SQL Injection

Authenticated SQL injection in the calendar module of Omnispace Agora Project before 26.10.0 lets a low-privileged user read arbitrary data from the backend database by tampering with the sortEvents parameter, which is concatenated unsanitized into an ORDER BY clause in app/ModCalendar/CtrlCalendar.php. Exploitation requires a valid session with access to the calendar feature (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so anonymous internet-wide attacks are not possible; the impact is confidentiality-only, with error-based payloads such as extractvalue() used to leak database version information. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in release 26.10.0.

Authenticated space administrators in Omnispace Agora Project releases before 26.10.0 can escalate to full general-administrator privileges by abusing the user-import flow, where caller-controlled agoraFields[] names are used directly as SQL column identifiers without validation. An attacker who already holds space-administrator rights can inject privileged column names such as generalAdmin, or use backtick-injection to escape the identifier context, and thereby set administrative flags on records processed by the import. The issue is tracked as CWE-89 and rated 8.7 under CVSS 4.0 (CVSS:3.1 equivalent AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H in our independent assessment); no public exploit code has been identified at time of analysis, and the flaw is fixed in Agora Project 26.10.0, making this a credible but not emergency-tier priority.

Second-order SQL injection in Omnispace Agora Project before 26.10.0 lets an authenticated user store a malicious _idCategoryFilter value in their own server-side session, which is later concatenated without parameterization into SQL in app/Common/MdlCategory.php, granting high-impact read and write access to the underlying database. Exploitation requires a valid authenticated session (CVSS 4.0 base 8.6; assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so unauthenticated outsiders cannot reach the sink and risk concentrates in deployments that issue accounts to numerous or low-trust users; no public exploit identified at time of analysis. The vendor has released 26.10.0, which removes the vulnerable condition.

Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.

SQL injection in Adobe Experience Manager 6.5 (through 6.5.25) allows an authenticated, low-privileged attacker to bypass security controls and gain unauthorized read and limited write access to backend data. The flaw is due to improper neutralization of special elements used in SQL commands (CWE-89), and exploitation requires no user interaction. No public exploit code or active exploitation has been identified, and the need for valid low-privilege credentials and the limited version range make this a moderate-priority issue rather than an emergency.

SQL injection in Microsoft Configuration Manager (MECM) lets an authenticated attacker with low-privilege network access execute arbitrary SQL against the site database and thereby elevate privileges, with high confidentiality, integrity, and availability impact (CVSS 8.8). The CVSS vector (AV:N/AC:L/PR:L/UI:N) means exploitation requires a pre-existing valid account on the network - fully unauthenticated attackers cannot reach the flaw - but no user interaction or special complexity is needed once such credentials or an authenticated session exist. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no active exploitation, while vendor patches for all affected builds are available.

SQL injection in Microsoft SharePoint Server Subscription Edition lets an authenticated, low-privilege user send crafted input that is incorporated into a SQL command, giving the attacker arbitrary control over the back-end database and effectively elevating their privileges on the farm. Only SharePoint Server Subscription Edition builds below 16.0.20326.20190 are affected, the attack requires a valid account on the target instance (CVSS PR:L) and no user interaction, so anonymous internet exploitation is not possible; environments already at or above the patched build are not exposed. Microsoft has shipped a fix and no public exploit code has been identified at time of analysis, with CISA SSVC recording Exploitation as none and Automatable as no, making this a credible but not emergency-tier priority that should be fixed on a normal patch cycle - the high CVSS score of 8.8 reflects total loss of confidentiality, integrity and availability once the injection is successfully driven.

SQL injection in Microsoft Configuration Manager allows an authenticated low-privilege user who already holds a foothold on an adjacent network segment to inject arbitrary SQL against the site's data tier and elevate privileges, with the changed-scope vector (S:C) indicating impact can cross from the Configuration Manager component into the SQL Server and host it relies on. Exploitation is constrained rather than trivial: the assessed vector requires prior authorization (PR:L), adjacency instead of internet reachability (AV:A), and a high-complexity path (AC:H) with non-trivial timing, state, or configuration preconditions, and CISA's SSVC assessment records Exploitation 'none' and Automatable 'no'. Microsoft has released a fix and no public exploit code was identified at time of analysis, so the 'total' technical impact describes the damage available if the prerequisites are met, not an easily reached or actively exploited condition.

SQL injection in Fortinet FortiAnalyzer and FortiManager (including Cloud variants) allows an authenticated attacker to execute arbitrary commands on the underlying system via crafted requests. Affected versions include FortiAnalyzer 7.6.0-7.6.4, 7.4.0-7.4.7, and all 7.2 releases, plus FortiManager 7.6.0-7.6.4, 7.4.0-7.4.6, and all 7.2 releases, as well as FortiAnalyzer Cloud 7.6.2-7.6.4, 7.4.1-7.4.7, 7.2.1-7.2.11 and FortiManager Cloud 7.6.2-7.6.4. The vulnerability requires valid credentials; the provided CVSS vector indicates high privileges (PR:H) while the description and independent assessment suggest low privileges (PR:L) may suffice. No public exploit code or active exploitation is identified at time of analysis, and the risk is considered elevated but not an emergency based on current signals.

Authenticated SQL injection in the Fortinet FortiAnalyzer and FortiManager management platforms allows a logged-in low-privileged user to execute arbitrary commands on the appliance via crafted requests. Affected firmware covers FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7 and all 7.2 releases, plus FortiManager 7.6.0 through 7.6.4, 7.4.0 through 7.4.6 and all 7.2 releases. Exploitation requires a valid account on the management interface - the vendor CVSS vector marks PR:H while the description and independent assessment indicate a low-privileged user suffices - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so the main risk mitigation is limiting who can reach and authenticate to the management plane.

Authenticated SQL injection in Frappe Framework before 16.23.0 lets a user with report access alter the raw SQL statement executed by the reportview get_count() method, potentially reading or modifying data the account should not reach. The flaw is reachable through the report/list view API by supplying crafted report input (fields/filters) that was interpolated into a 'select count(*) from ( ... )' query via frappe.db.sql(); the fix rewrites the count using the query builder's Count function with parameterized execution. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but exploitation requires only a valid account with report access (CVSS PR:L, AV:N), and default deployments older than 16.23.0 are exposed.

SQL injection in Payload CMS allows an authenticated attacker holding read plus create-or-update access on a collection to inject arbitrary SQL through the "in" and "not_in" query parameters when the application uses the SQLite, D1-SQLite, Postgres, or Vercel-Postgres database adapters. The flaw is only reachable when a readable collection exposes a "json" field or a "blocks" field configured with blocksAsJSON: true, and can lead to high confidentiality and integrity impact on the backing database. Affected users should upgrade to Payload 3.90.0 (SQLite/D1 adapters and core) or 3.73.0 (Postgres/Vercel-Postgres adapters), or 4.0.0-canary.34; no public exploit identified at time of analysis.

SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows an authenticated user who can create or edit device group or facility names to execute arbitrary SQL commands against the underlying database, with the injected payload only firing when those stored names are subsequently processed by the Bulk Export workflow. Attackers must hold valid credentials with name-editing privileges, and the assessed vectors (CVSS 4.0 base 7.7 with AC:H/PR:L; independent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicate additional non-default preconditions must be satisfied before the payload executes. No public exploit code has been identified at time of analysis, and this is a credentialed, moderate-priority vulnerability rather than a mass-exploitation emergency, with realistic exposure largely limited to insiders or attackers who have already compromised an operator account on an unpatched installation.

SQL injection in RUGGEDCOM CROSSBOW versions below V6.0 lets an attacker who already holds administrative credentials inject arbitrary SQL commands through the Name and Value fields of custom file labels, compromising the underlying database. The vendor-assessed vector (CVSS 4.0 8.4, PR:H, AV:L) and our independent assessment converge on a high-severity but access-gated issue: exploitation requires an authenticated administrative session and local access, with no user interaction, and no public exploit code identified at time of analysis. Siemens has released a fix in V6.0, so the practical priority is moderate and centered on insider or compromised-admin scenarios rather than external mass exploitation.

SQL injection in the firmware-upload filename handling of Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) lets an authenticated attacker who holds firmware-upload privileges run arbitrary SQL commands against the product's underlying database, giving high confidentiality, integrity, and availability impact to the CROSSBOW server itself (CVSS 4.0 base 8.7; assessed CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not pre-authentication: valid credentials with the specific firmware-upload right are mandatory, and the injected payload must be placed in the uploaded file's name rather than its contents, while no second-party user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis (no CISA KEV listing), and because CROSSBOW is a specialized OT access-management server normally deployed on segmented management networks, this is a credible but not top-tier priority.

SQL injection in the Value field of notification conditions handled by the Notification Profile configuration in RUGGEDCOM CROSSBOW (all versions before V6.0) allows an authenticated, suitably privileged user to execute arbitrary SQL commands against the product's underlying database. The flaw is network-reachable with no user interaction required, but it is gated by the privilege prerequisite - only accounts that can reach the Notification Profile configuration workflow can trigger it - so unauthenticated outsiders cannot exploit it directly; there is no public exploit identified at time of analysis. Siemens has published advisory SSA-508506 and V6.0 is the fixed release; given the high confidentiality, integrity, and availability impact on the CROSSBOW database and its OT-context role, this is a credible, actionable patch priority rather than an inflated alert.

Authenticated SQL injection in Siemens RUGGEDCOM CROSSBOW (all versions prior to V6.0) allows a user with the specific privileges needed to use the Bulk Import/Export workflow to execute arbitrary SQL commands against the underlying database via unsanitized facility name fields. The vulnerability is network-reachable, low-complexity, and requires no user interaction, but it is access-gated: a valid privileged account is mandatory, so an attacker lacking that workflow privilege cannot reach the vulnerable code. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an advisory (SSA-508506) addressing the issue.

Blind SQL injection in the Link Whisper Free WordPress plugin (versions through 0.9.7) allows an attacker who already holds a high-privilege, authenticated WordPress session to inject SQL through an unneutralized plugin input, reading database contents back through boolean- or time-based inference. Exploitation requires the plugin to be installed and active plus high-privilege access (PR:H in the CVSS vector), so anonymous visitors cannot reach it; the assessed impact is high confidentiality loss with limited integrity effect, making this a moderate-priority issue rather than an urgent one. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed as actively exploited (no CISA KEV listing).

Blind SQL injection in the PluginUs.Net WOLF bulk-editor WordPress plugin, affecting all versions through 1.1.1, allows an attacker who already holds high-privilege authenticated access to the WordPress site to inject arbitrary SQL through the plugin's bulk-editing input and infer database contents indirectly. Because the injection is blind, extraction is slower and no victim user interaction is required; the practical exposure is limited by the PR:H prerequisite, meaning an administrator-level account or an account with access to the WOLF bulk-editor interface is required before exploitation is possible. No public exploit code was identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, and the overall priority is moderate rather than emergency.

SQL injection in SAP Commerce Cloud lets an authenticated user with only low-level privileges (CVSS 8.8, AV:N/AC:L/PR:L/UI:N) inject arbitrary SQL through specially crafted requests into the affected out-of-the-box functionality, with the potential to read, modify or delete sensitive application database data and therefore high confidentiality, integrity and availability impact. The flaw is CWE-89 in code delivered as part of SAP Commerce Cloud itself, meaning it is not confined to a customer's custom extensions, but the advisory does not name the exact endpoint or parameter, so the precise injectable surface is not confirmed from available data. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only real precondition is obtaining a valid authenticated session, which is a low barrier for deployments that allow customer self-registration or maintain numerous back-office accounts. This is a genuine high-priority vulnerability, though not an emergency.

SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.

SQL injection in Frappe ERPNext (15.x before 15.113.0 and 16.x before 16.22.0) allows attackers with a valid ERPNext account to inject crafted parameters into database queries and read sensitive records from the underlying database. Exploitation requires an authenticated session over the network and no user interaction; the flaw yields high confidentiality impact with no integrity or availability impact. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the primary risk driver is the availability of low-privilege accounts - risk rises sharply where self-service or open registration is enabled or where the instance is internet-exposed.

SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.

SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 allows an authenticated attacker holding at least low-level application credentials to inject SQL into database queries through specific endpoints that fail to validate input, resulting in extraction of sensitive data from the underlying database. The vulnerability is confidentiality-only (CVSS:4.0 7.1 / assessed CVSS:3.1 7.1, C:H with I:N and A:N) - there is no integrity or availability impact, and exploitation is not possible anonymously, so broad internet scanning is ruled out. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is highest for internet-exposed instances that provision self-service or broadly distributed low-privilege accounts.

Authenticated SQL injection in Frappe ERPNext (before 15.106.0 and 16.x before 16.16.0) allows a low-privilege logged-in user to inject crafted input into several endpoints that build database queries without adequate validation, exposing sensitive data stored in the ERPNext database. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, vendor score 7.1) confirms high confidentiality impact with no inherent integrity or availability effect, and authentication is mandatory, so risk is concentrated where low-privilege accounts are widely issued, self-registration is enabled, or instances are internet-facing. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the breadth of affected endpoints and the presence of a public GitHub security advisory make the issue operationally relevant for exposed, multi-tenant deployments.

SQL injection in Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 lets an authenticated low-privileged attacker read sensitive database information through specific endpoints that fail to validate input. Exploitation requires a valid low-privileged ERPNext session and network reachability to the affected instance; no user interaction or elevated privileges are needed, and patched 15.106.0/16.16.0 versions are not affected. There is no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.

SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.

SQL injection in Frappe ERPNext allows authenticated attackers to read sensitive data from the underlying database by sending specially crafted requests to endpoints that fail to validate user-supplied input. The flaw affects ERPNext releases before 15.110.0 and 16.x versions before 16.21.0, and exploitation requires a valid low-privilege session (CVSS PR:L), so it cannot be triggered by an unauthenticated remote attacker. No public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation; the assessed risk is moderate-priority given the authentication barrier and the read-only confidentiality impact (C:H/I:N/A:N).

SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.

Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.

SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.

SQL injection in Frappe ERPNext 15.x before 15.121.0 and 16.x before 16.34.0 lets any authenticated user, including an account with no assigned roles, inject crafted parameters into several endpoints that lack input validation, read other users' sensitive information, and escalate to a privileged account. Because only the lowest privilege level is needed (CVSS 4.0 PR:L; independently assessed at 8.7 under a 3.1 vector of AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact), deployments that permit self-registration or hand out broad low-privilege accounts face a nearly trivial authentication barrier, while tightly controlled instances still require a valid login. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory is public, so unpatched, internet-reachable instances should be treated as high priority.

Unauthenticated SQL injection in phpMyFAQ versions prior to 4.1.9 lets remote attackers read credentials and configuration secrets, modify or delete records, or drop tables via the search parameter of the api/autocomplete endpoint. Exploitation is conditional: the backend MySQL or MariaDB instance must be running in NO_BACKSLASH_ESCAPES mode, because PdoMysql::escape() relies on backslash escaping of single quotes that that SQL mode treats literally; the payload additionally uses a Unicode right single quotation mark (U+2019) that the application normalizes to an ASCII quote after escaping has already been applied, bypassing the filter. This is a genuine high-priority issue (CVSS 4.0 base 9.2, AT:P/AC:H reflecting the non-default SQL-mode prerequisite) rather than a high-CVSS artifact, since an attacker who reaches such a deployment needs no authentication and no user interaction; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor is whether the target database uses the default SQL mode.

SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).

An HQL injection in LogicalDOC Community Edition through 9.3 lets any authenticated user who holds read permission on a single folder escape that folder's scope and read document metadata and database contents they are not entitled to see. The flaw is reachable through the documents.xml data endpoint (DocumentsDataServlet), where the 'indexed' request parameter is concatenated unvalidated into a Hibernate query, so the primary barrier is only the requirement for a low-privileged, read-only account; impact is limited to confidentiality with no modification or denial of service. There is no vendor patch version confirmed in the available data beyond the upstream fix commit, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though an advisory and public discussion exist.

SQL injection in LogicalDOC Community Edition through 9.3 allows authenticated low-privileged users to execute crafted SQL via the firstLetter parameter of TagsDataServlet, enabling UNION SELECT statements to be returned in the XML tag list and disclosing usernames, email addresses, and password hashes from the ld_user table. This is a credible but bounded risk: the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirm that an authenticated session is required, with no integrity or availability impact; no public exploit identified at time of analysis. The upstream fix commit (8428bfb) parameterizes the vulnerable LIKE clause, but a tagged patched release is not independently confirmed.

SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.

SQL injection in Kong Gateway (Enterprise and Open Source) Hybrid Mode clustering logic allows an attacker who can reach the Control Plane's clustering port and present a valid mTLS client certificate and key to inject arbitrary SQL into the Control Plane's backing database, resulting in unauthorized read and write access to gateway configuration and related data. Successful exploitation yields high confidentiality, integrity, and availability impact on the Control Plane database (CVSS 4.0 base 7.5 / assessed CVSS 3.1 8.8), but the prerequisites are substantial: the deployment must be running the Control Plane/Data Plane split, the attacker must have adjacent network access to the normally internal clustering channel, and must hold legitimate clustering credentials, which effectively limits realistic abuse to compromised Data Plane nodes or insiders with stolen cluster keys. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.

A crafted license plate value submitted through the bulk license plate search feature of Flock's Night Shift hosted service can be used to inject SQL, allowing an authenticated user of one customer organization to read license plate recognition records and other data belonging to other customer tenants; data modification was not possible. Exploitation requires a valid tenant account on the hosted platform (PR:L per the assessed vector), so this is not an unauthenticated attack. Flock discovered the flaw through internal security review, remediated it server-side on 2026-08-12, and states no customer action is required; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and because the fix was applied to the hosted platform the issue is no longer exploitable. The vendor-assigned CVSS 4.0 score is 7.1, while the independent assessment rates it CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact confined to cross-tenant read access.

Unauthenticated SQL injection in the WordPress plugin Post Voting System 1.0 and earlier allows remote attackers to inject arbitrary SQL through a request parameter that is passed into a database query without sanitization or escaping, exposing the contents of the site's WordPress database. Every installation with the plugin active is potentially reachable, because exploitation requires no authentication, no user interaction, and no non-default configuration - publicly available exploit code exists, and WPScan has published the vulnerability, so mass scanning is plausible. The practical risk is bounded by deployment: the plugin is niche, and the impact is confined to confidentiality (database read), since the assessed vector is S:U with C:H and no integrity or availability effect; no fixed version is confirmed at the time of analysis, so removal or virtual patching is the current mitigation.

Unauthenticated SQL injection in the WP Verify API WordPress plugin through version 1.0.0 lets remote attackers supply malicious input to a parameter used directly in a SQL query, allowing extraction of database contents. Publicly available exploit code exists, while no EPSS score or CISA KEV entry was provided; the input CVSS is 8.6 (network, low complexity, no privileges or user interaction), and the independent assessment keeps scope unchanged and rates confidentiality impact high with no integrity or availability impact. The practical prerequisite is that a target WordPress site has this specific plugin installed and the vulnerable endpoint reachable.

Unauthenticated SQL injection in the Loja Automática WordPress plugin (versions through 1.0.0) allows remote attackers to read data from a site's backend database by supplying crafted input to a parameter that is not sanitized or escaped before being placed in a SQL query, resulting in a high confidentiality impact per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 8.6 as published). No authentication, privileges, or user interaction are required, and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; realistic exposure is limited almost entirely by how rarely this obscure plugin is installed and active. WPScan reported the issue, which is tracked as EUVD-2026-96788.

Unauthenticated SQL injection in the ASPL Product Quotation WordPress plugin through version 1.1.0 allows remote attackers to read arbitrary data from the site's database without credentials or user interaction. Publicly available exploit code exists (reported via the WPScan vulnerability entry), but the flaw is not flagged as confirmed actively exploited (CISA KEV). Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6), impact is confidentiality-only - injected queries can disclose data but do not modify it or affect site availability.

Unauthenticated SQL injection in the Datalist it WordPress plugin through version 0.0.3 allows anonymous attackers to execute arbitrary database queries and read sensitive data from the underlying WordPress database. Publicly available exploit code exists, and the provided CVSS score is high, though the independent assessment scopes confirmed impact to unauthorized database reads under unchanged scope; real-world exposure is likely limited by the plugin's apparent small install base and requires only that the plugin be active and reachable on a WordPress site.

Unauthenticated SQL injection in the WP-Partner WordPress plugin (all versions through 1.2.1) allows remote attackers to append arbitrary SQL to an existing query and exfiltrate data from the underlying WordPress database, including user credentials, hashes, and other sensitive site content. The flaw carries a CVSS v3.1 base score of 8.6 (the independent assessment re-scores it as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, i.e. high confidentiality impact with no direct integrity or availability effect), requires no authentication or user interaction, and publicly available exploit code exists - though there is no confirmation of active exploitation (no CISA KEV listing). Risk is concentrated on sites that actually run this specific, low-footprint plugin; any such site exposing the vulnerable endpoint over HTTP(S) is directly exploitable with default configuration.

Unauthenticated SQL injection in the Recordbrowser WordPress plugin (all versions through 1.1.7) allows remote attackers to append arbitrary SQL to plugin-issued database queries and read sensitive data from the underlying WordPress database. The vulnerable endpoint requires no authentication, no privileges and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any reachable site with the plugin installed and active is exposed; publicly available exploit code exists, and the flaw is not currently listed in CISA KEV, so confirmed active exploitation has not been established. The practical risk is limited mainly by deployment footprint - the plugin must be present and its vulnerable parameter reachable - but for sites that do run it, this is a genuine priority.

Unauthenticated SQL injection in the WpCues Basic Quiz WordPress plugin through version 1.6.5 allows remote attackers to read arbitrary data from the site's database. Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is reported. The independent assessment rates confidentiality impact as High with no integrity or availability impact and scope unchanged, so the practical risk is data disclosure for sites running the vulnerable plugin.

Unauthenticated SQL injection in the Llavero.io WordPress plugin (versions through 0.1.4) allows remote attackers to inject arbitrary SQL through an unsanitized parameter and read data from the site's WordPress database. Exploitation requires no authentication and no user interaction (CVSS PR:N/UI:N), and publicly available exploit code exists via the WPScan disclosure, though CISA KEV does not list this as confirmed actively exploited. Based on the independent assessment, impact is confined to confidentiality (read-only data disclosure, C:H/I:N/A:N), and the practical exposure is limited by the plugin's niche, early-version footprint.

Unauthenticated SQL injection in the Site Setup Wizard WordPress plugin through 1.5.8 allows any remote attacker who can reach a site running the plugin to inject arbitrary SQL through an improperly sanitised parameter and read data from the site's database, including potentially password hashes, user records and stored configuration secrets. Exploitation requires no authentication, no user interaction and no special configuration - only that the plugin be installed and active at version 1.5.8 or earlier - and publicly available exploit code exists. The flaw is read-only in effect (Confidentiality High, Integrity None, Availability None per our assessed vector), so it does not by itself permit data modification or full site takeover, and there is no indication of confirmed active exploitation (CISA KEV).

Unauthenticated SQL injection in the Social Web Suite WordPress plugin through 4.1.12 lets remote attackers read arbitrary data from the site's database, because the plugin accepts requests supposedly authorized by its shared secret before ever requiring that secret to be configured, and then passes an unsanitized parameter directly into an SQL statement. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, privileges, or user interaction are needed: any internet-facing WordPress installation running a vulnerable version in the unconfigured state is directly exploitable. Publicly available exploit code exists, and while the primary limiting factor is the deployment footprint of this specific plugin (and the unset-secret prerequisite), the high confidentiality impact makes this a credible, actionable priority rather than a theoretical high-CVSS issue.

Unauthenticated SQL injection in the Tcard WP WordPress plugin (all versions through 1.8.0) allows remote attackers to inject arbitrary SQL through one of the plugin's AJAX actions, exposing data from the underlying WordPress database. Exploitation requires no authentication, no user interaction, and no non-default configuration - only that the plugin be installed and active - and publicly available exploit code exists, though there is no confirmed actively exploited (CISA KEV) signal. The assessed impact is read-oriented (high confidentiality, no integrity or availability impact), so the practical risk is sensitive-data disclosure rather than site takeover, with real-world exposure bounded by how widely this low-footprint plugin is deployed.

Unauthenticated SQL injection in the Mobile builder WordPress plugin (all versions through 1.4.2) lets any remote attacker inject arbitrary SQL into the site's backend database and read data the application can access. The assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication, no user interaction and no special configuration are required, with the sole precondition being that this non-default plugin is installed and active, and impact is confined to confidentiality. Publicly available exploit code exists (published via the WPScan vulnerability entry), and while this is not confirmed actively exploited (CISA KEV), the unauthenticated reachability and low skill barrier make it a genuine priority for any site running the plugin.

SQL injection in the WordPress plugin Barcode Scanner with Inventory & Order Manager (versions up to and including 1.13.1) lets an attacker who holds a Subscriber-level account inject arbitrary SQL through plugin input, as reported by Patchstack via CVE-2026-62117. The vulnerability is network-reachable, low-complexity and needs no user interaction, and because Subscriber is the lowest standard WordPress role, any site that allows open self-registration effectively exposes the flaw to any visitor who signs up. Patchstack scores it 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), while our independent assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N (base 7.1), reflecting high confidentiality impact and limited integrity impact without a scope change; no public exploit code or confirmed active exploitation was identified at time of analysis.

Unauthenticated SQL injection in StyleMix's uListing WordPress plugin, affecting versions up to and including 2.2.0, allows remote attackers to inject arbitrary SQL into the site's backend database queries via an insufficiently sanitized plugin input. The assessed vector (AV:N/AC:L/PR:N/UI:N) means any network-reachable WordPress installation with the plugin active is exposed without credentials or user interaction, with confidentiality impact rated high and limited integrity impact; availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact vulnerable parameter, request endpoint, and any required non-default configuration remain unconfirmed by the available Patchstack advisory, so the practical attack surface should be verified against the plugin source or vendor documentation.

SQL injection in WP Ultimate CSV Importer 9.2 and earlier allows an authenticated WordPress Administrator to inject arbitrary SQL through the plugin's import functionality, potentially exposing sensitive database contents. The CVSS 3.1 score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), requiring a high-privileged admin session with no user interaction; no public exploit identified at time of analysis. Real-world risk is limited to malicious administrators, compromised admin credentials, or attackers who first obtain an admin account, making this a high-CVSS but comparatively low-real-risk issue once the privilege requirement is factored in.

SQL injection in the Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.13) lets an authenticated administrator inject arbitrary SQL through plugin input fields handled without proper sanitization, scored 7.6 under the vendor-published vector. The realistic risk is contained rather than broad: exploitation requires a valid administrator account on the target site (CVSS PR:H), so the practical threat surface is insiders, compromised admin credentials, or deployments that hand admin-level access to lower-trust users, and it is reachable over the network without any victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor remains the administrator privilege prerequisite rather than any technical barrier.

SQL injection in the Leyka WordPress donation plugin (versions 3.32.3 and earlier) allows an authenticated administrator to inject arbitrary SQL through the plugin's admin-facing functionality, potentially exposing sensitive data stored in the underlying WordPress database. Exploitation requires a logged-in account with administrator-level capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N), so the practical risk is confined to insider abuse, compromised or shared admin credentials, or sites that hand admin roles to semi-trusted parties; there is no user-interaction requirement and the attack is delivered over the network. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a high-severity but operationally limited issue whose severity (7.6) is driven mainly by the confidentiality impact on database contents.

SQL injection in the Qode Tours WordPress plugin (all versions up to and including 3.1.3.2) allows a low-privileged authenticated user holding only the Subscriber role to inject arbitrary SQL through plugin-supplied input, exposing sensitive records such as WordPress user credentials and site configuration. Exploitation is remote, low-complexity and needs no user interaction, but it does require a valid account, so sites that allow open self-service registration effectively hand attackers the prerequisite while sites with registration disabled sharply reduce exposure. A published CVSS base of 8.5 reflects a scope-changed vector with confidentiality and availability impact, whereas independent assessment scores the same flaw more conservatively with unchanged scope and confidentiality-only impact; no public exploit code is identified at time of analysis and the issue is not listed in CISA KEV, though the low privilege bar makes it attractive for automated mass scanning.

Authenticated SQL injection in the WordPress plugin Events Manager, affecting versions through 7.4.6, allows a Subscriber-level user - the lowest registered role on a WordPress site - to inject arbitrary SQL into plugin queries, yielding an assessed CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) with high confidentiality impact, low availability impact, and no integrity impact. No end-user interaction is required and the flaw is network-reachable, but the PR:L prerequisite means an outside attacker must first obtain a Subscriber account, which in practice depends on the target site permitting open user self-registration; sites that disable registration substantially raise the barrier to exploitation. No public exploit identified at time of analysis, and the issue was reported through Patchstack - the combination of scope-changed database read impact and a low-privilege foothold makes this a credible, actionable priority rather than an inflated high-CVSS score.

SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.

Blind SQL injection in the Tickera WordPress event ticketing plugin, affecting versions through 3.6.0.6, lets a remote attacker inject crafted input into a plugin SQL query and exfiltrate database contents one inference at a time. The vulnerability is scored by its reporter at CVSS 9.3 (network reachable, low complexity, scope-changing, high confidentiality impact), while our own assessment is more conservative - CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N - because the specific vulnerable endpoint or parameter is not named and Patchstack-documented plugin SQLi issues frequently require a logged-in role. The supplied vector states PR:N (unauthenticated) but the alternative assessment assumes PR:L, so authentication requirements are not confirmed from the available data; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because exploitation is blind and inference-based, extraction is slower than a direct-query injection, though AC:L means it remains automatable once a working payload path is found.

Unauthenticated SQL injection in the LatePoint WordPress plugin (versions up to and including 5.7.2) allows remote attackers to append arbitrary SQL queries via the 'booking[service_id]' parameter, enabling extraction of sensitive data from the database. The vulnerability is easily exploitable (CVSS 7.5) with no authentication or user interaction required, and affects the plugin's core booking functionality. No public exploit code or active exploitation has been identified at time of analysis, but the flaw poses a significant risk due to its low complexity and high confidentiality impact.

Unauthenticated SQL injection in the LTL Freight Quotes WordPress plugin (versions 4.2.11 up to but not including 4.2.19) lets remote attackers inject arbitrary SQL through an unsanitised request parameter, giving high-impact read access to the underlying WordPress database - including user credential hashes and any customer or quote data the site stores. Exploitation requires no authentication, no user interaction, and no special configuration beyond an active, network-reachable vulnerable install, and a vendor patch is available in 4.2.19. No public exploit code has been identified at time of analysis, and the practical risk is tempered by the narrow installed base of this specialised less-than-truckload freight-quoting plugin, though sites that have not yet updated remain fully exposed.

SQL injection in JetBrains Exposed before 1.5.1 enables unauthenticated remote attackers to execute arbitrary SQL against downstream applications that pass attacker-controllable, unescaped string arguments into several affected SQL functions. The library itself is not directly exploitable; exploitation requires a hosting application to route untrusted input into the vulnerable function calls, so applications that only pass literals or use parameterized/escaped paths are unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case nominal impact of full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.

SQL injection in the WordPress plugin wp-post-author (versions 4.0.0 up to but not including 4.1.0) lets an authenticated, low-privilege user inject arbitrary SQL into plugin queries and read sensitive data from the site's underlying database. Exploitation is network-reachable, requires no user interaction, and is rated CVSS 7.1 (High) with high confidentiality impact but no integrity or availability impact, consistent with read-oriented database exfiltration rather than data tampering or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the primary barrier is the requirement for valid low-privilege credentials on the target WordPress site.

Unauthenticated SQL injection in the PHPNuxBill radius.php FreeRADIUS REST endpoint allows remote attackers to read arbitrary data from the application database - including customer records and stored credentials - by injecting crafted username, macAddr, or nasid parameters into the accounting or authenticate actions, which are interpolated directly into whereRaw() queries. All versions through 2025.3.20 are affected per the vendor advisory and CPE data (cpe:2.3:a:hotspotbilling:phpnuxbill:*:*), and exploitation requires only network reachability of radius.php, with no authentication and no user interaction. The supplier-scored CVSS 4.0 vector (9.3) asserts high confidentiality, integrity, and availability impact, whereas our independent assessment scopes the realistic impact to confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, so the decisive risk factor is whether radius.php is exposed beyond the trusted RADIUS/NAS segment.

Authenticated SQL injection in HortusFox (hortusfox-web) before 6.2 lets any holder of a valid API token read arbitrary database tables, including user password hashes, by supplying a crafted include_info value to the /api/locations/list endpoint. The flaw is in PlantsModel::getSpecificInfo(), which concatenates the caller-supplied include_info string directly into the SQL column list instead of validating column names. Exploitation is limited by the API-token prerequisite (CVSS PR:L, assessed CVSS:3.1 7.1, high confidentiality impact with no integrity or availability impact), the vendor has published a fix commit adding column-name validation, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.

Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. At time of analysis there is no CISA KEV entry and no public exploit code identified at time of analysis, and the unauthenticated classification is Patchstack-reported and unverified: if the real prerequisite turns out to be subscriber- or author-level access, authentication would become the primary limiting factor.

Blind SQL injection in the Metagauss ProfileGrid WordPress plugin (all versions through 6.0.0.2) lets an authenticated low-privilege user, such as a self-registered member of a community site, inject arbitrary SQL into a vulnerable plugin query and infer database contents through response timing or boolean differences. The issue is network-reachable, low complexity, and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, reported base score 8.5), with the practical barrier lowered because ProfileGrid is a user-profile/community plugin that frequently permits open self-registration; the independent assessment rates confidentiality impact as High, integrity Low, availability None. No public exploit code and no confirmed active exploitation were identified at time of analysis. The specific vulnerable endpoint and parameter are not named in the available data, so defenders cannot pin the trigger to a specific setting.

Unauthenticated blind SQL injection in the WordPress plugin EduAdmin Booking (MultiNet Interactive AB) before version 6.0.0 allows remote attackers to inject SQL through the plugin's request handling and extract data from the underlying WordPress database, including booking records, customer details, and potentially user credential hashes. The supplier-rated CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), while our reassessment is more conservative at AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, because blind SQL injection normally produces confidentiality-only impact without the claimed scope change; under either vector the flaw is network-reachable and, per the supplied vector, requires no authentication or user interaction, although the exact vulnerable parameter or endpoint is not identified in the available data. Risk is real but bounded: exploitation requires an active installation of this specific plugin, and no public exploit identified at time of analysis, with no CISA KEV listing and no public PoC in the supplied intelligence.

Blind SQL injection in the wpdreams Ajax Search Pro WordPress plugin, affecting all versions through 4.29.1, lets unauthenticated remote attackers inject crafted input into the plugin's public-facing search/AJAX query path and infer database contents one bit at a time. Because the vector is PR:N/UI:N, no credentials or victim interaction are needed, making any internet-exposed WordPress site running the vulnerable plugin a candidate target. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); exploitation demands many iterative automated requests rather than a single direct query, but a successful attack can yield sensitive data such as user password hashes, secret keys, and PII.

Unauthenticated blind SQL injection in tagDiv Opt-In Builder (td-subscription) versions through 1.7.6 allows remote attackers to extract sensitive data from the underlying WordPress database via crafted input to the plugin's subscription/opt-in functionality. The vendor-reported CVSS 3.1 score is 9.3 (S:C), but an independent assessment revises the scope to unchanged (S:U) and confirms high confidentiality impact without integrity or availability impact. No public exploit identified at time of analysis.

Blind SQL injection in the tagDiv Opt-In Builder WordPress plugin (slug td-subscription) through version 1.7.6 allows remote authenticated attackers with low privileges to extract sensitive data from the site's database via inference-based queries. The flaw is a CWE-89 improper neutralization of special elements in SQL commands; exploitation requires a valid low-privilege account (e.g., subscriber or contributor) and no user interaction, making sites with open registration the primary exposure. Assessed severity is high for confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and no public exploit identified at time of analysis.

Unauthenticated blind SQL injection in the JNews - Pay Writer WordPress plugin (versions through 12.0.1) allows remote attackers to extract sensitive data from the site's database by inferring information through boolean or time-based queries. The critical severity (CVSS 9.3) stems from network reachability, low complexity, and high confidentiality impact, but exploitation requires that this specific companion plugin be installed and active-the base JNews theme alone is insufficient. No public exploit code or active exploitation has been identified at time of analysis.

Blind SQL injection in the Taskbuilder WordPress plugin (all versions up to and including 6.0.5) allows an attacker who holds a valid low-privilege account to inject SQL through a plugin endpoint or parameter that fails to neutralize special elements, potentially exposing arbitrary data from the site's WordPress database. The vulnerability requires authentication (CVSS vector PR:L) and the plugin installed and active; the specific vulnerable feature, endpoint, and parameter are not named in the available advisory text, which limits targeted exploitation somewhat. At time of analysis there is no public exploit identified, no indication of confirmed active exploitation (not in CISA KEV), and no exact patched version confirmed, so this is a credible-but-not-urgent remediation priority - sites that allow open registration or host many low-privilege accounts carry the highest relative risk.

Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).

Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.2, letting an attacker who can reach the vulnerable endpoint infer and extract database contents - including WordPress user records and other sensitive tables - through a network-reachable, low-complexity attack (CWE-89, reported CVSS base 9.3). Exploitation status: no public exploit identified at time of analysis, and no CISA KEV listing. Sources disagree on prerequisites - the reported vector carries PR:N/S:C/C:H/I:N/A:L (unauthenticated, changed scope) while our independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (low-privilege authenticated, unchanged scope), so the minimum privilege level required should be verified against the Patchstack advisory before treating the issue as anonymously exploitable.

Blind SQL injection in the UpSolution Core WordPress plugin (us-core) through version 9.3 lets an attacker who already holds a low-privilege authenticated WordPress session inject SQL through a vulnerable parameter and extract database contents by inference (boolean/time-based) rather than by reading query output directly. Our independent assessment is more conservative than the vendor-advisory score of 8.5: with impact confined to confidentiality (C:H/I:N/A:N) and a mandatory PR:L session prerequisite, the effective severity is closer to 6.5, making this a genuine but conditional priority rather than a drop-everything emergency. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

Jivejdon through 5.0 stores account passwords as unsalted MD5 digests - computed by ToolsUtil.hash() and persisted through AccountDaoSql - so an attacker who obtains the user table can recover plaintext credentials offline with precomputed tables or GPU-accelerated cracking. The flaw is not self-contained: it requires a prior database compromise or a separate SQL injection to reach the credential table, which is why the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N (vendor CVSS 4.0 rates it 8.2 with AC:H/AT:P), making this an impact amplifier rather than an initial-access vector. No public exploit code and no confirmed active exploitation of this password-storage weakness were identified at time of analysis, although the advisory carries an associated SQLi tag.

Unauthenticated SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 allows a remote attacker to execute unauthorized SQL statements against the appliance, with the vendor-assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) indicating full compromise of confidentiality, integrity, and availability of the affected component with no privileges or user interaction required. The vulnerable feature or endpoint is not publicly disclosed, so defenders cannot pin down a specific setting to harden, but the practical gating factor is reachability: Guardium is a data-security management appliance that normally sits on an internal or management network segment rather than the public internet. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, but a vendor patch is available and should be treated as high priority because of the 9.8 severity and the sensitivity of the data Guardium manages.

SQL injection in IBM Guardium Data Protection 12.0, 12.1, and 12.2 lets remote unauthenticated attackers who can reach the product's network-facing interfaces inject crafted SQL against the back-end database, potentially viewing, adding, modifying, or deleting its contents (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and EPSS is low at 0.27% (17th percentile), so real-world exploitation appears opportunistic rather than widespread despite the maximum severity rating. Impact is exposure-dependent: internet-reachable or broadly accessible management/collector instances carry the full unauthenticated risk, while deployments confined to isolated management networks are substantially less exposed. The vendor has published remediation through IBM Support.

SQL injection in IBM Guardium Data Protection 12.1 and 12.2.2 allows unauthenticated remote attackers to execute arbitrary SQL commands against the platform's underlying data store, with IBM's own vector (AV:N/AC:L/PR:N/UI:N, C/I/A:H) describing total loss of confidentiality, integrity, and availability for exposed instances. The headline 9.8 CVSS should be tempered by conflicting signals: EPSS is only 0.30% (20th percentile), and CISA's SSVC assessment records exploitation as 'none' with the attack rated non-automatable, with no public exploit code or KEV listing identified at time of analysis. Real-world risk is governed by reachability - exploitation requires network access to a vulnerable Guardium management or collector interface, which is normally confined to restricted internal management networks rather than the internet.

SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.

SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded `SET ?` clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.

SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.

Blind SQL injection in the Appsbd Vitepos / vitepos-lite WordPress plugin, affecting versions through 3.6.1, allows an attacker who already holds a high-privilege account on the WordPress site to inject SQL through an improperly neutralized plugin input and extract database contents one inference at a time. The primary barrier is the authentication prerequisite (CVSS PR:H) - exploitation is remote over the network with low complexity and no user interaction, but anonymous internet attackers are excluded, and the attacker must first compromise or legitimately hold an administrative-level session. Patchstack reported the issue with a CVSS 3.1 score of 7.6; the independent assessment narrows the realized impact to loss of confidentiality (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis.

Unauthenticated blind SQL injection in the NetBoard CRM demo platform lets remote attackers read and modify backend database contents by sending a crafted POST request to the password-recovery endpoint /module/auth/recovery.php, where the 'user-name' parameter is passed unsafely into a SQL query. The flaw carries a maximum-severity CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L), so no credentials, user interaction, or non-default configuration are needed; the practical limiting factor is whether an instance of this specific demo application is reachable from the internet, since it is a demonstration platform rather than a widely deployed production CRM. No public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score was supplied, so active exploitation is not confirmed; exploitation is demonstrated through Boolean, error-based, time-based, and UNION query techniques.

Blind SQL injection in the WordPress WP Data Access plugin through version 5.5.82 could allow a remote attacker to read sensitive database contents; the supplied CVSS vector rates it 9.3 with PR:N, indicating network-reachable unauthenticated exploitation, though the provided advisory data does not independently corroborate the unauthenticated condition and comparable plugin SQLi often requires at least subscriber-level access. This is a genuine high-priority issue by severity signals but with important caveats, and no public exploit identified at time of analysis.

SQL injection in the Homer coordinator's POST /api/v4/statistics/query endpoint allows a remote attacker to execute arbitrary DuckDB SQL against the FlightSQL backend, exposing or altering all stored VoIP call records, SIP messages and metadata. The V4StatisticsQuery handler forwards the caller-supplied rawquery field verbatim to DuckDB without the sqlvalidator.ValidateRawSQL() neutralization applied in sibling handlers, so any authenticated user is sufficient (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1); the vendor notes that on default deployments an empty JWT secret collapses this to pre-authentication reachability. Publicly available exploit code exists (the advisory ships a working curl PoC, and DuckDB INSTALL/LOAD is reachable for extension-based exfiltration); no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Blind SQL injection in the WP Post Author WordPress plugin through version 4.0.0 allows an authenticated high-privilege (administrator-level) attacker to read sensitive data from the underlying WordPress database, with assessed high confidentiality impact, limited integrity impact, and no availability impact. Exploitation requires a high-privilege account (CVSS PR:H) and no victim user interaction, so direct external exploitation against a default install is limited, though risk increases in multi-author or delegated-admin environments or if an admin account is already compromised. Multiple signals point to a moderate, not critical, real-world priority; no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation.