SQL Injection

Unauthenticated SQL injection in the Bookly WordPress plugin permits remote extraction of database content. Attackers leverage a two-step chain—first carrying a malicious staff_ids parameter via a session-seeding AJAX call, then triggering the vulnerable query through a second endpoint—to append time-based blind SQL payloads. No public exploit code is known, but the full attack path is documented by Wordfence.

Unauthenticated SQL injection in the TrueBooker WordPress plugin allows remote attackers to extract sensitive database information. The vulnerability resides in the 'alldata[truebooker_user]' parameter and affects versions up to and including 1.2.2. Although a nonce is used, it is exposed on front-end booking pages, enabling unauthenticated exploitation if the required booking fields are present.

Unauthenticated SQL injection in the WordPress Premium Packages - Sell Digital Products Securely plugin (wpdm-premium-packages) allows any remote attacker to extract sensitive data from the website’s database. The vulnerability exists in the coupon processing REST API endpoint and stems from user input being directly interpolated into a raw SQL query without any sanitization or prepared statements.

Remote unauthenticated SQL injection in the WordPress WP Fast Total Search plugin up to version 1.80.280 allows attackers to extract sensitive database information via the 'form_data[s]' parameter. The flaw requires no authentication or user interaction, making it easily exploitable over the network. No public exploit code or active exploitation has been confirmed at this time.

We need to generate a comprehensive analysis JSON for CVE-2026-17191 based on provided data. Let's gather all fields. CVE ID: CVE-2026-17191 Description: An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. CVSS Score: 8.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-89 (SQL Injection) EPSS: 2.83% (85th percentile) Patch: Available from vendor Reported by: Arista CPE: cpe:2.3:a:arista_networks:velocloud_orchestrator_on-prem:*:*:*:*:*:*:*:* Tags: Authentication Bypass, SQLi, Velocloud Orchestrator On Prem SSVC: Exploitation: none, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49371 Affected versions: "VeloCloud Orchestrator On-Prem 5.2.0 <5.2.3.14", "6.1.0 <6.1.3.4", "6.4.0 <6.4.2.4" References: [cveorg] advisory link: https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145; [euvd] advisory link: nvd.nist.gov. Now, product_name: "Velocloud Orchestrator On-Prem" (or "VeloCloud Orchestrator On-Prem"). Could be "Arista VeloCloud Orchestrator" but tags say "Velocloud Orchestrator On Prem". I'll pick "VeloCloud Orchestrator On-Prem" (official name). product_name should be 1-3 words: "VeloCloud Orchestrator On-Prem" is 3 words? Actually "VeloCloud Orchestrator On-Prem" is 4 words. I'll do "VeloCloud Orchestrator On-Prem" or maybe "VeloCloud Orchestrator". But the description says "an API component of the orchestrator". The CPE specifies "velocloud_orchestrator_on-prem". So product_name: "VeloCloud Orchestrator On-Prem". That's 4, but maybe we can shorten to "VeloCloud Orchestrator" (2 words)

We have the CVE-2026-66427 description: "Administrator SQL Injection in WP Google Review Slider <= 18.4 versions." CVSS 3.1 vector given: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. Score 7.6. CWE: CWE-89 (SQL Injection) Multi-source intelligence: patchstack reported, CPE string: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:* Tags: SQLi, Google, Wp Google Review Slider SSVC: Exploitation: none, Automatable: no, Technical Impact: partial EUVD references: affected versions: WP Google Review Slider n/a ≤18.4. References: patchstack database link, and nvd.nist.gov link (but that is likely not the official NVD because that CVE is 2026, maybe placeholder). The task: Synthesize into JSON fields. product_name: "WP Google Review Slider" (1-3 words, the plugin name). So output: "WP Google Review Slider" summary: 2-3 sentence plain-language. Not copy description. Original synthesis. Start with specific impact verb: "Authenticated SQL injection in WP Google Review Slider plugin up to version 18.4 allows..." But the CVSS vector is PR:H, meaning high privileges (administrator). So authenticated as admin. Impact: CVSS vector says C:H (high confidentiality), I:N (no integrity), A:L (low availability). So it reads data, possibly denial of service partial. Not actively exploited (SSVC exploitation none, no KEV). POC status unknown. EPSS not given. But EPSS score is missing from input, we have no EPSS. So in summary, mention that it's a SQL injection by admin. Not start with "A vulnerability". Example: "Authenticated SQL injection in WP Google Review Slider versions ≤18.4 enables administrators to read database contents, potentially exposing sensitive user data. The vulnerability, reported by Patchstack, does not appear to be actively exploited and requires high privileges, limiting risk to trusted users." technical_context: Explain the technology: WordPress plugin, likely uses SQL queries to store/retrieve review data. CWE-89, insufficient sanitization of user-supplied input

SQL injection in the rtMedia WordPress plugin (versions ≤ 4.7.10) allows authenticated subscriber-level users to extract highly sensitive information from the site's database. The vulnerability, disclosed by Patchstack, has no known active exploitation or public exploit code. With a CVSS score of 8.5, it poses a high data exposure risk for any site using the plugin with open subscriber registration.

Unauthenticated SQL injection in the AWP Classifieds WordPress plugin (≤4.4.7) allows remote attackers to extract sensitive data from the database via crafted HTTP requests, potentially exposing user information and other site data. The vulnerability exists in the plugin's handling of unsanitized input, enabling attackers to perform SQL injection without authentication. No public exploit or active exploitation has been reported at this time.

Unauthenticated SQL injection in rtMedia for WordPress, BuddyPress and bbPress versions ≤4.7.

Unauthenticated SQL injection in the Gamipress WordPress plugin (versions up to 7.9.7) allows remote attackers to execute arbitrary SQL queries against the site's database. This can lead to unauthorized extraction of sensitive data (such as user credentials) and potential denial of service through resource exhaustion. No active exploitation or public proof-of-concept has been reported at the time of analysis.

An authenticated SQL injection flaw in the Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce plugin (≤2.10.22) allows administrators to execute arbitrary SQL queries, potentially exposing sensitive database content. The vulnerability arises from improper input neutralization (CWE-89) and, while requiring high privileges, enables reading of the entire WordPress database due to a scope change. No public exploit or active exploitation has been reported.

SQL injection in the Relevanssi Light WordPress plugin (≤1.2.2) allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, leading to exposure of sensitive information and limited data corruption. The vulnerability carries a critical CVSS score of 9.3 due to low attack complexity and high confidentiality impact. No public exploit or CISA KEV listing was identified at the time of analysis.

Unauthenticated SQL injection in the MapSVG WordPress plugin up to version 8.14.0 allows remote attackers to extract sensitive data from the database without credentials. The vulnerability can be triggered via specially crafted requests and has a critical CVSS score of 9.3. No public exploit code or active exploitation has been reported at the time of analysis.

Unauthenticated SQL injection in the SP Page Builder Joomla extension before version 6.7.1 allows remote attackers to extract sensitive database contents via the loadMoreArticles endpoint. The vulnerability stems from improper validation of the catid parameter, which can be manipulated to execute arbitrary SQL queries. No public exploit or active exploitation has been reported at this time.

SQL injection in the SP Page Builder extension for Joomla versions prior to 6.7.1 allows an authenticated attacker with high privileges to inject arbitrary SQL via the media manager’s search and date filter parameters. Exploitation can lead to unauthorized access to sensitive database contents, including data outside the extension’s scope. No public exploit or active exploitation has been confirmed at this time.

Unauthenticated SQL injection in SP Page Builder for Joomla prior to version 6.7.1 allows remote attackers to extract sensitive data from the Joomla database via crafted order parameters in the Dynamic Content endpoint. The vulnerability, assigned CVE-2026-65766, has a CVSS 4.0 score of 9.2 but is not listed in CISA's KEV and has no known public exploits at time of analysis.

SQL injection in Dede CMS 5.7.118 via the sqlquery parameter of sys_sql_query.php allows unauthenticated remote attackers to extract arbitrary database contents, including sensitive information. A publicly available proof-of-concept exploit exists, although no active exploitation has been confirmed.

Authenticated SQL injection in Likeshop up to 3.0.5 allows admin-level users to extract arbitrary database contents via the adjustAccount endpoint. The vulnerability stems from unsanitized POST parameters (money, integral, growth, earnings) concatenated directly into raw SQL queries. Exploit code is publicly available, though no active exploitation has been reported by CISA.

Unauthenticated SQL injection in the 'Project Management, Bug and Issue Tracking Plugin' for WordPress before version 5.1.0 enables remote attackers to extract or modify database contents via the standard front-end issue tracker. Exploit code is publicly available, and the vulnerability has a high CVSS score of 9.1, though EPSS probability remains low at 0.14%.

SQL injection in the Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications lets an unauthenticated remote attacker send a crafted request that bypasses the login page, exposes other users' credentials, enables full account takeover, and permits dumping of sensitive PII and other database contents. VINE is the notification platform used by U.S. corrections and law enforcement agencies to alert crime victims about offender status, so exposure of its data carries direct victim-safety implications. No public exploit identified at time of analysis, but the flaw is trivially exploitable (network, no authentication, low complexity) with a CVSS 4.0 base score of 9.3.

Unauthenticated SQL injection in the Easy Store extension for Joomla (versions 1.0.0 through 2.0.1) by JoomShaper allows remote attackers to inject arbitrary SQL through improperly validated order parameters, yielding full read access to the backend database including credentials and active session tokens. No public exploit has been identified at time of analysis, but the flaw is trivially reachable over the network without authentication and against default installations. Successful exploitation enables complete disclosure of stored user data and hijacking of authenticated sessions.

Authenticated SQL injection in the Persian Woocommerce SMS WordPress plugin (versions 7.2.2 and earlier) lets a user holding the Shop Manager role inject arbitrary SQL into backend queries, enabling extraction of sensitive database contents such as customer PII, order data, and WordPress credential hashes. Reported by Patchstack and classified CWE-89, the flaw carries a CVSS 7.6 score driven by network reach and high confidentiality impact but gated behind privileged access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

SQL injection in the Visualizer WordPress plugin (versions 4.0.6 and earlier) allows an authenticated user holding only Contributor-level privileges to inject arbitrary SQL into backend database queries, enabling extraction of sensitive data such as user credentials and secrets. Reported by Patchstack and tracked under CWE-89, the flaw carries a CVSS 8.5 (scope-changed) rating; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The low privilege bar (Contributor is a common, low-trust role on multi-author sites) makes this a meaningful risk for any site that grants untrusted users content-contribution access.

Authenticated SQL injection in the Dokan Pro WordPress multivendor marketplace plugin (versions <= 5.0.2) allows a low-privileged Subscriber-level user to inject malicious SQL into backend database queries, enabling extraction of sensitive data across the WordPress store. Reported by Patchstack and rated CVSS 7.1, the scope-changed vector reflects that a compromised low-tier account can reach data beyond its own authorization boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

SQL injection in the Uncanny Automator WordPress plugin (versions 7.3.2 and earlier) lets an authenticated administrator inject arbitrary SQL into backend database queries. Reported by Patchstack and scored CVSS 7.6, the flaw carries a confidentiality-heavy impact (C:H) but requires high privileges (PR:H), so the realistic threat is a compromised or rogue admin account rather than an anonymous internet attacker. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authenticated SQL injection in the Quiz And Survey Master WordPress plugin (versions 11.2.0 and earlier) lets a low-privileged Contributor-level user inject arbitrary SQL through the plugin's quiz/survey handling, exposing the entire WordPress database. The CVSS 3.1 base score is 8.5 with a scope change, reflecting that a single low-trust account can read data across the whole database rather than just plugin-scoped tables. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

SQL injection in the MapSVG WordPress plugin (versions <= 8.14.0) allows an authenticated user holding at least Contributor privileges to inject arbitrary SQL into backend database queries (CWE-89). Reported by Patchstack and rated CVSS 8.5, the flaw enables extraction of sensitive database contents such as WordPress user records and password hashes. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows Contributor-level authenticated users to inject arbitrary SQL through an unsanitized parameter (CWE-89), exposing the WordPress database. Because Contributor is a low-privilege role that many blogs and multi-author sites grant liberally, an attacker with such an account can read sensitive data including user credentials and secret keys. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but SQLi in WordPress plugins is a well-understood, easily weaponized class once details are public.

Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affects all versions up to and including 1.2.3, letting remote attackers inject arbitrary SQL through an exposed plugin parameter without any authentication. Rated CVSS 9.3, it enables extraction of sensitive WordPress database contents (user records, credentials, secrets) and, per the scope-changed CVSS vector, impact reaching beyond the plugin's own security boundary. No public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector makes it an attractive automation target.

SQL injection in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets remote, unauthenticated attackers inject arbitrary SQL through a plugin request, carrying a CVSS 3.1 base score of 9.3 (AV:N/PR:N with a changed scope and high confidentiality impact). Because Bookly is a public-facing booking form reachable by any site visitor, the flaw exposes the entire WordPress database to extraction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

SQL injection in the WPDM - Premium Packages WordPress plugin (versions <= 6.2.0) allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries, per the CVSS vector (PR:N). With a CVSS base of 9.3 and a changed scope, successful exploitation exposes sensitive database contents (C:H) such as user credentials, order data, and secrets. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV; the flaw was reported by Patchstack.

SQL injection in the MapSVG WordPress plugin (versions 8.14.0 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing the WordPress database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though no public exploit has been identified at time of analysis. Any WordPress site running a vulnerable MapSVG build is directly exposed to database extraction over the network.

Unauthenticated SQL injection in the Participants Database WordPress plugin (versions <= 2.7.8.3) lets remote attackers with no authentication inject arbitrary SQL through unsanitized input, enabling extraction of sensitive database contents such as participant records, user data, and WordPress credentials/hashes. Rated CVSS 9.3 with a network attack vector and no privileges required, and reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated SQL injection in the BuddyBoss Platform WordPress plugin (versions <= 3.0.5) lets remote attackers inject arbitrary SQL through unsanitized input, exposing database contents without any login. Rated CVSS 9.3 (scope-changed) and reported by Patchstack; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The network-reachable, no-authentication nature makes it a high-priority patch for any site running the community/social-networking plugin.

SQL injection in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets an authenticated Contributor-level user inject arbitrary SQL and read backend database contents. Reported by Patchstack and rated CVSS 8.5, the flaw carries a scope change (S:C) meaning the injected query can reach data beyond the plugin's own boundary. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low attacker prerequisites make it a credible risk on any multi-author site running the plugin.

SQL injection in the Create by Mediavine (Mediavine Create) WordPress recipe plugin through version 2.5.3 allows authenticated users holding at least Contributor-level privileges to inject arbitrary SQL into backend database queries (CWE-89). Successful exploitation exposes the full WordPress database - including user credentials, secret keys, and site content - and the CVSS 3.1 scope-changed vector (S:C) indicates impact beyond the plugin's own security context. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided.

SQL injection in the Lumise Product Designer for WooCommerce WordPress plugin (versions up to and including 2.1.1) allows unauthenticated attackers to extract sensitive database contents by manipulating the 'id' and 'table' parameters inside an uploaded cart JSON file processed by the checkout AJAX action. The flaw stems from unescaped interpolation into a raw SQL query in the find_resource() function, letting attackers append their own SELECT logic. No public exploit is identified at time of analysis, and the CVSS 7.5 rating reflects high confidentiality impact with no integrity or availability effect.

SQL injection in Xpoda No Code Platform (versions 4.3.1.0 through build 20260722) allows remote unauthenticated attackers to inject arbitrary SQL commands, per the CVSS PR:N/UI:N vector. Full read/write access to the backing database is achievable, threatening data confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; notably, the vendor was contacted by TR-CERT but did not respond, so no fixed version exists.

Arbitrary database read in the Events Manager WordPress plugin before 7.3.7 lets unauthenticated bookers inject a malicious serialized PHP object through a booking-registration field on sites running No-User-Account Booking Mode. When the stored booking is later loaded, the object is deserialized without a class allow-list, triggering a gadget chain that reaches an unparameterised SQL query and exposes sensitive data such as user password hashes and secret keys. Publicly available exploit code exists (WPScan) and SSVC rates exploitation as PoC and automatable, though it is not listed in CISA KEV.

Full takeover of Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) is possible when a low-privileged, network-authenticated attacker submits crafted SQL against the Product Security component, yielding complete loss of confidentiality, integrity, and availability. Oracle rates this 8.8 (CVSS 3.1) and addresses it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 'via SQL' wording combined with the tags points to a SQL-injection-class weakness in an authenticated interface.

Authenticated data tampering and denial of service in Oracle Enterprise Command Center Framework V16 (a Core component of Oracle E-Business Suite) lets a low-privileged attacker with network HTTP access create, delete or modify critical data, read a subset of accessible data, and force a complete, repeatable crash (full DoS). Oracle rates it CVSS 3.1 8.3 (C:L/I:H/A:H) and disclosed it in the Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege bar make it attractive to any actor already holding even limited EBS credentials.

Cross-tenant data disclosure in Aptabase (open-source privacy-friendly analytics) up to commit 5a89368 lets an authenticated tenant read every other tenant's event data by abusing a ClickHouse SQL injection in the stats API. Filter parameters (EventName, CountryCode, OsName, DeviceModel, AppVersion, SessionId) are interpolated unsanitized into Liquid SQL templates, letting an attacker append a UNION ALL that defeats the app_id tenant-isolation filter on 13 of 15 stats endpoints. Publicly available exploit code exists and the issue was reported by VulnCheck; no active exploitation is confirmed (not in CISA KEV).

Blind SQL injection in Tenable Security Center (formerly Tenable.sc/SecurityCenter) lets an authenticated, low-privileged user manipulate report filtering parameters to read unauthorized data from the backend database. Because the vulnerable manager aggregates vulnerability, asset, and scan data across the enterprise, a successful attacker can exfiltrate sensitive security posture information belonging to other users and organizations. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was self-reported by Tenable under advisory TNS-2026-19.

SQL injection in DHIS2 SQL View data endpoints lets an authenticated user with SQL View execution access supply crafted filter values that are interpolated directly into the generated SQL, allowing them to read data outside the intended SQL View result set. It affects release lines 2.37, 2.38 and 2.39 prior to the 2026-06-09 End-of-Support security updates and carries a vendor CVSS 4.0 score of 8.7 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix reworks filter handling to use parameterized placeholders instead of string interpolation.

Error-based SQL injection in the DHIS2 core SqlView API (the `filter` parameter of `/api/sqlViews/{viewId}/data.json`) lets an authenticated user who has access to a SqlView inject arbitrary SQL that PostgreSQL evaluates, with the result reflected in the application error message to exfiltrate arbitrary database content. It affects DHIS2 core across the 2.37 through 2.44 lines (2.37-2.39 reached end-of-support on 2026-06-09), and the root cause is an unquoted column name concatenated into the query, fixed in PR #24162 by wrapping it in SqlUtils.quote(). There is no public exploit identified at time of analysis and no CISA KEV listing, but the vendor-issued GHSA advisory and CVSS 8.8 mark it as a high-priority patch for any DHIS2 instance where SqlView access is broadly granted.

SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.

SQL injection and security-boundary bypass in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) lets a low-privileged MCP client abuse the prebuilt BigQuery forecasting tool (bigquery-forecast) to read arbitrary BigQuery tables. The tool interpolates client-supplied column parameters (data_col, timestamp_col, id_cols) unescaped into a generated AI.FORECAST SELECT statement, and the operator-configured allowedDatasets guard only validates the history_data parameter - not the final assembled query - so an attacker breaks out of a string literal to reach datasets that should be off-limits. There is no public exploit identified at time of analysis; risk derives from the injection primitive plus the confidentiality impact of cross-dataset reads.

SQL injection in Turkhotspot 5651 Loglama versions 5.1.2 through 5.1.2 (fixed in 5.1.3) allows remote attackers to inject arbitrary SQL commands, per TR-CERT advisory TR-26-0584. The product is a Turkish Law 5651 network-access logging/hotspot compliance appliance, and successful exploitation exposes the backing database that stores legally mandated user-activity logs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

SQL injection in the bpost Shipping Platform WordPress plugin (versions before 3.2.3) lets unauthenticated attackers inject SQL via an unsanitized parameter processed during WooCommerce order submission, enabling time-based blind extraction of database contents. Any WooCommerce store using this Belgian-postal shipping integration is exposed at checkout without authentication or user interaction. Publicly available exploit code exists (WPScan) and a vendor patch is available, though there is no public exploit identified as being actively used in the wild (not in CISA KEV).

SQL injection in AiFlowy versions 2.1.2 and earlier lets remote attackers extract sensitive database contents through the getPageData method in DatacenterQuery.java. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated, low-complexity network exploitation with high confidentiality impact but no integrity or availability effect. A public technical write-up with reproduction details exists on GitHub, though the low EPSS score (0.19%, 8th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.

SQL injection in WGCLOUD 3.6.4 lets remote attackers inject arbitrary SQL through unsanitized parameters bound in the PortInfoMapper.xml MyBatis mapper, enabling database manipulation that can be leveraged to escalate privileges within the monitoring platform. The flaw is remotely reachable and rated critical (CVSS 9.8), with publicly available exploit code exists in the form of a detailed write-up, though EPSS remains low (0.20%, 10th percentile) and there is no public exploit identified as actively used. WGCLOUD is an open-source IT infrastructure/host monitoring system, so a compromise exposes credentials and monitoring data for every managed host.

SQL injection in Crocus version 1.3.44 lets a remote attacker manipulate database queries through the RecordStateMapper.xml mapper and escalate privileges within the application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact on confidentiality, integrity and availability. A public write-up/proof-of-concept exists on GitHub, though the flaw is not listed in CISA KEV and EPSS is low (0.19%, 8th percentile), indicating no confirmed active exploitation to date.

Privilege escalation via SQL injection in Crocus version 1.3.44 allows remote attackers to manipulate backend database queries through the DeviceInfoMapper.xml data-access layer, yielding full read/write control over application data. The flaw carries a CVSS 9.8 (network, no authentication) rating, and publicly available exploit code exists in a GitHub write-up, though it is not listed in CISA KEV and its EPSS exploitation probability is low (0.20%, 10th percentile).

SQL injection in syslog-ng versions before 4.12 (also fixed in Premium Edition 8.2 and Store Box 7.8) allows an attacker who controls an untrusted log source to inject SQL through log data processed by the afsql SQL destination driver, because afsql_dd_run_query omits a required sanitization call. Exploitation only affects deployments that have manually configured the SQL driver, and there is no public exploit identified at time of analysis and no CISA KEV listing. The rated impact centers on integrity of the backing database and availability of the logging pipeline (CVSS 7.1).

SQL injection in Apache Syncope allows an administrator holding sufficient entitlements to execute arbitrary SQL through stacked queries by abusing unsanitized sort parameters, affecting the 3.0.x, 4.0.x, and 4.1.x branches up to 3.0.16, 4.0.6, and 4.1.1 respectively. Because stacked queries are supported, an attacker can go beyond data theft to modify or destroy identity data and potentially chain to further backend compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; note the NVD CVSS 9.8 (PR:N) contradicts the vendor description, which explicitly requires an authenticated privileged administrator.

Blind SQL injection in Windu CMS 4.1 lets remote attackers inject SQL syntax through the URL path carried in an HTTP header, requiring no authentication per the PR:N vector. Because the vendor (jcd) never responded to CERT-PL disclosure, only version 4.1 is confirmed vulnerable while other releases may also be affected. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the unauthenticated network-facing nature and CWE-89 root cause make it a high-severity data-exposure risk.

Unauthenticated SQL injection in the Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (all versions before 7.34.0) lets remote attackers extract sensitive database contents by injecting into an unsanitized request parameter used within a SQL statement, reachable through an AJAX action open to unauthenticated users. Publicly available exploit code exists (reported by WPScan), and a vendor patch is available; the CVSS 8.6 rating reflects a scope-changed, high-confidentiality impact with no authentication or user interaction required. No EPSS score or CISA KEV listing was provided, so there is no public exploit identified as being actively exploited at time of analysis.

Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint route confusion flaw that, when chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), lets attackers inject SQL and ultimately execute arbitrary code on the underlying host. Publicly available exploit code exists (a ProjectDiscovery Nuclei template and WPScan advisory), and the CISA SSVC framework rates the flaw as automatable with total technical impact, though it is not currently listed in CISA KEV. The vulnerability was reported by WPScan and patched in the WordPress 7.0.2 and 6.9.5 releases.

SQL injection in WordPress core (6.8.x before 6.8.6, 6.9.x before 6.9.5, 7.0.x before 7.0.2) arises from improper sanitisation of the author__not_in parameter in WP_Query, allowing an attacker to inject SQL when a plugin or theme forwards untrusted input into that parameter. Reported by WPScan and rated CVSS 9.1, it can lead to full database disclosure on affected sites, but exploitation is not reachable through unmodified core alone - a vulnerable plugin or theme code path is required. No public exploit identified at time of analysis and it is not listed in CISA KEV, though CISA SSVC flags the technical impact as total and the flaw as automatable.

Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrary SQL against the backend PostgreSQL database via the /pa endpoint, which concatenates the attacker-supplied PhoneIP value from a <PolycomIPPhone> XML body into queries without parameterization. Because SQL access on this PostgreSQL deployment can be escalated to command execution, a single crafted, unauthenticated request yields full database compromise and remote code execution on the VoIP appliance. There is no public exploit identified at time of analysis, though vendor SRA published a technical writeup, and the CVSS 4.0 base score is 9.3 (Critical).

SQL injection in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows remote unauthenticated attackers to inject arbitrary SQL commands via improperly neutralized special elements, per a TR-CERT advisory (TR-26-0573). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) indicates full compromise of the backend database with no authentication or user interaction. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

SQL injection in OpenRemote's datapoint crosstab export endpoint (all versions before 1.26.0) lets an authenticated user with asset creation or rename permissions exfiltrate database contents by embedding SQL into an asset display name that is concatenated into a raw PostgreSQL crosstab query. Injected SELECT results are streamed back inside the ZIP/CSV export response, giving a practical read primitive against any table the manager's database role can reach - including other tenants' data in multi-tenant deployments. Publicly available exploit code exists (VulnCheck/GHSA proof of concept); no active exploitation has been reported.

SQL injection in cool-admin-java 8.0.0 lets attackers inject arbitrary SQL through the order() method of CrudOption.java, a shared CRUD helper used across the framework's auto-generated data endpoints. The flaw carries an NVD CVSS of 9.8 (CWE-89) and, if reachable without authentication as the vector implies, permits full read/write access to the backing database. There is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile), indicating minimal observed exploitation activity so far.

SQL injection in UReport v2.2.9 lets remote unauthenticated attackers read arbitrary database contents by sending crafted SQL through the /ureport/datasource/previewData endpoint (CWE-89). The endpoint appears to pass user-controlled input into a live datasource preview query without parameterization, exposing sensitive stored data. No public exploit identified at time of analysis, though a technical write-up is published on GitHub; not listed in CISA KEV and no EPSS score was provided.

SQL injection in the Quix Page Builder Pro extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through a crafted request, enabling database read and write against affected sites. The CVSS 4.0 base score is 8.7 (High), reflecting network vector, low complexity, no privileges, and high impact to confidentiality, integrity, and availability of the vulnerable database. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; a third-party disclosure write-up exists on mysites.guru.

SQL injection in ThemeHunk's Advance Product Search - Voice & Ajax Search for WooCommerce plugin (all versions ≤ 1.4.4) lets unauthenticated attackers inject arbitrary SQL through the 's' and 'match' search parameters, enabling extraction of sensitive database contents such as user credentials and order data. The flaw stems from unescaped, unprepared query construction in the plugin's AJAX search backend and is remotely exploitable without authentication or user interaction. Reported by Wordfence; no public exploit identified at time of analysis and not listed in CISA KEV.

SQL injection in NocoBase's @nocobase/plugin-notification-in-app-message (before 2.0.61) lets any signed-up authenticated user reach GET /api/myInAppChannels:list and inject into the filter[latestMsgReceiveTimestamp][$lt] parameter, which is concatenated into a Sequelize.literal() template with no escaping or parameter binding. Because PostgreSQL permits stacked statements through this sink, an attacker can run arbitrary SQL and escalate to operating-system command execution via COPY ... TO PROGRAM. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the code fix and regression tests are public in the vendor commit, and the vendor rates it CVSS 10.0.

Authenticated SQL injection in DataEase dashboard variables allows data compromise. DataEase versions prior to 2.10.23 fail to sanitize dashboard SQL variables for non-in and non-between operators,

Stored SQL injection in DataEase (open source data visualization/BI tool) versions prior to 2.10.23 allows an authenticated user who can define SQL-type datasets to persist malicious SQL through variable defaultValue entries, which later execute against the backend database whenever any user with dataset read permission opens the dataset. The flaw (CWE-89) enables reading and modifying arbitrary database data, and CVSS 4.0 rates it 8.7 (High). No public exploit has been identified at time of analysis, but the upstream fix commit is public, so exploitation prerequisites are well documented.

Arbitrary SQL read access in DataEase before 2.10.23 lets authenticated users abuse the SQL preview feature (/de2api/datasetData/previewSql) to run attacker-supplied queries against any configured datasource. Because DatasetDataManage.previewSql passes the decoded PreviewSqlDTO.sql straight into datasourceRequest.query and CalciteProvider.fetchResultField executes it via prepareStatement().executeQuery(), an attacker can read any table the datasource account can access and receive the rows in the preview response. No public exploit identified at time of analysis, but the fix commit and advisory are public, making the flaw easy to reverse-engineer.

SQL injection in DataEase before 2.10.23 lets an authenticated low-privilege user compromise the backend datasource by abusing the datasource connection-status check, where io.dataease.datasource.provider.CalciteProvider#checkStatus concatenates the user-controlled configuration.getSchema() value into getTablesSql and runs it via executeQuery. Because the schema/owner string is embedded directly into metadata queries for DB2, SQL Server, PostgreSQL, Oracle and other datasources, an attacker who can create or edit a datasource can inject arbitrary SQL and read or alter data on the connected database. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor commit that replaces string concatenation with parameterized PreparedStatements.

SQL injection in MantisBT 2.28.3 and earlier (fixed in 2.28.4) lets an administrator poison the history_order configuration value, which core/history_api.php concatenates unsanitized into an ORDER BY clause; the injected SQL then fires whenever any authenticated user views a bug that has history entries. This converts an administrator's config-write into database-wide data theft (password hashes, cookie_strings, API tokens, private issues) and, where the MySQL account holds the FILE privilege, remote code execution via INTO OUTFILE dropping a PHP webshell in the web root. No public exploit identified at time of analysis; reported by McCaulay Hudson of watchTowr and tracked as GitHub advisory GHSA-mw6p-33vw-46cc.

SQL injection in EDocman, the Joomla download/document manager extension by Joomdonation, allows remote unauthenticated attackers to inject arbitrary SQL through the extension's request handling (CWE-89). The CVSS 4.0 score of 8.7 reflects high confidentiality impact with no required privileges or user interaction, meaning database contents can be extracted directly over the network. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.

SQL injection in the DPCalendar extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, per the CVSS:4.0 vector (PR:N/UI:N). With confidentiality-only impact rated High and no integrity or availability effect, the flaw primarily enables theft of Joomla database contents such as user records, session data, and configuration secrets. No public exploit identified at time of analysis, and no EPSS or CISA KEV signal was provided.

SQL injection in MetaGuru's HCM (Human Capital Management) platform lets authenticated remote attackers inject malicious SQL through specific request parameters, yielding full read/write control over the backing database and its confidentiality, integrity, and availability. The flaw was reported by TWCERT (Taiwan CERT) and carries a CVSS 4.0 base score of 8.7; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because valid low-privilege credentials are required (PR:L), risk concentrates in environments where accounts are broadly provisioned or credentials can be phished/reused.

SQL injection in Apache Fineract's Office Search API (GET /api/v1/offices) in all versions up to and including 1.14.0 lets an authenticated user who holds the office-view permission inject arbitrary SQL through the orderBy request parameter. Because it bypasses the ColumnValidator hardening added for CVE-2024-32838, an attacker can run time-based blind SQL injection to exfiltrate database contents and, by launching concurrent injections that hold connections open, exhaust the database connection pool to cause denial of service. No public exploit identified at time of analysis; the flaw is documented via an oss-security advisory and an upstream fix pull request (apache/fineract #6048).

Blind boolean-based SQL injection in Apache Fineract's Client Search API (GET /api/v1/clients) through version 1.14.0 lets an authenticated user who holds the view-clients permission concatenate unvalidated orderBy (and sortOrder) parameters directly into the backing SQL query. Attackers can extract arbitrary database contents one bit at a time and, on MySQL/MariaDB back ends, read arbitrary files accessible to the DB process via LOAD_FILE(). There is no public exploit identified at time of analysis, though the vendor's fix PR (#6020) ships an integration test containing a working injection payload; not listed in CISA KEV.

SQL injection in Apache Fineract's Report Execution API (the runreports endpoint) in all versions up to and including 1.14.0 lets an authenticated user holding report-run permission inject arbitrary SQL through crafted report parameter values, because those values are concatenated into the generated query without sufficient validation. This yields unauthorized read access to data well beyond what the report was scoped to expose, and by extension other database contents. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the upstream fix landed in PR #5980, which introduces a configurable InputValidator/validation-profile framework.

UNION-based SQL injection in the Quotes Llama WordPress plugin (all versions before 3.1.6) lets unauthenticated remote attackers inject arbitrary SQL through an unsanitized request parameter and read any data from the WordPress database, including user password hashes. Publicly available exploit code exists and a vendor patch has been released; the flaw carries a high EPSS-relevant profile because it is remotely reachable with no authentication or user interaction. This is no public exploit identified as actively exploited (not in CISA KEV), but working PoC availability makes opportunistic mass-scanning likely.

SQL injection in Adobe ColdFusion 2023 and 2025 lets an attacker with high privileges inject crafted SQL that escalates to arbitrary code execution in the context of the current user, with a changed scope that extends impact beyond the vulnerable component. The flaw (CWE-89, CVSS 9.1) affects ColdFusion 2023 through Update 21 and ColdFusion 2025 through Update 10, requires no user interaction, and was disclosed by Adobe PSIRT. There is no public exploit identified at time of analysis, and EPSS is modest at 0.69% (49th percentile).

SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged authenticated attacker to inject malicious SQL that can escalate to arbitrary code execution in the context of the current user, enabling account/session takeover. The flaw (CWE-89) is network-reachable and requires no user interaction, but demands existing high privileges per the CVSS PR:H metric. No public exploit is identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.

Cross-resource SQL injection in the FacturaScripts REST API (all versions through 2026.1) lets a low-privileged, scoped ApiKey read or modify arbitrary database tables via the `filter` query parameter, enabling full admin account takeover. A single GET request with a parenthesized filter key leaks the admin's bcrypt password hash and `logkey` session token, which are then replayed as the `fsLogkey` cookie to reach admin-only endpoints like `/AdminPlugins`. A live end-to-end PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no public exploit identified as being used in active attacks (not in CISA KEV).

Privilege elevation in Microsoft SQL Server (2016 SP3 through 2025) allows an authenticated attacker to inject crafted SQL commands over the network and gain higher database privileges (CVSS 8.8). The flaw is a classic improper neutralization of special elements (CWE-89) reachable by any principal already holding low-level database access. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, though a vendor patch is available.

SQL injection in Microsoft SQL Server (versions 2016 through 2025) enables an authenticated attacker to escalate privileges on the database server. The flaw, tracked as CWE-89, exists within the SQL Server engine's handling of user-supplied SQL input, allowing insufficient neutralization to be leveraged for privilege elevation. Publicly available exploit code exists (GitHub gist), though CISA has not yet added this to the KEV catalog and SSVC indicates no confirmed active exploitation; EPSS sits at 0.57% (44th percentile), suggesting low but non-trivial opportunistic exploitation risk.

SQL injection and local file disclosure in Snowflake SQLAlchemy before 1.11.0 lets an authenticated application user abuse three distinct weaknesses: unsanitized column identifiers in MERGE/upsert operations, improper literal rendering of bound parameters in Snowflake-specific table-creation queries, and unsafe forwarding of connection parameters that can be coerced into reading arbitrary local files. Any application built on this dialect that passes user-controlled keys, strings, or connection settings into the affected APIs can leak or modify data within the connection role's scope and, in some deployments, exfiltrate local files to an attacker endpoint. No public exploit identified at time of analysis; the issues are reported by the vendor (Snowflake) and fixed in 1.11.0.

SQL injection and input-validation weaknesses in the Snowflake Spark Connector (spark-snowflake) before version 3.2.1 let attackers exfiltrate OAuth client credentials, run arbitrary SQL under the connector's Snowflake role, and redirect COPY data-loading operations to attacker-controlled storage. Reported by Snowflake, the flaws are most dangerous in shared/multi-tenant Spark clusters where injected SQL executes with the cluster admin's JDBC credentials, enabling credential theft and privilege escalation. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis.

SQL injection in Apache Kylin (versions 4 through 5.0.3) allows attackers to inject arbitrary SQL through a backend API used to refresh the table catalog, where untrusted input is concatenated into a dynamically generated SQL statement. The upstream CVSS 3.1 vector rates this as unauthenticated (PR:N) with full confidentiality, integrity, and availability impact (9.8), enabling database read/write and potentially further compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Remote code execution in DIRAC (Distributed Infrastructure with Remote Agent Control) grid middleware lets any authenticated user run arbitrary commands on the server through the FileCatalog DatasetManager. A SQL injection (CWE-89) in the checkDataset code path lets the attacker control a value that is fed directly into a Python eval(), turning a data-layer flaw into full server compromise. Rated CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H); no public exploit identified at time of analysis, though the vendor advisory names the exact vulnerable source lines.

Blind SQL injection in the persian-gravity-forms WordPress plugin (گرویتی فرم فارسی) affects all versions up to and including 3.0.2, allowing a high-privilege authenticated attacker to inject arbitrary SQL through unsanitized input and blindly extract database contents. The flaw was reported by Patchstack and carries a CVSS 7.6 due to a changed scope and high confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Blind SQL injection in the Sergey "AIWU" ai-copilot-content-generator WordPress plugin (all versions through 1.5.4) allows remote attackers to inject arbitrary SQL into backend database queries, per the CVSS:3.1 vector without requiring authentication or user interaction. Because the scope is changed and confidentiality impact is High, an attacker can exfiltrate sensitive database contents (WordPress user credentials, secrets, PII) via time- or boolean-based blind techniques. No public exploit identified at time of analysis and the issue is not on CISA KEV, but its high CVSS (9.3) and the fact that it was catalogued by Patchstack make it a credible risk for exposed WordPress sites.