SQL Injection

web HIGH

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.

How It Works

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements. When developers concatenate untrusted data into queries without proper sanitization, attackers can inject SQL syntax that changes the query's logic. For example, entering ' OR '1'='1 into a login form might transform SELECT * FROM users WHERE username='input' into a query that always returns true, bypassing authentication.

Attackers follow a methodical process: first probing input fields with special characters like quotes or semicolons to trigger database errors, then identifying whether the application is vulnerable. Once confirmed, they escalate by injecting commands to extract data (UNION-based attacks to merge results from other tables), manipulate records, or probe the database structure. Blind SQL injection variants work without visible error messages—boolean-based attacks infer data by observing application behavior changes, while time-based attacks use database sleep functions to confirm successful injection through response delays.

Advanced scenarios include second-order injection, where malicious input is stored in the database and later executed in a different context, and out-of-band attacks that exfiltrate data through DNS queries or HTTP requests when direct data retrieval isn't possible. Some database systems enable attackers to execute operating system commands through built-in functions like MySQL's LOAD_FILE or SQL Server's xp_cmdshell, escalating from database compromise to full server control.

Impact

  • Complete data breach — extraction of entire database contents including credentials, personal information, and proprietary data
  • Authentication bypass — logging in as any user without knowing passwords
  • Data manipulation — unauthorized modification or deletion of critical records
  • Privilege escalation — granting administrative rights to attacker-controlled accounts
  • Remote code execution — leveraging database features to run operating system commands and compromise the underlying server
  • Lateral movement — using compromised database credentials to access other connected systems

Real-World Examples

FreePBX's CVE-2025-66039 demonstrated a complete attack chain where SQL injection across 11 parameters in four different endpoints allowed attackers to write malicious entries into the cron_jobs table. When the system's scheduler executed these entries, the injected SQL transformed into operating system commands, granting full server control. The vulnerability required no authentication, making it immediately exploitable.

E-commerce platforms have suffered massive breaches through shopping cart SQL injection, where attackers inserted skimming code into stored procedures that executed during checkout, harvesting credit card data from thousands of transactions. Healthcare systems have been compromised through patient portal vulnerabilities, exposing millions of medical records when attackers injected UNION queries to merge data from supposedly isolated tables.

Mitigation

  • Parameterized queries (prepared statements) — separates SQL logic from data, making injection syntactically impossible
  • Object-Relational Mapping (ORM) frameworks — abstracts database interactions with built-in protections when used correctly
  • Strict input validation — whitelist acceptable characters and formats, reject suspicious patterns
  • Least privilege database accounts — applications should use credentials with minimal necessary permissions
  • Web Application Firewall (WAF) — detects and blocks common injection patterns as a secondary defense layer
  • Database activity monitoring — alerts on unusual query patterns or privilege escalation attempts

Recent CVEs (4530)

CVE-2026-1581
EPSS 0% CVSS 7.5
HIGH This Week

Unauthenticated attackers can exploit time-based SQL injection in wpForo Forum plugin for WordPress versions up to 2.4.14 through the 'wpfob' parameter to extract sensitive database information. The vulnerability stems from insufficient input sanitization and improper SQL query preparation, allowing attackers to inject arbitrary SQL commands without authentication. No patch is currently available.

WordPress SQLi
NVD
CVE-2025-9953
EPSS 0% CVSS 9.8
CRITICAL Act Now

Authorization bypass via user-controlled SQL primary key in Databank Accreditation Software.

SQLi
NVD
CVE-2025-15560
EPSS 0% CVSS 8.8
HIGH This Week

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. [CVSS 8.8 HIGH]

Mssql SQLi Worktime
NVD
CVE-2026-25418
EPSS 0% CVSS 7.6
HIGH This Week

SQL injection in Bit Form through version 2.21.10 enables authenticated attackers with high privileges to execute arbitrary database queries, potentially exposing sensitive data. The vulnerability requires administrative credentials but has no available patch, leaving affected installations at risk until an update is released.

SQLi
NVD
CVE-2026-25378
EPSS 0% CVSS 7.6
HIGH This Week

Blind SQL injection in Nelio AB Testing plugin version 8.2.4 and earlier enables authenticated attackers with high privileges to execute arbitrary SQL queries against the database. An attacker with administrative access could exploit this vulnerability to extract sensitive data or manipulate database contents, though availability impact is limited. No patch is currently available.

SQLi
NVD
CVE-2026-23805
EPSS 0% CVSS 7.6
HIGH This Week

SQL injection in Yoren Chang Media Search Enhanced through version 0.9.1 enables unauthenticated remote attackers to execute arbitrary SQL queries and extract sensitive data from the underlying database. With high privileges required for exploitation, an authenticated attacker with administrative access can manipulate SQL commands to compromise data confidentiality while causing minor service disruption. No patch is currently available.

SQLi
NVD
CVE-2026-2706
EPSS 0% CVSS 6.3
MEDIUM POC This Month

SQL injection in Patient Record Management System 1.0 via the comp_id parameter in /fecalysis_not.php enables authenticated remote attackers to read, modify, or delete database contents. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but no user interaction.

PHP SQLi Patient Record Management System
NVD GitHub VulDB
CVE-2026-2691
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /admin/manage_register.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, and no patch is currently available, creating significant risk for unpatched deployments.

PHP SQLi Event Management System
NVD GitHub VulDB
CVE-2026-2690
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Event Management System 1.0's admin login endpoint allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, enabling attackers to potentially extract sensitive data or compromise system integrity. No patch is currently available for affected PHP installations.

PHP SQLi Event Management System
NVD GitHub VulDB
CVE-2026-2689
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Event Management System 1.0's booking management interface allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /admin/manage_booking.php. Public exploit code exists for this vulnerability, enabling potential unauthorized data access and modification. No patch is currently available to address this high-severity flaw affecting PHP-based deployments.

PHP SQLi Event Management System
NVD GitHub VulDB
CVE-2026-0722
EPSS 0% CVSS 6.5
MEDIUM This Month

The Shield Security plugin for WordPress versions up to 21.0.8 contains a CSRF vulnerability that allows attackers to bypass nonce verification through a manipulated parameter, enabling SQL injection attacks to extract database contents. An unauthenticated attacker can exploit this by tricking a site administrator into clicking a malicious link, potentially compromising sensitive information stored in the WordPress database. No patch is currently available for affected installations.

WordPress SQLi CSRF
NVD
CVE-2025-12707
EPSS 0% CVSS 7.5
HIGH This Week

The Library Management System plugin for WordPress is vulnerable to SQL Injection via the 'bid' parameter in all versions up to, and including, 3.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. [CVSS 7.5 HIGH]

WordPress SQLi PHP
NVD
CVE-2025-15585
EPSS 0%
This Week

Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file search function. Successful exploitation requires the system to use MySQL as the underlying database and could result in privilege escalation or data exfiltration.

MySQL SQLi Privilege Escalation
NVD
CVE-2026-2682
EPSS 0% CVSS 6.3
MEDIUM POC This Month

SQL injection in Tsinghua Unigroup Electronic Archives System versions up to 3.2.210802 allows authenticated remote attackers to manipulate the comid parameter via the /mine/PublicReport/prinReport.html endpoint, potentially leading to unauthorized data access or modification. Public exploit code is available for this vulnerability, and the vendor has not provided a patch despite early notification.

Java SQLi Electronic Archives System
NVD GitHub VulDB
CVE-2025-12812
EPSS 0%
This Week

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Privileged Access Service.

SQLi
NVD
CVE-2026-27179
EPSS 0% CVSS 8.2
HIGH POC This Week

Unauthenticated SQL injection in MajorDoMo's commands module allows remote attackers to extract database contents including unsalted MD5 password hashes without authentication, enabling credential compromise and admin panel access. The vulnerability stems from unsanitized $_GET parameters in SQL queries accessible via the /objects/?module=commands endpoint, and public exploit code is available. Affected versions lack a patch and impact both MajorDoMo and PHP installations running this software.

PHP SQLi Majordomo
NVD GitHub
CVE-2019-25359
EPSS 0% CVSS 8.2
HIGH POC This Week

SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL statements through POST parameters 'idtyp' and 'idgremium'. [CVSS 8.2 HIGH]

Dotnet SQLi Information Disclosure
NVD Exploit-DB
CVE-2026-2663
EPSS 0% CVSS 6.3
MEDIUM This Month

SQL injection in Alixhan xh-admin-backend versions up to 1.7.0 allows authenticated attackers to manipulate the prop parameter in the /frontend-api/system-service/api/system/role/query endpoint and execute arbitrary database queries remotely. Public exploit code exists for this vulnerability, and the vendor has not provided a patch or responded to disclosure efforts. Affected organizations running vulnerable versions should immediately restrict access to this endpoint or upgrade if available.

SQLi
NVD VulDB
CVE-2025-70152
EPSS 0% CVSS 9.8
CRITICAL POC Act Now

SQL injection in code-projects Community Project Scholars Tracking System 1.0 admin user management. Allows database compromise via admin panel. PoC available.

PHP SQLi Scholars Tracking System
NVD
CVE-2025-70149
EPSS 0% CVSS 9.8
CRITICAL POC Act Now

SQL injection in CodeAstro Membership Management System 1.0 via ID parameter in print_membership_card.php enables unauthenticated database access. PoC available.

PHP SQLi Membership Management System
NVD
CVE-2025-59920
EPSS 0%
This Week

When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If the query URL is copied and opened in a new browser window, the ‘IDClient’ parameter is vulnerable to a blind authenticated SQL injection.

SQLi
NVD
CVE-2026-1317
EPSS 0% CVSS 6.5
MEDIUM This Month

SQL injection in the WP Import - Ultimate CSV Importer plugin for WordPress (versions up to 7.37) allows authenticated subscribers and higher-privileged users to inject malicious SQL commands through specially crafted filenames during file uploads. When the Single Import/Export feature is enabled on PHP versions below 8.0, attackers can extract sensitive database information by exploiting insufficient input validation. The vulnerability requires valid WordPress credentials but poses a medium risk due to its direct access to database contents.

WordPress PHP SQLi
NVD
CVE-2025-8781
EPSS 0% CVSS 4.9
MEDIUM This Month

The Bookster - WordPress Appointment Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘raw’ parameter in all versions up to, and including, 2.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. [CVSS 4.9 MEDIUM]

WordPress SQLi PHP
NVD
CVE-2026-2495
EPSS 0% CVSS 7.5
HIGH This Week

Unauthenticated attackers can exploit SQL injection in the WPNakama WordPress plugin (versions up to 0.6.5) through the 'order' parameter in the REST API /wp-json/WPNakama/v1/boards endpoint due to insufficient input escaping. This allows unauthorized extraction of sensitive database information from any WordPress installation running the vulnerable plugin. No patch is currently available.

WordPress SQLi
NVD
CVE-2026-1639
EPSS 0% CVSS 6.5
MEDIUM This Month

SQL injection in the Taskbuilder WordPress plugin through unescaped 'order' and 'sort_by' parameters allows authenticated users with subscriber-level privileges to extract sensitive database information via time-based blind SQL injection attacks. The vulnerability affects all versions up to 5.0.2 and has no available patch. Attackers can craft malicious queries to systematically retrieve confidential data from the WordPress database.

WordPress SQLi
NVD
CVE-2026-2576
EPSS 0% CVSS 7.5
HIGH This Week

Unauthenticated attackers can exploit time-based SQL injection in the Business Directory Plugin for WordPress (versions up to 6.4.2) through an unescaped 'payment' parameter to extract sensitive database information. The vulnerability stems from insufficient input validation and improper query preparation, allowing attackers to append arbitrary SQL commands to existing queries without authentication. No patch is currently available.

WordPress SQLi
NVD
CVE-2026-2621
EPSS 0% CVSS 7.3
HIGH This Week

SQL injection in Sciyon Koyuan Thermoelectricity Heat Network Management System 3.0 via the PGUID parameter in AsyncTreeProxy.aspx allows unauthenticated remote attackers to read, modify, and delete database contents. Public exploit code exists for this vulnerability and no patch is currently available from the vendor.

SQLi
NVD GitHub VulDB
CVE-2026-2620
EPSS 0% CVSS 7.3
HIGH This Week

SQL injection in Huace Monitoring and Early Warning System 2.2 via the ID parameter in /Web/SysManage/ProjectRole.aspx allows unauthenticated remote attackers to manipulate database queries. Public exploit code exists for this vulnerability, and the vendor has not provided a patch or response. An attacker can exploit this to read, modify, or delete sensitive data from the affected system.

SQLi
NVD GitHub VulDB
CVE-2025-67102
EPSS 0% CVSS 7.6
HIGH This Week

A SQL injection vulnerability in the alldayoffs feature in Jorani up to v1.0.4, allows an authenticated attacker to execute arbitrary SQL commands via the entity parameter. [CVSS 7.6 HIGH]

SQLi
NVD GitHub
CVE-2024-55270
EPSS 0% CVSS 8.8
HIGH POC This Week

phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata parameter. [CVSS 8.8 HIGH]

PHP SQLi Student Management System
NVD GitHub
CVE-2025-70397
EPSS 0% CVSS 7.2
HIGH POC This Week

jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter. [CVSS 7.2 HIGH]

SQLi Jizhicms
NVD
CVE-2026-2247
EPSS 0%
This Week

SQL injection vulnerability (SQLi) in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker executes a malicious payload in the URL generated after downloading the student's report card in the ‘Day-to-day’ section from the mobile application.

SQLi
NVD
CVE-2025-7631
EPSS 0% CVSS 8.6
HIGH This Week

Tumeva Internet Technologies Software Information Advertising and Consulting Services Trade Ltd. Co. Tumeva Prime News Software is affected by sql injection (CVSS 8.6).

SQLi
NVD
CVE-2026-2553
EPSS 0% CVSS 6.3
MEDIUM This Month

SQL injection in the Hotel-Management-System /home.php POST handler allows authenticated remote attackers to manipulate Name/Email parameters and execute arbitrary database queries. Public exploit code exists for this vulnerability, which affects PHP-based deployments with no available patch. An attacker with login credentials can leverage this flaw to read or modify sensitive database records.

PHP SQLi
NVD GitHub VulDB
CVE-2026-1258
EPSS 0% CVSS 4.9
MEDIUM This Month

SQL injection in Mail Mint plugin for WordPress (versions up to 1.19.2) allows authenticated administrators to execute arbitrary SQL queries through improperly sanitized parameters in multiple API endpoints. An attacker with admin-level access could exploit insufficient input escaping on 'order-by', 'order-type', and 'selectedCourses' parameters to extract sensitive data from the WordPress database. No patch is currently available for this vulnerability.

WordPress SQLi
NVD
CVE-2026-2024
EPSS 0% CVSS 7.5
HIGH This Week

Unauthenticated attackers can exploit SQL injection in the PhotoStack Gallery plugin for WordPress (versions up to 0.4.1) through the unescaped 'postid' parameter to extract sensitive database information. The vulnerability stems from insufficient input validation and unprepared SQL queries, allowing attackers to inject arbitrary SQL commands without authentication. With no patch currently available, all WordPress installations using this plugin are at risk of data exposure.

WordPress SQLi
NVD
CVE-2025-69633
EPSS 0% CVSS 9.8
CRITICAL Act Now

SQL injection in Advanced Popup Creator PrestaShop module 1.1.26-1.2.6. Fixed in 1.2.7.

PHP SQLi
NVD
CVE-2019-25325
EPSS 0% CVSS 8.2
HIGH POC This Week

Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by manipulating the 'user' POST parameter. [CVSS 8.2 HIGH]

PHP SQLi Authentication Bypass
NVD Exploit-DB
CVE-2019-25347
EPSS 0% CVSS 7.5
HIGH POC This Week

thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can inject malicious SQL code like ' or '1=1 to the username field to gain unauthorized access to user accounts. [CVSS 7.5 HIGH]

SQLi Authentication Bypass Password Management Application
NVD GitHub Exploit-DB
CVE-2019-25346
EPSS 0% CVSS 7.5
HIGH POC This Week

TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter. Attackers can inject malicious SQL code like ' or '1=1 to retrieve unauthorized database records and potentially access sensitive system information. [CVSS 7.5 HIGH]

SQLi Authentication Bypass Password Management Application
NVD GitHub Exploit-DB
CVE-2026-22821
EPSS 0% CVSS 4.9
MEDIUM PATCH This Month

The More Reporting GLPI plugin versions prior to 1.9.4 contain a SQL injection vulnerability in date change functionality that allows authenticated users with high privileges to execute arbitrary SQL queries and extract sensitive data. An attacker with administrative credentials could exploit this network-accessible vulnerability to read confidential information from the database. A patch is available in version 1.9.4 and later.

SQLi More Reporting
NVD GitHub
CVE-2025-70981
EPSS 0% CVSS 9.8
CRITICAL POC Act Now

SQL injection in CordysCRM 1.4.1 employee list query via departmentIds parameter. PoC available.

SQLi Cordys Crm
NVD GitHub
CVE-2025-10969
EPSS 0% CVSS 9.8
CRITICAL Act Now

SQL injection in Farktor E-Commerce platform allows full database access.

SQLi E Commerce Package
NVD
CVE-2026-2250
EPSS 0% CVSS 7.5
HIGH This Week

METIS WIC devices expose an unauthenticated /dbviewer/ endpoint that permits remote attackers to directly access and export internal SQLite databases containing sensitive operational telemetry. The affected Golang and Django applications run with debug mode enabled, causing error responses to leak backend source code, local file paths, and system configuration details. No patch is currently available.

Golang Django SQLi
NVD
CVE-2025-13431
EPSS 0% CVSS 6.5
MEDIUM This Month

The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and including, 5.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. [CVSS 6.5 MEDIUM]

WordPress Industrial SQLi +1
NVD
CVE-2026-25993
EPSS 0% CVSS 9.8
CRITICAL PATCH Act Now

SQL injection in EverShop e-commerce platform during category update/deletion event handling. Path/request_path values injected unsanitized into SQL. Patch available.

SQLi Evershop
NVD GitHub
CVE-2026-25947
EPSS 0% CVSS 8.8
HIGH POC PATCH This Week

Worklenz is a project management tool. [CVSS 8.8 HIGH]

SQLi Worklenz
NVD GitHub
CVE-2026-1602
EPSS 0% CVSS 6.5
MEDIUM This Month

Authenticated attackers can exploit SQL injection in Ivanti Endpoint Manager prior to version 2024 SU5 to extract sensitive data from the underlying database. This network-accessible vulnerability requires valid credentials but allows unauthorized information disclosure with no user interaction needed. No patch is currently available for affected systems.

Ivanti SQLi Endpoint Manager
NVD
CVE-2025-7636
EPSS 0% CVSS 8.8
HIGH This Week

Ergosis Security Systems Computer Industry and Trade Inc. ZEUS PDKS is affected by sql injection (CVSS 8.8).

SQLi
NVD
CVE-2026-2094
EPSS 0% CVSS 8.8
HIGH This Week

Docpedia by Flowring contains a SQL injection vulnerability (CWE-89) that allows authenticated users to execute arbitrary database queries with network access. Attackers can exploit this flaw to read, modify, or delete sensitive database contents, with no patch currently available. The vulnerability has a high CVSS score of 8.8 and affects all confidentiality, integrity, and availability of the underlying database.

SQLi
NVD
CVE-2026-2093
EPSS 0% CVSS 7.5
HIGH This Week

Unauthenticated attackers can exploit SQL injection in Flowring's Docpedia to execute arbitrary database queries and extract sensitive information without authentication. The vulnerability requires no user interaction and is remotely accessible over the network, presenting a critical risk to all deployments. No patch is currently available to remediate this issue.

SQLi
NVD
CVE-2026-25495
EPSS 0% CVSS 8.8
HIGH POC PATCH This Week

SQL injection in Craft CMS 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21 allows authenticated Control Panel users to execute arbitrary SQL queries via the criteria[orderBy] parameter in the element-indexes/get-elements endpoint. The vulnerability stems from insufficient input sanitization in the ORDER BY clause, enabling attackers to manipulate database queries. Public exploit code exists for this high-severity vulnerability, and patches are available in versions 4.16.18 and 5.8.22.

SQLi Craft Cms
NVD GitHub
CVE-2025-6830
EPSS 0% CVSS 9.8
CRITICAL Act Now

An SQL injection vulnerability in a product allows unauthenticated database compromise through unsanitized input.

SQLi
NVD
CVE-2026-2225
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in the News Portal Project 1.0 administrator login interface allows unauthenticated remote attackers to manipulate the email parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker could exploit this to extract sensitive data, modify database contents, or potentially escalate privileges within the application.

PHP SQLi News Portal Project
NVD GitHub VulDB
CVE-2026-2236
EPSS 0% CVSS 7.5
HIGH This Week

Unauthenticated attackers can exploit SQL injection in C&Cm@il by HGiga to execute arbitrary database queries and extract sensitive information without authentication or user interaction. The vulnerability has a high severity rating with a CVSS score of 7.5 and impacts database confidentiality. No patch is currently available for this issue.

SQLi
NVD
CVE-2026-2235
EPSS 0% CVSS 6.5
MEDIUM This Month

C&Cm@il by HGiga contains a SQL injection flaw (CWE-89) that allows authenticated users to execute arbitrary database queries and extract sensitive information. The vulnerability requires valid credentials but no user interaction, making it exploitable by compromised or malicious internal accounts. No patch is currently available for this medium-severity issue.

SQLi
NVD
CVE-2026-2223
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in code-projects Online Reviewer System 1.0 via the ID parameter in the assessment module allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2221
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in the login component of code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, which affects PHP-based installations of the Online Reviewer System. An attacker can exploit this to extract sensitive data, modify database contents, or potentially gain unauthorized system access.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2220
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in /system/system/admins/assessments/pretest/btn_functions.php allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2217
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Event Management System 1.0 via the ID parameter in /admin/manage_user.php allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available, putting all affected installations at immediate risk.

PHP SQLi Event Management System
NVD GitHub VulDB
CVE-2026-2212
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in AdminEditCategory.php, enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.

PHP SQLi Online Music Site
NVD GitHub VulDB
CVE-2026-2211
EPSS 0% CVSS 7.3
HIGH POC This Week

Online Music Site versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).

PHP SQLi Online Music Site
NVD GitHub VulDB
CVE-2026-2199
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in the user deletion function, potentially leading to unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations vulnerable to active exploitation.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2198
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in /system/system/admins/assessments/pretest/loaddata.php allows remote attackers to execute arbitrary SQL queries without authentication. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could result in unauthorized data access, modification, or deletion within the application database.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2197
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in code-projects Online Reviewer System 1.0 allows remote attackers to manipulate the test_id parameter in the exam-delete.php file, enabling unauthorized database access and modification without authentication. The vulnerability has public exploit code available and currently lacks a patch, posing an immediate risk to unpatched installations. Affected organizations using this system should prioritize mitigation strategies while awaiting official remediation.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2196
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the test_id parameter in the exam-update.php endpoint, enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2195
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in code-projects Online Reviewer System 1.0 via the ID parameter in the questions-view.php file allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at active risk.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2190
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /ramonsys/user/controller.php allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available, requiring organizations to implement alternative mitigations or restrict access to vulnerable systems.

PHP SQLi School Management System
NVD GitHub VulDB
CVE-2026-2189
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode School Management System 1.0 allows unauthenticated remote attackers to manipulate the 'ay' parameter in /ramonsys/report/index.php, potentially enabling data exfiltration, modification, or service disruption. Public exploit code exists for this vulnerability and no patch is currently available, creating immediate risk for deployed instances.

PHP SQLi School Management System
NVD GitHub VulDB
CVE-2026-2179
EPSS 0% CVSS 4.7
MEDIUM POC This Month

SQL injection in PHPGurukul Hospital Management System 4.0's user management interface allows remote attackers with administrative privileges to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, though no patch is currently available. The attack requires high-level credentials but poses risks to data confidentiality, integrity, and availability within affected hospital deployments.

PHP SQLi Hospital Management System
NVD GitHub VulDB
CVE-2026-2176
EPSS 0% CVSS 6.3
MEDIUM This Month

SQL injection in code-projects Contact Management System 1.0 allows authenticated remote attackers to manipulate the selecteditem[0] parameter in index.py and execute arbitrary SQL queries. The vulnerability requires valid user credentials but enables data exfiltration, modification, and potential system compromise. No patch is currently available.

SQLi Contact Management System
NVD VulDB
CVE-2026-2173
EPSS 0% CVSS 7.3
HIGH This Week

SQL injection in code-projects Online Examination System 1.0 allows unauthenticated remote attackers to manipulate the username and password parameters in login.php, potentially enabling unauthorized access to sensitive data or system compromise. The vulnerability requires no user interaction and can be exploited over the network with low complexity. No patch is currently available for this issue.

PHP SQLi Online Examination System
NVD VulDB
CVE-2026-2172
EPSS 0% CVSS 7.3
HIGH This Week

Online Application System For Admission versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).

PHP SQLi Online Application System For Admission
NVD VulDB
CVE-2026-2171
EPSS 0% CVSS 7.3
HIGH This Week

SQL injection in the login function of code-projects Online Student Management System 1.0 allows unauthenticated attackers to manipulate username and password parameters in accounts.php, enabling unauthorized data access, modification, and potential service disruption. Public exploit code is available for this vulnerability, increasing exploitation risk. No patch is currently available.

PHP SQLi Online Student Management System
NVD VulDB
CVE-2026-2166
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in the Online Reviewer System 1.0 login function allows unauthenticated remote attackers to manipulate username and password parameters, potentially enabling unauthorized database access and data modification. With public exploit code available and no patch released, this vulnerability poses an immediate risk to deployed instances.

PHP SQLi Online Reviewer System
NVD GitHub VulDB
CVE-2026-2162
EPSS 0% CVSS 4.7
MEDIUM POC This Month

SQL injection in the News Portal Project 1.0 admin panel (/admin/aboutus.php) allows authenticated attackers with high privileges to manipulate the pagetitle parameter and execute arbitrary SQL queries, potentially compromising database integrity and confidentiality. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires network access and valid administrative credentials but no user interaction.

PHP SQLi News Portal Project
NVD GitHub VulDB
CVE-2026-2161
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Directory Management System 1.0 allows unauthenticated remote attackers to manipulate the email parameter in /admin/forget-password.php and execute arbitrary database queries. Public exploit code exists for this vulnerability and no patch is currently available. An attacker can leverage this to extract sensitive data or modify database contents with minimal complexity.

PHP SQLi Directory Management System
NVD GitHub VulDB
CVE-2026-2158
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in the Student Web Portal 1.0 /check_user.php endpoint allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. The vulnerability enables attackers to read, modify, or delete sensitive data with public exploit code readily available. This affects PHP-based installations of the Student Web Portal with no patch currently available.

PHP SQLi Student Web Portal
NVD GitHub VulDB
CVE-2026-2136
EPSS 0% CVSS 7.3
HIGH POC This Week

Online Food Ordering System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).

PHP SQLi Online Food Ordering System
NVD GitHub VulDB
CVE-2026-2134
EPSS 0% CVSS 4.7
MEDIUM POC This Month

PHPGurukul Hospital Management System 4.0 contains a SQL injection vulnerability in the doctor management interface that allows authenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with administrative credentials could potentially extract or modify sensitive hospital data.

PHP SQLi Hospital Management System
NVD GitHub VulDB
CVE-2026-2132
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in Online Music Site 1.0's AdminUpdateCategory.php allows unauthenticated remote attackers to manipulate the txtcat parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, with no patch currently available. The attack requires no user interaction and can compromise the confidentiality, integrity, and availability of the underlying database.

PHP SQLi Online Music Site
NVD GitHub VulDB
CVE-2026-2122
EPSS 0% CVSS 6.3
MEDIUM This Month

SQL injection in Xiaopi Panel's WAF Firewall component (up to version 20260126) allows authenticated remote attackers to manipulate the ID parameter in /demo.php and execute arbitrary SQL queries. Public exploit code is available and the vendor has not provided a patch despite early notification. This vulnerability requires valid credentials to exploit but enables attackers to access or modify sensitive database information.

PHP SQLi Panel
NVD GitHub VulDB
CVE-2026-2117
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Society Management System 1.0 allows unauthenticated remote attackers to manipulate the activity_id parameter in /admin/edit_activity.php, enabling data exfiltration, modification, or denial of service. Public exploit code exists for this vulnerability, and no patch is currently available.

PHP SQLi Society Management System
NVD GitHub VulDB
CVE-2026-2116
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Society Management System 1.0's expense editing functionality allows unauthenticated remote attackers to manipulate the expenses_id parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw enables attackers to access, modify, or delete sensitive financial data with minimal complexity.

PHP SQLi Society Management System
NVD GitHub VulDB
CVE-2026-2115
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Society Management System 1.0 allows unauthenticated remote attackers to manipulate the expenses_id parameter in /admin/delete_expenses.php, enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.

PHP SQLi Society Management System
NVD GitHub VulDB
CVE-2026-2114
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in itsourcecode Society Management System 1.0 through the admin_id parameter in /admin/edit_admin.php allows unauthenticated remote attackers to manipulate the database. Public exploit code exists for this vulnerability, and no patch is currently available, putting all installations at immediate risk of data compromise.

PHP SQLi Society Management System
NVD GitHub VulDB
CVE-2026-2090
EPSS 0% CVSS 7.3
HIGH This Week

Online Class Record System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).

PHP SQLi Online Class Record System
NVD GitHub VulDB
CVE-2026-2089
EPSS 0% CVSS 7.3
HIGH This Week

SourceCodester Online Class Record System 1.0 contains a SQL injection vulnerability in the subject controller that allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and could enable unauthorized data access, modification, or system compromise.

PHP SQLi Online Class Record System
NVD GitHub VulDB
CVE-2026-2088
EPSS 0% CVSS 7.3
HIGH POC This Week

SQL injection in PHPGurukul Beauty Parlour Management System 1.1 via the delid parameter in /admin/accepted-appointment.php enables remote attackers to manipulate database queries without authentication. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected systems at active risk.

PHP SQLi Beauty Parlour Management System
NVD GitHub VulDB
CVE-2026-2087
EPSS 0% CVSS 7.3
HIGH This Week

SQL injection in SourceCodester Online Class Record System 1.0 allows unauthenticated remote attackers to manipulate the user_email parameter in /admin/login.php, potentially enabling unauthorized data access and modification. Public exploit code exists for this vulnerability, and no patch is currently available.

PHP SQLi Online Class Record System
NVD GitHub VulDB
Prev Page 9 of 51 Next

Quick Facts

Typical Severity
HIGH
Category
web
Total CVEs
4530

Related CWEs

MITRE ATT&CK

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy