SQL Injection

SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.

SQL injection in SourceCodester Simple Doctors Appointment System 1.0 exposes the application's database to remote manipulation through the unsanitized 'id' parameter in the admin delete-appointment endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates low-complexity remote exploitation with no authentication formally required per the reporter's assessment, though the /admin/ path implies a session context that should be independently verified. A public proof-of-concept is available on GitHub, raising practical exploitation risk despite the product's limited real-world footprint; no active exploitation (CISA KEV) has been recorded.

SQL injection in SourceCodester Photo Share Website 1.0 exposes the unauthenticated user registration endpoint (/social/ajax.php?action=signup) to database manipulation via the email parameter. The CVSS 4.0 vector confirms network-exploitable with no authentication, no complexity, and no special attack conditions, while the E:P modifier reflects publicly available exploit code hosted on GitHub. No active exploitation is confirmed in CISA KEV, but the combination of a zero-barrier attack surface and public POC code means any internet-exposed instance should be treated as immediately at risk.

SQL injection in Postgrex (elixir-ecto's PostgreSQL driver) versions 0.19.3 through 0.22.3 allows an attacker who controls the :comment option passed to Postgrex.stream/4 or Ecto.Repo.stream/2 to close the SQL comment delimiter with */ and inject arbitrary SQL clauses into the streamed statement, executing them under the existing database connection's role. The root cause is a missing call to the comment_not_present!/1 guard in stream/4, an oversight absent from every other execution path in the library. No public exploit code has been identified and no active exploitation appears in the CISA KEV catalog; the CVSS 4.0 vector (AV:L, AT:P) signals that exploitation requires specific, non-default application architecture.

SQL injection in SourceCodester Photo Share Website 1.0 exposes the login endpoint `/social/ajax.php?action=login` to remote unauthenticated exploitation via the `email` parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector confirms zero-barrier access - no credentials, no complexity, no user interaction required against a default deployment. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the threshold for opportunistic attacks, though no active exploitation has been confirmed in CISA KEV.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment deletion endpoint `/viewappointment.php` to database manipulation by authenticated low-privileged users via the `delid` parameter. The vulnerability allows partial read, write, and availability impact against the underlying database. A proof-of-concept exploit has been publicly published (CVSS 4.0 E:P), lowering the bar for abuse. No public KEV listing or vendor patch has been identified at time of analysis.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewadmin.php endpoint to database manipulation via the unsanitized `delid` parameter. Authenticated low-privileged attackers with network access can craft malicious requests to read, modify, or delete records from the underlying database. A public exploit exists (POC confirmed via VulDB submission); no KEV listing at time of analysis.

SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-privilege credentials to manipulate database queries via the unsanitized `editid` parameter in `/treatmentrecord.php`. Exploitation can expose or alter sensitive patient treatment records stored in the backend database. A publicly disclosed exploit exists (E:P), though no confirmed active exploitation appears in CISA KEV at time of analysis.

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries by supplying crafted input via the `patientid` parameter in `/treatmentdetail.php`. Successful exploitation can result in unauthorized read or modification of patient records and other database contents. Publicly available exploit code exists (CVSS 4.0 supplemental E:P), raising practical risk above the low numeric score of 2.1 suggests; however, no confirmed active exploitation has been identified in CISA KEV at time of analysis.

SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/treatment.php` endpoint to database manipulation via the `editid` parameter, accessible to remote low-privilege authenticated users. Public exploit code has been released and is referenced via a GitHub issue, making exploitation straightforward for attackers who have obtained any valid session. The CVSS 4.0 score of 2.1 reflects bounded impact (low C/I/A, no subsequent-system scope), but the healthcare context - where treatment records carry regulatory and patient-safety weight - elevates real-world consequence beyond the raw score.

SQL injection in chiuwingyan's 'house' web application exposes the `/paid/selectall.action` endpoint to remote unauthenticated attackers who can manipulate the `zuname` parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated remote exploitation, and the E:P supplemental metric confirms a public proof-of-concept has been disclosed via VulDB. No patch exists and the vendor did not respond to responsible disclosure, leaving deployments permanently unmitigated absent operator-side controls.

Cross-tenant namespace disclosure in LangGraph's PostgreSQL and SQLite checkpoint stores allows an authenticated low-privileged user to read stored items belonging to other namespaces without any crafted input. The flaw arises from translating hierarchical namespaces into dot-joined strings and scoping reads with SQL LIKE patterns that have no understanding of the segment separator, so a query scoped to 'foo' also returns data from 'foobar' or 'foo2'. Exploitation requires the specific precondition of prefix-overlapping or wildcard-containing namespace labels; no public exploit code exists and the vendor confirms no evidence of in-the-wild exploitation.

SQL injection in SourceCodester Computer Repair Shop Management System 1.0 exposes the `/classes/Master.php?f=delete_product` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit has been disclosed on GitHub. Impact is assessed as limited (VC:L/VI:L/VA:L) with no scope change to subsequent systems, though the availability of exploit code meaningfully lowers the bar for opportunistic abuse of any internet-exposed instance.

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `editid` parameter in /servicetype.php. The vulnerability is a classic CWE-89 unsanitized input passed directly to a SQL query, enabling read and write access to the underlying database. A public proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk above the low CVSS 4.0 base score of 2.1 - though exploitation is not confirmed in CISA KEV and real-world deployment of this product is limited.

SQL injection in the Welcart e-Commerce WordPress plugin (all versions before 2.11.32) enables authenticated users holding at minimum the Editor role - or Welcart's custom shop-management roles - to execute arbitrary SQL against the underlying WordPress database by supplying a crafted CSV file through the plugin's import feature. A publicly available proof-of-concept exploit exists (reported by WPScan), meaningfully lowering the bar for abuse by any account with sufficient role access. No active exploitation is confirmed in CISA KEV at time of analysis, but the combination of a public POC and high database impact (confidentiality and integrity both rated High) makes patching urgent for multi-editor or multi-manager WordPress deployments.

Unauthenticated SQL injection in Rongzhitong Visual Integrated Command and Dispatch Platform (all versions through build 20260617) exposes the `/dm/dispatch/user/findAll` endpoint to remote database manipulation via the unsanitized `Name` parameter. A publicly available exploit has been published, and the vendor has not responded to responsible disclosure, meaning no patch exists. With CVSS 4.0 AV:N/PR:N and a live exploit, any internet-exposed deployment is at immediate risk of data extraction or modification.

SQL injection in the imranrisal-dev Student-Management-System login component (loginCheckTest.php) allows unauthenticated remote attackers to manipulate backend database queries via the username and password parameters. A public exploit exists (CVSS 4.0 E:P modifier confirmed), making opportunistic exploitation immediately feasible with no authentication or special preconditions. The vendor was unresponsive to responsible disclosure, and no patch has been released, leaving all deployed instances of this repository permanently exposed.

SQL injection in ChirpStack's SQLite-backend device tag filtering exposes the full database contents to any authenticated user with device-list access. The flaw lives in `chirpstack/src/storage/device.rs` within both `get_count()` and `list()`, where the tag KEY is concatenated into raw SQL via Rust's `format!()` macro while only the tag VALUE receives safe parameterization through Diesel's `.bind()`. Only deployments using the `chirpstack-sqlite` package are affected - the PostgreSQL backend uses Diesel's native JSONB containment operator and is architecturally immune. No public exploit code or CISA KEV listing has been identified at time of analysis.

SQL injection in the ZTE Smart Life mobile app enables a local attacker with physical device access to execute UNION SELECT statements against the app's feedback.db SQLite database, extracting sensitive personal data including user account details, phone numbers, feedback content, and local debug log paths. Exploitation is severely constrained by the CVSS:3.1/AV:P/AC:H/PR:L/UI:R vector, requiring physical access to the device, a low-privilege authenticated session within the app, user interaction, and non-trivial attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor (ZTE PSIRT) has published a bulletin acknowledging the issue.

Time-based SQL injection in the JoomSport WordPress plugin (all versions through 5.7.9) allows extraction of sensitive WordPress database contents via the unsanitized 'order' parameter on a vulnerable admin boxfields page. While the direct exploitation path requires administrator-level authentication (PR:H), the affected admin endpoint lacks nonce or CSRF protection on GET requests, creating a second, more accessible attack path: an unauthenticated actor can trigger the injection by social-engineering an active administrator session into issuing a crafted URL. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CSRF bypass substantially elevates real-world risk beyond the official CVSS 4.9 score.

SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.

SQL injection in the WP TripAdvisor Review Slider WordPress plugin (all versions through 14.3) enables authenticated administrators to extract arbitrary data from the underlying WordPress database via a maliciously crafted `curselrevs[]` array parameter. The flaw stems from insufficient escaping and improper SQL query preparation in the plugin's admin-side code, documented at specific lines in the plugin's source on the WordPress repository. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified; real-world risk is substantially constrained by the administrator-level privilege requirement reflected in the CVSS 4.9 Medium score.

SQL injection in the Askeet - Talk to Your WooCommerce Data plugin (all versions through 3.0) enables authenticated administrators to exfiltrate arbitrary data from the WordPress database by exploiting a filter bypass in the plugin's query sanitization routine. The `askeet_is_safe_query()` function strips standard MySQL block comments before scanning for forbidden keywords, but fails to account for MySQL's conditional comment syntax (e.g., `/*!UNION*/`), which MySQL executes as live SQL while the filter treats it as a comment. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at the time of analysis; EPSS data was not included in the available intelligence.

Second-order SQL injection in the User Access Manager WordPress plugin (versions ≤ 2.3.12) enables authenticated attackers with subscriber-level access to exfiltrate arbitrary data from the WordPress database. The vulnerability is rooted in a stored objectId value that bypasses validation at write time but is later imploded directly into a SQL NOT IN() clause without integer casting or prepared statements, exploiting a classic second-order injection pattern across two distinct code paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low privilege requirement (subscriber-level) and high confidentiality impact make this a meaningful priority on sites with open user registration or untrusted authenticated users.

Local root escalation on the ZTE Nubia Red Magic 11 Air (NX799J) gaming smartphone stems from a built-in PostgreSQL service that runs as root, listens on a device port, and is guarded only by weak credentials. Because PostgreSQL's COPY FROM PROGRAM syntax executes OS commands with the server's privileges, any local app that reaches the database can break out of the Android application sandbox and run commands as root. No public exploit identified at time of analysis, though the technique (weak-cred Postgres plus COPY FROM PROGRAM) is well understood and trivially reproducible.

SQL injection in the PrettyLinks WordPress plugin (all versions through 3.6.20) enables authenticated administrators to extract arbitrary data from the underlying WordPress database by appending malicious SQL to the 's' search parameter on the Pretty Links listing page. The root cause is insufficient input escaping and absent prepared-statement usage in the `search_links_table()` function within `PrliLinksController.php`. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the CVSS confidentiality impact is rated High, meaning successful exploitation could expose all data stored in the WordPress database.

SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.

SQL injection in the WP ERP WordPress plugin (all versions through 1.17.4) allows authenticated CRM Agent-role users to extract arbitrary data from the WordPress database by supplying a crafted 'erpadvancefilter' parameter to the CRM AJAX handler. The root flaw is a sanitization gap: sanitize_text_field strips HTML but preserves single quotes, which are then interpolated verbatim into a single-quoted SQL WHERE clause inside erp_crm_contact_advance_filter() before execution via $wpdb->get_results(), bypassing WordPress's parameterized query protections entirely. No public exploit has been identified at time of analysis, but the vulnerable code paths are fully documented in WordPress plugin trac source references provided by Wordfence.

SQL injection in lavkush-maurya Student-Registration-System 1.0 allows authenticated remote attackers to manipulate backend database queries via the unsanitized `oldpass` parameter in `/student/changepass.php`, potentially exposing or modifying student records. A proof-of-concept exploit has been publicly disclosed on GitHub, making exploitation trivial for any holder of a low-privileged student account. No vendor patch exists - the maintainer did not respond to coordinated disclosure - leaving all deployments of this version permanently unmitigated absent manual intervention.

SQL injection in ESAFENET CDG's USB key login endpoint allows remote unauthenticated attackers to manipulate backend database queries through the unvalidated `keyid` parameter at `/CDGServer3/ukey/usbkey;logindojojs`. All CDG versions up to build 20260615 are affected per CPE data, with impacts spanning limited database read and write access. A public exploit is available (E:P per CVSS 4.0 vector), the vendor has not responded to disclosure, and no patch has been released - leaving all deployed instances exposed with no vendor-confirmed remediation path.

SQL injection in Shandong Hoteam PDM Product Data Management System (versions up to 8.3.10) allows unauthenticated remote attackers to inject arbitrary SQL commands via the `FilterString` parameter of the `GetStoredClassByFilter` function exposed through the `/Base/BaseService.asmx/DataService` ASMX web service endpoint. A public exploit has been disclosed via a Feishu document, elevating real-world risk despite the moderate CVSS 4.0 score of 5.5. The vendor did not respond to responsible disclosure, meaning no patch is available and no remediation timeline exists.

SQL injection in chetans9's core-php-admin-panel exposes the customers.php endpoint to remote authenticated attackers who can manipulate the filter_col argument to execute arbitrary SQL against the backend database. All code up to commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f on the rolling-release branch is affected, with no vendor patch issued as the maintainer did not respond to disclosure. A public proof-of-concept exploit is available via GitHub, though no confirmed active exploitation has been recorded by CISA KEV; CVSS 4.0 scores the overall risk at 2.1, reflecting limited but real partial data exposure and database manipulation potential.

SQL injection in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin (versions before 1.5.5) exposes the underlying WordPress database to unauthorized read access by any user holding a specific capability that defaults to administrators but can be explicitly delegated to lower-privileged roles. The CVSS scope-change rating (S:C/C:H) reflects that a successful injection reaches beyond the plugin itself into the shared WordPress database, potentially exposing all stored form submissions, user data, and other sensitive records. Publicly available exploit code exists per WPScan; however, EPSS at 0.16% (5th percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.

SQL injection in sar2html 4.0.0's Search component permits remote low-privileged attackers to manipulate backend SQL queries by supplying crafted input to the Search argument in sar2html.py. Public exploit code exists (CVSS 4.0 E:P), though the vulnerability has not been confirmed as actively exploited in the wild via CISA KEV. The vendor did not respond to coordinated disclosure, leaving no official patch available and no timeline for remediation.

Second-order SQL injection in osCommerce 4.14.63493 allows remote attackers with high-privilege (administrator-level) backend access to manipulate the `email_templates_key` parameter in the Email Template Configuration component, enabling database extraction and modification. Public exploit code is confirmed available via an anonymous repository hosting a detailed second-order SQLi report. No vendor patch exists - the vendor did not respond to responsible disclosure - raising operational risk for any organization still running this version despite the PR:H constraint.

SQL Injection in CubeWP Framework plugin for WordPress (all versions through 1.1.30) enables authenticated attackers holding only subscriber-level access to append arbitrary SQL to database queries via the cubewp_remove_relation() AJAX handler, exposing the full WordPress database to read-based attacks. The flaw is particularly egregious because the code actively undoes WordPress's built-in injection protection: wp_unslash() strips the magic-quotes escaping that WordPress applies to all POST data, then the unescaped relation_id is interpolated directly into a raw SQL query without wpdb->prepare(), with sanitize_text_field() providing no SQL protection whatsoever. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low subscriber-level authentication bar significantly elevates real-world risk on sites with open user registration.

SQL injection in the WPvivid Backup & Migration WordPress plugin (versions ≤0.9.131) allows authenticated Administrators to extract arbitrary data from the WordPress database via a crafted export_data parameter. The flaw exists because JSON object keys supplied by the attacker pass through sanitize_text_field() and stripslashes() but are never integer-cast, allowing them to be stored and later interpolated unsanitized into a WHERE ID IN (...) SQL clause without wpdb->prepare() or esc_sql(). No public exploit or active exploitation has been identified; the Administrator privilege requirement substantially constrains real-world impact.

SQL injection in the Icegram Mailer WordPress plugin (versions up to and including 1.0.12) enables authenticated WordPress administrators to extract arbitrary data from the underlying database by manipulating the 'fields' parameter submitted to the email log view. The vulnerable code path in Icegram_Mailer_Logs_Table::get_logs() concatenates user-supplied array elements verbatim into a SQL SELECT clause via PHP implode() with no whitelist, escaping, or prepared-statement binding. No active exploitation has been confirmed (not listed in CISA KEV), no public POC is referenced, and a code-level fix is visible in the plugin's SVN repository at changeset 3627122, though the exact patched release version is not independently confirmed from available data.

Time-based blind SQL injection in the Database Collation Fix WordPress plugin (versions ≤ 1.2.10) allows remote attackers to extract sensitive information from the WordPress database via the 'force-collation-algorithm' parameter. Exploitation is gated on a non-default precondition: a trigger.txt file must exist in the plugin directory, a state created only by DesktopServer lifecycle events such as site creation, import, or deploy operations. No public exploit code and no CISA KEV listing have been identified at time of analysis, substantially limiting real-world exposure to sites with an active DesktopServer integration history.

SQL injection in the GSheetConnector CF7 Google Sheets Connector WordPress plugin (all versions through 5.2.1) enables authenticated administrators to exfiltrate arbitrary database contents via the unsanitized 's' search parameter. The root cause is a flawed sanitization chain: wp_unslash() removes magic-quote escaping while sanitize_text_field() fails to neutralize SQL metacharacters, leaving single quotes intact before direct query interpolation. No public exploit or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references confirming the vulnerable code paths in class-gs-cf7db-formEntryList.php and gs-cf7db.php.

Second-order SQL injection in the Icegram Engage WordPress plugin (all versions through 3.1.42) allows authenticated attackers holding sufficient WordPress role privileges to extract arbitrary data from the site database across two deliberate HTTP requests. A crafted `messages[][id]` value is first persisted to WordPress post meta through the `save_campaign_preview()` AJAX action, then later interpolated unescaped into a SQL `IN()` clause inside `get_message_data()` during a subsequent preview request - bypassing `$wpdb->prepare()` entirely. No public exploit code or CISA KEV listing exists at time of analysis; Wordfence reported the issue with a CVSS 6.5 base score reflecting high confidentiality impact against an unchanged scope.

Blind SQL injection in the Pinpoint Booking System - Version 2 WordPress plugin (all versions through 2.9.9.6.9) allows authenticated administrators to extract arbitrary data from the underlying WordPress database via the unsanitized 'field' parameter. The vulnerability resides in the backend calendar class (class-backend-calendar.php) and is reachable by any user holding administrator-level access; the required nonce is trivially obtainable from any plugin admin page loaded under manage_options, eliminating any meaningful anti-CSRF barrier once admin credentials are possessed. No public exploit code or active exploitation has been identified at time of analysis.

SQL injection in SourceCodester Modern Loan Management System 1.0 lets attackers manipulate the database via the unsanitized 'id' parameter of /admin/delete_group.php. The flaw carries a CVSS 9.8 and CISA SSVC rates technical impact as total and automatable, but EPSS is only 0.16% (5th percentile) and status is publicly available exploit code exists (POC), not active exploitation. A TaintRadar proof-of-concept is published, making trivial exploitation likely against any exposed instance.

SQL injection in SourceCodester Modern Loan Management System 1.0 allows remote attackers to inject arbitrary SQL through the district_id, division_id, region_id, and ward_id parameters of ajaxData.php. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires no authentication or user interaction and yields total compromise of the backend database (confidentiality, integrity, and availability all High). Publicly available exploit code exists (documented in the TaintRadar research repository), though EPSS remains low at 0.16% and the flaw is not on the CISA KEV list.

SQL injection in multiple PHP Jabbers PHP scripts allows an authenticated user to inject arbitrary SQL through the sorting parameters, enabling database read and modification. Reported by CERT Polska (cert.pl) and classified as CWE-89, it carries a CVSS 4.0 base score of 8.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor states the issue is fixed in updated versions listed in the (not-provided) affected-products list, so patched builds exist but exact fix versions are not confirmed in the supplied data.

SQL injection in PHP Jabbers Car Rental Script allows unauthenticated remote attackers to inject arbitrary SQL through sorting-related parameters that are not properly neutralized before use in database queries. The flaw (CWE-89) carries a CVSS 4.0 base score of 9.3 and enables reading or manipulating backend database contents; there is no public exploit identified at time of analysis, and it is fixed in version 4.1. Because sorting parameters are typically reachable on public-facing catalog/listing pages, exploitation requires no credentials or user interaction.

SQL injection in WP Go Maps WordPress plugin (all versions before 10.1.04) allows unauthenticated network attackers to read data from the underlying WordPress database by injecting malicious SQL syntax into an unsanitized plugin parameter. Reported by WPScan, a publicly available proof-of-concept exploit exists for this flaw; however, CISA KEV does not list active exploitation, and EPSS at 0.18% (7th percentile) indicates low observed exploitation probability in the wild. The SSVC framework's 'non-automatable' classification and the CVSS AC:H rating indicate that exploitation requires attacker effort beyond trivial scripting, moderating the real-world urgency despite the unauthenticated attack vector.

SQL injection in the Check & Log Email WordPress plugin (all versions before 2.0.15) allows authenticated WordPress administrators to execute arbitrary SQL queries against the underlying database via unsanitized parameters. With PR:H per the CVSS vector, exploitation is constrained to admin-level accounts, making the primary threat a rogue insider or a follow-on attack after admin credential compromise. A public proof-of-concept is available through WPScan; however, EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation campaign at time of analysis.

SQL injection via unescaped identifier interpolation in Kamaji's PostgreSQL and MySQL datastore drivers exposes the shared datastore root connection to arbitrary DDL/DML manipulation. Versions prior to 26.7.4-edge interpolate operator-supplied DataStoreUsername and DataStoreSchema fields directly into SQL via fmt.Sprintf without any identifier sanitization, allowing a quote or backtick character to break out of the identifier context. Compounding the risk, the pre-fix MySQL primary connection had multiStatements=true enabled, enabling stacked query execution over a root-privileged database connection that spans all hosted tenant control planes. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

SQL injection in the WP Hotel Booking WordPress plugin before 2.3.2 allows users holding plugin-specific booking-management roles to extract data from the underlying WordPress database via an unsanitized search parameter on the administrative booking listing page. The CVSS scope change (S:C) and high confidentiality impact (C:H) indicate the injected queries can reach data beyond the plugin's own tables, such as WordPress user credentials or site configuration. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile) and the vulnerability is not listed in CISA KEV, suggesting targeted rather than widespread exploitation risk.

Second-order SQL Injection in the Improved Save Button WordPress plugin (all versions ≤ 1.2.1) allows authenticated attackers with author-level access or above to exfiltrate sensitive data from the WordPress database. The flaw arises in the 'Save and Duplicate' feature, where a user-supplied 'meta_key' Custom Field value is stored without adequate escaping, then later incorporated into an insufficiently prepared SQL query when the duplicate action is triggered. No public exploit code or active exploitation has been identified at time of analysis, and with a CVSS score of 6.5 the risk is medium - constrained by the authentication barrier but meaningful in multi-author WordPress environments.

SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.

SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.

SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.

SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.

SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.

SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.

SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.

SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.

SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers manipulate backend database queries through the unsanitized fromDate parameter in report.php and revenue_report.php. With no public exploit identified at time of analysis and a very low EPSS score (0.14%), the flaw carries a maximal CVSS 9.8 but appears to affect a niche PHP application; authentication requirements not confirmed beyond the PR:N stated in the CVSS vector, which indicates unauthenticated access. Successful exploitation permits full read/write access to membership and financial data.

SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.

Blind SQL injection in Quick.CMS 6.8 is exploitable by a high-privileged administrator through multiple fields in the administration panel, bypassing front-end validation controls and enabling potential database destruction. The vendor has explicitly declined to patch this issue, citing the administration panel's existing broad modification capabilities as context that limits the incremental risk. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 reflects the high-privilege prerequisite that significantly constrains real-world impact.

SQL Injection in WP-Lister Lite for eBay (WordPress plugin, all versions ≤ 3.8.8) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL clauses via the unsanitized 'orderby' parameter, enabling exfiltration of sensitive data from the WordPress database. The flaw spans at least three distinct model/table classes - ProfilesModel.php, StocksLogTable.php, and EbayOrdersModel.php - indicating a systemic lack of input preparation rather than an isolated oversight. No public exploit code or CISA KEV listing has been identified at time of analysis; the high privilege requirement substantially constrains the realistic attacker population.

Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.

SQL Injection in kishan0725 Hospital Management System 4.0 exposes patient medical history records to unauthenticated remote attackers via the `viewid` parameter of the `view-medhistory.php` endpoint. The CVSS vector confirms no authentication, complexity, or user interaction is required, and the SSVC framework independently verifies a proof-of-concept exists and the attack is fully automatable. Despite a low EPSS score of 0.14%, the sensitivity of medical record data and zero-barrier exploitation make any internet-exposed instance a meaningful risk; no public exploit identified at time of analysis as confirmed active exploitation (KEV not listed).

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized 'status' parameter of /save_user.php, enabling data theft, tampering, or authentication bypass. The flaw carries a CVSS 7.3 and a documented technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV and its EPSS exploitation probability is very low (0.14%, 4th percentile). No vendor patch has been identified for this end-of-life hobbyist PHP application.

SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers manipulate database queries through the unsanitized 'editid' GET parameter of /doctor/edit-patient.php. Successful injection can expose or alter stored patient records and potentially the whole application database. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.14%, though a public technical write-up documenting the injection point exists.

SQL injection in kishan0725's open-source Hospital Management System 4.0 lets remote attackers manipulate backend database queries through the check_availability.php endpoint via the unsanitized emailid and email parameters (CWE-89). The flaw carries a 7.3 CVSS score with a network/no-privilege vector, meaning it is reachable without authentication, though its EPSS probability is low (0.15%, 5th percentile) and no public exploit identified at time of analysis. The vulnerability is documented in the academic TaintRadar SQLi corpus but is not listed in CISA KEV.

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 allows attackers to manipulate backend database queries through the fname and student_class parameters of update_student.php, enabling extraction or tampering of student enrollment records. The flaw carries CVSS 7.3 (network-reachable, low complexity) but is a niche PHP tutorial-grade application with negligible exploitation probability (EPSS 0.14%, 4th percentile), and no public exploit identified at time of analysis. Not listed in CISA KEV.

SQL injection in kishan0725's open-source PHP Hospital Management System 4.0 lets attackers manipulate the backend database via the 'fromdate' parameter of /betweendates-detailsreports.php. Because input is concatenated directly into a SQL query, an attacker can read, alter, or destroy patient and hospital records; publicly available exploit code exists (sqlmap-confirmed injection techniques documented in the TaintRadar research repository). EPSS is low (0.14%, 4th percentile) and there is no CISA KEV listing, so this is a proof-of-concept-stage issue rather than confirmed active exploitation.

SQL injection in kishan0725 Hospital Management System 4.0 lets attackers manipulate the 'viewid' parameter of /hms/doctor/view-patient.php to inject arbitrary SQL, exposing and altering the backend patient database. The flaw carries a CVSS 9.8 and CWE-89 classification, and publicly available exploit code exists via a TaintRadar research write-up, though it is not listed in CISA KEV and its EPSS score is only 0.14% (4th percentile). CISA's SSVC framework rates it automatable with total technical impact, meaning successful exploitation can fully compromise database confidentiality, integrity, and availability.

SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers inject arbitrary SQL through the 'doctor' and 'specilizationid' parameters of get_doctor.php, yielding full read/write access to the backend database. The CVSS 9.8 vector (PR:N) indicates unauthenticated network exploitation, though no public exploit is identified and EPSS remains very low at 0.15%. This is an open-source PHP/MySQL project on GitHub rather than commercial enterprise software, so real-world exposure is limited despite the critical score.

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized class_name parameter of update_class.php. Because the flaw is unauthenticated and network-reachable (CVSS 9.8), an attacker can read, alter, or destroy enrollment records and potentially achieve full database compromise. There is publicly available exploit code exists via a public disclosure write-up, though EPSS remains low at 0.14% (4th percentile), indicating limited observed exploitation activity.

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets attackers manipulate the backend database through the new_password parameter of update_password.php, enabling data theft, credential tampering, and unauthorized account takeover. The flaw is a classic CWE-89 injection in a small PHP web application, with publicly available exploit code (TaintRadar/VulDB) but no public exploit confirmed as actively used. EPSS is low (0.14%, 4th percentile), consistent with a niche product that is documented but not mass-targeted.

SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers inject arbitrary SQL through the fname, lname, and student_class parameters of save_stud.php, enabling database read, modification, and potential full compromise of enrollment records. The flaw carries a 9.8 CVSS rating reflecting network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact. It is not in CISA KEV and its EPSS score is low (0.14%, 4th percentile); no public exploit identified at time of analysis, though an automated TaintRadar taint-analysis writeup documents the injection path.

SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.

SQL injection in Tanium Patch allows authenticated low-privilege attackers to read, modify, or delete data from the backend database via crafted network requests. The vulnerability affects all versions prior to the vendor-released patch identified in advisory TAN-2026-019. No public exploit code or active exploitation has been reported.

SQL injection in the Plugin Organizer WordPress plugin (<=10.2.4) allows authenticated attackers with subscriber-level access to extract sensitive information from the web server's database. The vulnerability arises from improper escaping in the perform_plugin_search() AJAX handler, where esc_sql() output is mishandled by preg_replace(), permitting arbitrary SQL query injection. No public exploit or active exploitation reported; the patch is available in version 10.2.5.

Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.

SQL injection in the Taskbuilder WordPress plugin version 5.0.9 and earlier allows authenticated users with subscriber-level access or higher to extract sensitive database information via the 'wppm_proj_filter' parameter. The vulnerability stems from improper sanitization and parameterization, where user input is concatenated into a prepared statement without proper quoting. No active exploitation or public exploit code has been confirmed at the time of analysis, and the CVSS score is 6.5 (Medium).

Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-level attackers to extract database contents through a second-order attack. Malicious payloads inserted into the `checkout_payment_plans` and `order_status` plugin settings are saved by `update_option()` and later executed when a WP-Cron event triggers the vulnerable `sendSms()` function. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive database information. Affected are all versions up to 3.9.7. No public exploit or active exploitation has been identified at this time.

SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database information. Affected versions up to and including 3.9.7 are vulnerable via the 'id' parameter. No active exploitation or public exploit has been reported as of this analysis.

Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.

SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.

SQL injection vulnerability in the WPBot WordPress plugin before version 8.5.2 allows authenticated administrators to inject arbitrary SQL queries via unsanitized field identifiers. This injection executes when a site visitor triggers a search, potentially leading to low-level data exposure or modification. A public exploit is available, though no active exploitation has been confirmed by CISA KEV.

SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via the order_by parameter of /customers/search. Under certain MySQL configurations, the flaw can escalate to remote code execution by writing a PHP webshell using INTO OUTFILE. Public exploit code exists, though no active exploitation has been reported to CISA KEV.

Information disclosure through SQL injection in Ninja Forms for WordPress versions 3.14.9 and earlier enables authenticated administrators to extract sensitive database data. The vulnerability originates from unsanitized keys in the 'settings' object when importing form files, allowing SQL payload injection via two distinct sinks. No active exploitation is confirmed, and EPSS indicates low exploitation probability.

SQL injection in CodeAstro Online Classroom 1.0 exposes the admin login endpoint `/OnlineClassroom/loginlinkadmin.php` to unauthenticated remote attackers who can manipulate the `aid` parameter to alter backend SQL queries. The practical impact extends beyond the CVSS 4.0 score of 5.5 because the vulnerable file is the admin authentication gateway, meaning successful exploitation can bypass login controls entirely and expose or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no public exploit identified at time of analysis as a KEV-confirmed active exploitation campaign, though the barrier to exploitation is now minimal.