodester educational applications - though this should be independently verified. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified as confirmed actively exploited by CISA KEV at time of analysis), meaningfully lowering the barrier to opportunistic attacks against any internet-exposed deployment.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the unauthenticated admin login endpoint /admin/ajax.php?action=login to remote exploitation via the unsanitized Username parameter. A publicly available proof-of-concept exploit has been published on GitHub, reducing the bar for exploitation to near-zero skill level. The CVSS 4.0 vector confirms no authentication, privileges, or user interaction are required, though impact is limited to partial confidentiality, integrity, and availability compromise of the underlying database.

SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis.

SQL injection in xianrendzw EasyReport up to version 2.0.17.0522_Beta allows remote authenticated attackers to manipulate the sourcePath argument within the ModuleController.java Move Operations component, enabling unauthorized database query execution. The vulnerability carries limited confidentiality, integrity, and availability impact per the CVSS 4.0 assessment, though a publicly available proof-of-concept exploit (E:P) elevates the practical risk above its low CVSS score alone suggests. No vendor patch has been issued; the project was notified via a GitHub issue report but has not responded.

SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.

SQL injection in PHPGurukul Complaint Management System 1.0 exposes the user/check_availability.php endpoint to remote unauthenticated database manipulation via a crafted email parameter, enabling unauthorized data read, write, and limited availability disruption against the backend database. A public proof-of-concept exploit is confirmed available on GitHub, lowering the skill bar for opportunistic exploitation. No CISA KEV listing at time of analysis, but the CVSS 4.0 vector includes E:P confirming exploit code exists publicly.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.

SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.

SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject1.php` endpoint to unauthenticated remote attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the underlying database. The vulnerability carries a CVSS 4.0 score of 6.9 with no authentication or user interaction required, and a proof-of-concept exploit has been publicly disclosed via GitHub. No KEV listing exists, but the public POC materially lowers the barrier to exploitation for opportunistic attackers targeting exposed instances.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject2.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites. Public exploit code exists per the referenced GitHub issue, lowering the skill bar for attackers, though no CISA KEV listing confirms widespread active exploitation at time of analysis.

SQL injection in SourceCodester Pet Grooming Management Software 1.0 exposes the /admin/get_barcode_data.php endpoint to remote attackers who can manipulate the unsanitized 'barcode' parameter to read, alter, or corrupt the underlying database. The CVSS 4.0 vector assigns no authentication or user-interaction requirement, and a publicly available proof-of-concept lowers the exploitation bar to script-level effort. No CISA KEV listing exists, but the combination of a network-exposed attack surface and published exploit code makes this a higher practical priority than the nominal Medium score implies for any internet-facing deployment.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewprescriptionrecord.php endpoint to authenticated remote attackers who can manipulate the `delid` parameter to execute arbitrary SQL commands against the underlying database. Publicly available exploit code exists on GitHub, confirmed by the CVSS 4.0 E:P modifier, though no CISA KEV listing indicates active widespread exploitation at time of analysis. Given the healthcare context, the combination of public exploit availability and sensitive patient data makes this a higher-priority remediation than the low CVSS 4.0 score of 2.1 alone suggests.

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter in /viewpaymentreport.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any reachable instance. The CVSS 4.0 vector confirms low-privilege authentication is required (PR:L), and impact is rated partial across confidentiality, integrity, and availability - though SQL injection primitives can often be escalated beyond initial scoring to achieve broader data extraction.

SQL injection in itsourcecode Hospital Management System 1.0 exposes patient management functionality to low-privileged authenticated attackers who can manipulate the `delid` parameter in /viewpatient.php to alter or extract database records. Successful exploitation allows unauthorized read, modification, or deletion of patient data, carrying significant regulatory and privacy consequences in healthcare environments. A proof-of-concept exploit has been publicly disclosed via GitHub, materially lowering the bar for opportunistic attacks against unpatched instances; the vulnerability is not currently listed in the CISA KEV catalog.

SQL injection in the WC Vendors WordPress plugin (all versions through 2.7.0) enables authenticated shop managers to exfiltrate arbitrary records from the WordPress database via the 'status' parameter across multiple REST API admin endpoints. The flaw exploits a sanitization bypass specific to the WordPress REST API: WP_REST_Server::serve_request() calls wp_unslash() on GET parameters before registered sanitize callbacks execute, stripping WordPress's magic-quotes protection while leaving SQL metacharacters intact; sanitize_text_field then removes HTML but passes quotes and comment sequences through to the underlying SQL query unchanged. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the high confidentiality impact and the fact that multivendor marketplaces routinely grant shop manager access to untrusted third-party sellers elevate real-world risk for this plugin's typical deployment.

SQL injection in Weblizar's School Management - Education & Learning ERP WordPress plugin (versions ≤5.4) enables authenticated attackers with custom-level access to exfiltrate arbitrary database records by manipulating the unsanitized `order[0][dir]` sort-direction parameter across at least seven AJAX handlers. The vulnerability's attack surface is compounded by missing nonce verification on several of those same handlers, enabling a CSRF-chained exploitation path that effectively bypasses the authentication prerequisite when an authenticated user can be lured to a malicious page. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Second-order SQL Injection in the Slider Hero with Video Background, Animation WordPress plugin (versions up to and including 9.1.7) allows authenticated administrators to exfiltrate arbitrary data from the WordPress database. The vulnerability arises in the slide-duplication workflow: slide fields are safely parameterized on write, but re-read as raw strings and concatenated directly into an INSERT statement without any escaping when an administrator invokes the heroduplicateslider action. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

SQL injection in the User Login History WordPress plugin (all versions ≤2.1.7) enables authenticated administrators to append arbitrary SQL to existing queries via the unsanitized 'blog_id' parameter, exposing the full WordPress database to read access. The vulnerability is constrained to WordPress multisite deployments and requires Administrator-level credentials, limiting its real-world attack surface considerably. No public exploit code or CISA KEV listing has been identified at time of analysis; a code-level fix appears to have been committed upstream per the plugin repository changeset.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.

SQL Injection in the Quiz and Survey Master (QSM) WordPress plugin versions up to and including 11.2.1 allows authenticated attackers with custom-level access or above to extract sensitive data from the underlying WordPress database. The flaw resides in the 'randon_category' Quiz Option parameter, where insufficient escaping and improper SQL query preparation permit arbitrary SQL to be appended to existing queries. No public exploit code or active KEV listing has been identified at time of analysis; however, the targeted parameter is accessible to any user holding a custom or higher WordPress role, broadening the realistic attacker pool beyond just administrators.

SQL Injection in the Fullscreen Galleria WordPress plugin (all versions through 1.6.12) allows authenticated attackers holding contributor-level access or higher to append arbitrary SQL subqueries via an unsanitized 'href' attribute in post content, enabling full read-access to the WordPress database. Multiple vulnerable sinks in galleria-fs.php (lines 68, 74, 146, 1074, 1078) were identified and disclosed by Wordfence; upstream fix commits have been published to the WordPress plugin repository. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this at moderate real-world priority, elevated for sites with open contributor registration.

Second-order SQL injection in NEX-Forms - Ultimate Forms Plugin for WordPress (versions through 9.2.4) enables authenticated attackers with admin-level access to extract arbitrary data from the WordPress database by abusing insufficient escaping on the 'additional_params' parameter. The attack is staged: a malicious payload is first stored via the submission_report2 AJAX handler, which notably lacks a nonce check and whose required capability can be configured down to subscriber-level, then the injection fires when an administrator triggers a CSV export. No public exploit or active exploitation has been confirmed at time of analysis, but the privilege-downgrade path on the AJAX handler meaningfully complicates the PR:H framing of the official CVSS vector.

SQL injection in Evergreen's open-ils.fielder OpenSRF Service, exposed via the /osrf-gateway-v1 HTTP gateway endpoint, affects all actively maintained branches through 3.14.11, 3.15.11, 3.16.5, and 3.17-beta1. The CVSS 4.0 vector confirms network-accessible, unauthenticated exploitation with low attack complexity, yielding partial confidentiality, integrity, and availability impact against the underlying database. A public proof-of-concept has been disclosed and patched releases (3.14.12, 3.15.12, 3.16.6, 3.17-beta2) are available, making delayed remediation difficult to justify given the exploit's public availability.

SQL injection in SourceCodester Stock Management System 1.0 exposes the `/classes/Master.php?f=delete_supplier` endpoint to database manipulation by authenticated high-privileged users. The `id` parameter is passed unsanitized to the backend SQL query, enabling an attacker to read, modify, or delete database records. A publicly available exploit exists on GitHub, though exploitation is bounded by the high-privilege authentication requirement and the CVSS 4.0 base score of 2.0 reflects limited real-world blast radius. No active exploitation (CISA KEV) has been confirmed.

SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.

SQL injection in the `cat_id` parameter of `/homeaction.php` in code-projects Online Shopping System 1.0 exposes the backend database to remote attackers holding low-privilege authenticated sessions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms low-complexity network exploitation with a public proof-of-concept documented on GitHub, lowering the skill bar for abuse. Successful exploitation yields limited read, write, and availability impact against the application's database; no public active exploitation (KEV) has been confirmed.

SQL injection in code-projects Online Shopping System 1.0 exposes the `/action.php` endpoint to database manipulation via the unsanitized `proId` parameter. Attackers with low-privilege application access can send crafted HTTP requests over the network to read, alter, or corrupt backend database contents - impacting confidentiality, integrity, and availability. Publicly available exploit code exists per the GitHub disclosure, significantly lowering the skill barrier for opportunistic attackers despite the low CVSS 4.0 base score of 2.1.

SQL injection in code-projects Online Shopping System 1.0 allows remote unauthenticated attackers to manipulate the email parameter on the /login.php endpoint, potentially bypassing authentication and reading or modifying backend database contents. A public proof-of-concept exploit has been published on GitHub, confirming practical exploitability. No patch is available at time of analysis, and the product is a low-prevalence academic/demo codebase with no indication of CISA KEV listing.

SQL injection in code-projects Online Food Order System 1.0 allows remote authenticated attackers to manipulate the `checkbox` parameter in delete_food_items1.php to inject arbitrary SQL into the backend database. A proof-of-concept exploit has been publicly published on GitHub, and the CVSS 4.0 score of 2.1 reflects bounded confidentiality, integrity, and availability impact limited to the application's data scope. No CISA KEV listing and no vendor patch have been identified; this appears to be a researcher-reported vulnerability in niche academic software with negligible enterprise deployment.

SQL injection in Jinher OA 1.0 exposes the attendance approval endpoint to unauthenticated remote attackers via the unvalidated `httpOID` parameter in `/C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx`. Publicly available exploit code exists, lowering the bar for exploitation significantly. The vendor was notified prior to disclosure but did not respond, meaning no official patch has been issued.

SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_teacher.php` endpoint to unauthenticated remote exploitation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated, network-accessible exploitation with partial confidentiality, integrity, and availability impact. A public proof-of-concept exploit exists (E:P in CVSS 4.0 threat metrics); no vendor-released patch has been identified at time of analysis.

SQL Injection in WPML Multilingual CMS for WordPress allows authenticated attackers holding translator-level access or above to extract sensitive information from the underlying database on all plugin versions through 4.9.5. The vulnerable code resides in the Translation Manager REST API's job-ordering logic - specifically the unsanitized 'sorting' parameter processed by OrderQueryHelper - where user-supplied input is appended to existing SQL queries without adequate escaping or prepared-statement protections. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the translator role is routinely provisioned on multilingual WordPress sites, making the authenticated barrier lower than it may appear from the CVSS score alone.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.

SQL Injection in the 'Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms' WordPress plugin (all versions through 5.1) permits authenticated users holding editor-level or higher WordPress roles to append arbitrary SQL clauses to existing database queries via unsanitized Pattern JSON keys and values. The attack yields full read access to the WordPress database - including user credentials, PII, and configuration data - while carrying no integrity or availability impact per the CVSS vector (I:N, A:N). No public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at time of analysis.

SQL Injection in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin through version 4.5.1 exposes sensitive healthcare database contents to authenticated low-privilege users. The unsanitized 'searchTerm' parameter in SettingsController/ListingData.php (lines 69, 442, 456) is interpolated directly into SQL queries without parameterization, enabling arbitrary data extraction from the underlying WordPress database - including patient records, clinical data, and credential hashes. Exploitation is constrained to KiviCare custom roles bearing the 'settings_view' permission (e.g., Doctor, Receptionist), limiting but not eliminating insider-threat and compromised-account scenarios. No public exploit identified at time of analysis and no CISA KEV listing confirmed.

SQL injection in the Invisible Anti-Spam & CAPTCHA - reCAPTCHA Alternative for All Forms WordPress plugin (all versions through 5.1) exposes WordPress database contents to authenticated attackers holding editor-level or higher roles. The 'key' parameter in plugin admin functionality lacks sufficient escaping and prepared-statement handling, allowing appended SQL to read arbitrary database tables. No public exploit exists and the vulnerability is not listed in CISA KEV; exploitation is constrained by the high privilege requirement, keeping real-world risk moderate despite the high confidentiality impact.

Second-order SQL injection in the Contest Gallery WordPress plugin (all versions through 30.0.7) allows authenticated attackers with author-level access to append arbitrary SQL into backend queries via the `cgRealId` parameter within the `cg_multiple_files_for_post` upload mechanism. The injected payload is first stored in the database without adequate sanitization and later executed unsafely by backend AJAX handlers in `ajax/ajax-functions-backend.php` and gallery administration scripts, enabling extraction of sensitive information from the WordPress database. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Blind SQL injection in the Form Maker by 10Web WordPress plugin exposes full database read access to authenticated subscriber-level attackers through a two-stage exploitation path involving profile manipulation and a crafted AJAX request. All plugin versions through 1.15.44 are affected per Wordfence's disclosure, with specific vulnerable code paths confirmed at multiple locations in WDW_FM_Library.php and the plugin's frontend controllers. No public exploit code has been identified at time of analysis, and exploitation is gated behind a non-default form configuration, substantially limiting mass exploitation risk despite the C:H confidentiality rating.

SQL injection in the Groundhogg WordPress CRM plugin (versions through 4.5.14) permits authenticated attackers holding vendor-level or higher access to append arbitrary SQL to database queries via the insufficiently escaped 'tag_query' parameter, resulting in full read-access to the WordPress database. The exploitation path is non-trivial: the attacker must deliberately force execution into the deprecated Legacy_Contact_Query handler by submitting an unknown filter type that triggers a FilterException, bypassing the modern query handler's protections. No public exploit has been identified at time of analysis, and the vendor has issued a code fix (SVN changeset 3643654), though the exact patched release version is not independently confirmed in available data.

SQL injection in the Image Uploader for Welcart WordPress plugin (all versions up to and including 1.4.6) allows authenticated attackers holding author-level access or above to exfiltrate sensitive data from the WordPress database by appending arbitrary SQL to queries constructed around the unsanitized 'post_title' parameter. The root cause is the absence of both input escaping and prepared statement usage in the plugin's database interaction code, confirmed by Wordfence with direct source code references. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low authentication bar makes this a credible risk on any multi-author Welcart installation.

SQL injection in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables remote authenticated attackers to bypass security restrictions by injecting special elements into SQL commands, yielding limited confidentiality and integrity impact (C:L/I:L per CVSS). The CVSS medium score of 5.4 reflects the authentication barrier (PR:L) and bounded scope - no availability impact and no scope change. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available via IBM advisory node/7283359.

SQL injection in LimeSurvey Community Edition 7.0.5 exposes the Central Participant Database (CPDB) token-copy workflow to authenticated database exfiltration. An attacker with survey-level access can inject malicious SQL through unsanitized `participantId`, `surveyId`, `tokenFieldname`, and `participantAttributeId` parameters in `Participant.php`, achieving high-confidence read access to the underlying database with limited write impact. No public exploit identified at time of analysis; a vendor fix is available as a GitHub commit but a formally versioned patched release is not independently confirmed.

SQL injection in Tenable Security Center permits an authenticated administrator to execute arbitrary SQL queries against the underlying database, exposing sensitive data including stored credentials. The CVSS vector (PR:H) confirms exploitation requires existing administrator-level access, placing this squarely in the insider threat and compromised-admin scenario space. No public exploit code or active exploitation has been identified at time of analysis, but the 'Authentication Bypass' tag signals that extracted credentials could enable downstream privilege escalation or lateral movement into connected systems managed by Security Center.

SQL injection in SourceCodester Simple Client Management System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized `ID` parameter in `/classes/Master.php?f=save_service`. The vulnerability allows arbitrary SQL query manipulation, enabling data exfiltration and potential data modification against the backend database. A publicly disclosed proof-of-concept exploit exists (referenced in GitHub issue lyf3273/CVE/issues/3), elevating near-term exploitation risk for any internet-exposed instances despite the limited prevalence of this product.

Time-based SQL injection in the affiliate-toolkit WordPress plugin (all versions up to and including 3.8.8) enables authenticated administrators to blindly enumerate and extract arbitrary data from the WordPress database by manipulating the unsanitized `orderby` parameter in template administrative pages. The impact is limited to confidentiality - database modification and denial-of-service are not achievable via this vector. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, consistent with the high authentication barrier (PR:H) that substantially constrains real-world exploitability.

SQL injection in the Bit Form WordPress plugin (all versions through 3.2.0) allows authenticated administrators to append arbitrary SQL to existing database queries via the insufficiently escaped and unprepared `data[queryCondition]` parameter, yielding full database read and write access. Wordfence confirmed the vulnerability spans at least four distinct code paths across Model.php, AdminFormHandler.php, AdminAjax.php, and GlobalHelper.php, indicating the flaw is systemic to the plugin's query-building logic rather than isolated to a single endpoint. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; remediation urgency is driven by data sensitivity rather than observed threat activity.

SQL injection in SourceCodester Air Cargo Management System 1.0 exposes the `/classes/Master.php?f=save_cargo_type` endpoint to database manipulation via a crafted `id` argument. Exploitation requires high-privilege authenticated access (CVSS 4.0 PR:H), constraining the realistic attacker pool to compromised or shared administrator accounts. A public proof-of-concept is available on GitHub, confirmed by VulDB reporting; no patch has been identified at time of analysis.

Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized `table` parameter in `modules/Students/includes/Medical.inc.php`. While `DBEscapeIdentifier()` prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.

Unauthenticated SQL injection in Raisecom Communication Command and Dispatch Management Platform (versions up to 7.6.5) exposes backend database contents via the `sip` parameter in `/app/users/getpwd.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, zero-prerequisite exploitation, and a public proof-of-concept exploit is already available. The vendor did not respond to disclosure, leaving no patch available and no official guidance for affected operators.

SQL injection in SourceCodester Simple Student Information System exposes the admin department view endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter in app/admin/departments/view_department.php. A public proof-of-concept is available through a GitHub issue, confirmed by VulDB (EUVD-2026-58068), lowering the barrier for opportunistic exploitation. The CVSS 4.0 score of 6.9 with E:P reflects partial confidentiality, integrity, and availability impact - no authentication or special configuration is required based on the provided vector.

SQL injection in IBM i 7.3 through 7.6 enables remote authenticated attackers to modify data in certain SQL tables by injecting malicious SQL commands through improperly neutralized input. The CVSS score of 4.3 (Medium) reflects a constrained impact profile - integrity in specific tables is at risk, but confidentiality and availability are unaffected. A vendor patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.

SQL injection in IBM i 7.3 through 7.6 allows remote authenticated attackers to modify SQL table data by injecting unsanitized special elements into SQL commands processed by the platform. The CWE-89 root cause confirms missing or inadequate input neutralization within IBM i's SQL handling layer, enabling unauthorized data manipulation. No public exploit identified at time of analysis; a vendor patch is available via IBM advisory 7283289.

SQL injection in Winter CMS Backend Filter widget (versions <= 1.2.12) allows authenticated backend users to read arbitrary database contents by submitting crafted AJAX requests to the `numberrange` filter scope handler. Exploitation requires a third-party plugin to have registered a `numberrange` filter scope with the `conditions` configuration key - no built-in Winter CMS views use this combination, making vanilla installations unexploitable. The fix is confirmed in v1.2.13 via GitHub Advisory GHSA-m7jc-g4rc-jmvh; no public exploit code or active exploitation has been identified at time of analysis.

SQL injection in Phoenix Contact PLCnext controller web interfaces exposes a notification message SQLite database to manipulation by authenticated low-privilege users. The vulnerable endpoint is network-accessible with no attack requirements beyond a valid low-privilege account, making it trivially exploitable from any networked workstation in OT environments where such accounts exist. Impact is deliberately bounded by design to the notification subsystem - core PLC control logic, I/O, and safety functions are not affected - but notification tampering in industrial contexts may suppress or falsify operational alerts. No public exploit code exists and no CISA KEV listing is present at time of analysis.

SQL injection in n8n's PostgresTrigger node enables authenticated users to execute arbitrary SQL against connected PostgreSQL databases with the configured credential's full privileges. Affected versions span the n8n 1.x branch before 1.123.67, the 2.x branch before 2.31.5, and the 2.32.x branch before 2.32.1. Successful exploitation yields unrestricted read and write access to the backend PostgreSQL instance - a scope-change impact confirmed by the CVSS 4.0 SC:H/SI:H/SA:H rating - with no public exploit identified at time of analysis and no CISA KEV listing.

SQL injection in n8n's Snowflake node Execute Query operation exposes downstream Snowflake databases to unauthorized data access and manipulation when workflow authors embed externally-controlled expression data directly into raw SQL strings without parameterization. Affected across three version lines - n8n below 1.123.67, 2.0.0-rc.0 through below 2.31.5, and 2.32.0 through below 2.32.1 - the flaw is rooted in direct string interpolation rather than prepared statements. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector signals high subsequent-system confidentiality and integrity impact against connected Snowflake environments.

Stored SQL injection in Koha across all active release branches (24.11, 25.05, 25.11, 26.05) allows authenticated library staff holding the edit_borrowers permission to plant a compact time-based SLEEP payload in a patron's lang field, causing recurring denial-of-service each time an issue slip is printed for that patron. The 25-character column constraint prevents practical data extraction, confining real-world impact strictly to workflow disruption in the circulation slip-printing path. No public exploit code or active exploitation has been identified at time of analysis; the attack requires valid staff credentials scoped to a specific Koha permission.

Stored SQL injection in Koha's patron card layout feature allows authenticated staff with the label_creator permission to exfiltrate the entire library database, including patron PII and staff bcrypt password hashes. The image_name field is persisted verbatim into layout XML without sanitization and later concatenated raw into a SQL query inside patroncards/create-pdf.pl when a patron card batch is printed, creating a second-order injection that fires on a routine staff action. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact and low privilege requirement make this a meaningful priority for library operators running affected releases.

SQL DDL injection in SAP Social Intelligence (versions 102-109) allows an authenticated low-privilege network attacker to directly execute Data Definition Language commands against the underlying database. Exploitation can alter or destroy database schema objects - a more structurally damaging capability than typical DML injection - with vendor-rated Low impact across confidentiality, integrity, and availability. No active exploitation confirmed at time of analysis and no public exploit identified; patch details are available via SAP Security Note 3766473.

SQL injection in ERPNext's tax rule engine allows any authenticated low-privilege user to extract arbitrary database content. The get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py directly interpolated request-supplied posting_date and args dictionary values into raw SQL WHERE clauses via Python f-strings and .format() calls, bypassing all parameterization. Vendor-released patches exist as versions 15.109.0 and 16.20.0; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

SQL injection in the web server of TBEA TLogger (TBEA Communication Box 3rd Generation), firmware V2.1.0.0B0.0.0.0, lets a remote unauthenticated attacker inject SQL through multiple HTTP endpoints that build SQLite queries from attacker-controlled parameters. Successful exploitation allows reading, altering, or deleting all records in the device's on-board CCU.db database, giving full compromise of the logger's stored data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 and the unauthenticated network vector make it a high-priority defect for affected operational-technology deployments.

SQL injection in the vitepos WordPress plugin before version 3.6.0 enables authenticated administrators to exfiltrate database contents via a crafted REST API report request. The vulnerability stems from an unsanitized identifier taken directly from the request body and concatenated into a SQL query, a textbook CWE-89 flaw. A publicly available exploit proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV and the EPSS score of 0.16% reflects the high authentication bar.

SQL injection in the Term Pages WordPress plugin (versions before 2.0.0) allows unauthenticated remote attackers to execute arbitrary SQL queries against the WordPress database by submitting a crafted request containing a malicious parameter. The vulnerability stems from missing input sanitization and output escaping prior to SQL statement construction (CWE-89). A publicly available exploit exists per WPScan, though EPSS sits at just 0.18% (7th percentile), suggesting exploitation remains limited at this time despite accessible proof-of-concept code. No CISA KEV listing has been confirmed.

SQL injection in the Library Management System WordPress plugin (all versions before 3.6.7) allows any user holding a Subscriber role or higher to inject arbitrary SQL into the underlying WordPress database, extracting sensitive records including user password hashes. A publicly available proof-of-concept exploit is confirmed via WPScan. No CISA KEV listing exists and EPSS sits at 0.17% (6th percentile), indicating limited observed automated exploitation, but the low privilege bar and public POC make this a meaningful and urgent patching priority for any affected site.

SQL injection in SourceCodester Simple Doctors Appointment System 1.0 exposes the `/admin/ajax.php?action=set_appointment` endpoint to unauthenticated remote attackers who can manipulate database queries by supplying crafted values for the `id` argument. The attack requires no privileges or user interaction, and a public proof-of-concept is available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch has been identified at time of analysis, leaving all deployed instances of version 1.0 unmitigated.

SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated attackers to database manipulation via the `delid` parameter in `/viewdoctorconsultancycharge.php`. The vulnerability is PHP-based, requires only low-privilege authentication, and carries a public proof-of-concept exploit documented on GitHub. No active exploitation has been confirmed via CISA KEV, and the CVSS 4.0 score of 2.1 reflects constrained impact, though the sensitivity of healthcare data elevates organizational risk beyond the raw score.

SQL injection in MingSoft MCMS up to version 3.0.6 exposes the application's database to unauthenticated remote attackers via the formFields argument in the ModelDataImpl.queryDiyFormData function at /mdiy/form/data/list.do. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or special conditions are required, making the endpoint directly exploitable over the internet. A public exploit has been disclosed (E:P in CVSS 4.0 supplemental metrics), and the vendor failed to respond to responsible disclosure, leaving users without an official patch.

SQL injection in lock-upme OPMS allows remote low-privileged attackers to manipulate the `ids` argument within the IN Clause Handler of controllers/messages/message.go, potentially enabling unauthorized read and write access to underlying database contents. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network exploitation with low complexity, requiring only a valid low-privileged session, yielding partial confidentiality, integrity, and availability impact. No vendor patch exists as the maintainer did not respond to the coordinated disclosure, and no public exploit or CISA KEV listing has been identified at time of analysis.

SQL injection in dresende/node-sql-query versions 0.1.25-0.1.28 allows attackers who can influence the joinType option passed to SelectQuery.from() to inject arbitrary SQL into JOIN clauses, because the joinType string was interpolated directly into the query without any allowlist validation. Applications built on this Node.js SQL query-builder library that pass user-controlled input to the joinType parameter are exploitable remotely with no authentication (per the CVSS 4.0 AV:N/PR:N vector). A publicly available exploit exists per the E:P maturity flag and referenced GitHub issue; no confirmed active exploitation (not in CISA KEV). A vendor-released patch is available as v0.1.29.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewdoctor.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing authenticated remote attackers to read, modify, or potentially delete records including patient and physician data. No active exploitation is confirmed in the CISA KEV catalog, but a public proof-of-concept exploit exists on GitHub, materially lowering the skill threshold for attacks. The CVSS 4.0 score of 5.3 with PR:L reflects a constrained but realistic threat to healthcare deployments with lax access controls.

SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.