SQL Injection

SQL injection in the getComponentScalings function of MB connect line's mbCONNECT24/myREX24V2 remote-maintenance platforms (all variants at version 2.20.0 and earlier) lets a remote attacker manipulate a backend SQL SELECT statement to read arbitrary database contents, causing a total loss of confidentiality. The flaw was reported by CERT@VDE (advisory VDE-2026-044, EUVD-2026-32138) and the CVSS 4.0 vector indicates the attacker holds at least a low-privilege account (PR:L), although the description text confusingly also calls it 'unauthenticated.' No public exploit identified at time of analysis, and EPSS is very low at 0.03% (11th percentile), indicating no observed mass-exploitation interest.

SQL injection in the mbCONNECT24 industrial remote-access platform (and the sibling products myREX24V2, myREX24V2.virtual and mymbCONNECT24, all versions up to and including 2.20.0) lets a remote attacker abuse the getDeviceScalings function, where user input is concatenated into a SQL SELECT statement without proper neutralization (CWE-89). Successful injection yields a total loss of confidentiality, allowing extraction of arbitrary database contents, though integrity and availability are unaffected per the CVSS 4.0 vector (VC:H/VI:N/VA:N, score 7.1). There is no public exploit identified at time of analysis, and EPSS is very low at 0.03% (11th percentile).

Confidential data disclosure via SQL injection affects the mbCONNECT24 industrial remote-maintenance platform and its related variants (mymbCONNECT24, myREX24V2, myREX24V2.virtual) at versions up to and including 2.20.0. The flaw lives in the getProjectScalings function, where attacker-controlled input reaches a SQL SELECT statement, allowing extraction of arbitrary database contents and a total loss of confidentiality (CVSS 4.0 base 7.1, VC:H). The CVSS vector requires low-privilege access (PR:L), which conflicts with the description's claim of an 'unauthenticated' attack - a discrepancy defenders should resolve against the vendor advisory. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 11th percentile), with CISA SSVC rating exploitation as 'none'.

SQL injection in MB connect line's remote-maintenance platforms - mbCONNECT24, myREX24V2, myREX24V2.virtual and mymbCONNECT24 at versions up to and including 2.20.0 - lets a low-privileged remote attacker manipulate the SQL DELETE command in the 'inmessage' model to read the entire backend database and delete rows from a non-critical table. The flaw yields full confidentiality loss and partial integrity loss but no availability impact, and is rated CVSS 4.0 7.1. EPSS is very low (0.03%, 11th percentile), there is no public exploit identified at time of analysis, and it is not on CISA KEV.

SQL injection in the MB connect line mbCONNECT24 / myREX24 family of industrial remote-maintenance gateways (all listed editions through 2.20.0) lets a low-privileged remote user feed crafted input into a SQL SELECT statement assembled by the saveObjectFromData function, exposing the full backend database for reading. Reported by CERT@VDE (advisory VDE-2026-044, EUVD-2026-32134), the issue is a confidentiality-only impact (CVSS 4.0 base 7.1, VC:H/VI:N/VA:N). No public exploit code and no CISA KEV listing exist at this time, and EPSS is very low (0.03%, 11th percentile), indicating no observed mass exploitation.

SQL injection in the saveDashboardLayout function of dash_layout.php in MB connect line's mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual remote-access platforms (all versions up to and including 2.20.0) lets a low-privileged remote attacker manipulate a SQL INSERT statement to read the entire backend database and write rows into a non-critical table. The flaw, reported by CERT@VDE (VDE-2026-044, EUVD-2026-32133), yields total loss of confidentiality and partial loss of integrity but no availability impact. EPSS is very low (0.03%, 11th percentile) and there is no public exploit identified at time of analysis, so this is a serious data-exposure bug rather than a mass-exploitation threat.

SQL injection in the saveDashboardLayout function of dash.php affects the mbCONNECT24, myREX24V2, mymbCONNECT24, and myREX24V2.virtual industrial remote-maintenance platforms in versions up to and including 2.20.0. Because user-supplied input is improperly neutralized inside a SQL INSERT statement, a remote attacker can read the entire backend database and write rows into a non-critical table, yielding full loss of confidentiality and partial loss of integrity. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%, 11th percentile).

SQL injection in the getDevicegroups function of MB connect line / Red Lion industrial remote-access products (mbCONNECT24, myREX24V2 and their hosted mymbCONNECT24 / myREX24V2.virtual variants, all versions up to and including 2.20.0) lets a low-privileged remote user inject crafted input into a SQL SELECT statement and read arbitrary database contents, yielding a total loss of confidentiality (CVSS 4.0 base 7.1, VC:H, VI:N, VA:N). The issue was reported by CERT@VDE and published as advisory VDE-2026-044 / EUVD-2026-32161; no public exploit has been identified and EPSS is very low (0.03%, 11th percentile), indicating no observed widespread exploitation. Note a source discrepancy: the description labels the flaw 'unauthenticated' while the CVSS vector requires low privileges (PR:L) - this should be verified with the vendor.

Information disclosure via SQL injection affects the Easy View feature of MB connect line's remote-maintenance portals (mbCONNECT24, mymbCONNECT24, myREX24V2, and myREX24V2.virtual) in versions up to and including 2.20.0. A remote attacker holding a low-privileged account can inject crafted input into a SQL SELECT statement to read arbitrary database contents, resulting in total loss of confidentiality. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 11th percentile), indicating no observed widespread exploitation activity.

SQL injection in the UpdateParam function of admin.mbnetj.php in MB connect line's mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual remote-maintenance portals (versions up to and including 2.20.0) lets a high-privileged remote attacker tamper with a SQL UPDATE command, reading the entire database and modifying values in a non-critical table. The flaw was reported by CERT@VDE (advisory VDE-2026-044) and carries CVSS 4.0 base 7.0. There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and CISA SSVC rates exploitation as 'none' - indicating low immediate real-world urgency despite the high impact ceiling.

SQL injection in the UpdateParam function of view.html.php affects MB connect line remote-access portals (mbCONNECT24, myREX24V2, mymbCONNECT24, and myREX24V2.virtual) in versions up to and including 2.20.0, letting an attacker inject into a SQL UPDATE statement to read the entire backend database and alter values in a non-critical table. The CVSS 4.0 vector (PR:H) indicates a high-privileged account is required, even though the advisory text labels the flaw 'unauthenticated' - a discrepancy defenders should resolve with the vendor. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC rates exploitation as 'none'.

SQL injection in the DeleteSysLogEntry function of MB connect line / Helmholz remote-maintenance platforms - mbCONNECT24, myREX24V2, mymbCONNECT24 and the myREX24V2.virtual variant through version 2.20.0 - lets a network attacker with high privileges inject SQL into a DELETE statement, reading the entire backend database and deleting rows in a non-critical syslog table. The flaw yields full confidentiality loss and limited integrity impact (CVSS 4.0 base 7.0). There is no public exploit identified at time of analysis, EPSS is very low (0.03%, 10th percentile), and CISA SSVC rates exploitation as none, indicating no observed in-the-wild activity. Note the vendor description's 'unauthenticated' wording conflicts with the CVSS PR:H (high privileges required) metric.

SQL injection in the MB connect line remote-maintenance portals mbCONNECT24, myREX24V2, myREX24V2.virtual and mymbCONNECT24 (all versions up to and including 2.20.0) lets a high-privileged remote user manipulate a SQL DELETE statement in the _RemoveRequest function to read the entire backend database and delete rows in a non-critical table. The CVSS 4.0 vector (PR:H) indicates an authenticated, high-privilege account is required despite the description's wording, yielding total confidentiality loss and partial integrity loss. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and the issue is not listed in CISA KEV.

SQL injection in MB connect line's mbCONNECT24 / myREX24V2 remote-maintenance portals (all releases up to and including 2.20.0) lets an attacker break out of the SQL UPDATE statement bound to the 'devices' parameter in the accountstatus view, yielding full read access to the backend database and limited writes to a non-critical table. The CVSS 4.0 vector requires high privileges (PR:H), so a privileged authenticated user is the realistic threat actor — this directly contradicts the advisory text that labels the flaw 'unauthenticated,' a discrepancy defenders should resolve with the vendor. EPSS is very low (0.03%, 10th percentile) and there is no CISA KEV entry; no public exploit identified at time of analysis.

SQL injection in the mbCONNECT24 / myREX24V2 industrial remote-access platform (all editions through 2.20.0) lets a high-privileged remote attacker inject SQL through the userid parameter of the accountstatus view, which is concatenated unsafely into a SQL UPDATE statement. Successful exploitation yields read access to the entire backend database (total confidentiality loss) plus the ability to alter values in a non-critical table (partial integrity loss). There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and the EPSS probability is very low at 0.03% (10th percentile).

SQL injection in the DevSerialReset function of MB connect line / Helmholz industrial remote-access portals (mbCONNECT24, mymbCONNECT24, myREX24V2, and the .virtual variants) lets a high-privileged remote attacker read the entire backend database and modify values in a non-critical table. The flaw stems from improper neutralization of special elements within a SQL UPDATE statement (CWE-89), yielding total loss of confidentiality and partial integrity impact. There is no public exploit identified at time of analysis, and EPSS rates exploitation likelihood very low (0.03%, 10th percentile).

Unauthenticated SQL injection in the mbCONNECT24 remote-maintenance platform (and the related myREX24V2, myREX24V2.virtual, and mymbCONNECT24 portals) at version 2.20.0 and earlier lets a remote attacker inject crafted SQL into a SELECT statement processed by the 'sync_data24' task, yielding a total loss of database confidentiality (CVSS 4.0 base 8.7). Because the CVSS vector confirms no privileges and no user interaction (PR:N/UI:N), any network-reachable client can attempt it. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.05%, 15th percentile), so widespread automated exploitation is not currently indicated.

Unauthenticated SQL injection in the mbCONNECT24 remote-maintenance portal (and the related myREX24V2, myREX24V2.virtual and mymbCONNECT24 products, all versions up to and including 2.20.0) lets a remote attacker read arbitrary data from the backend database by abusing the _mb24confi_getDevice function. The flaw requires no credentials, no user interaction and low attack complexity over the network (CVSS 4.0 score 8.7), but its impact is confined to confidentiality. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.05%, 15th percentile), indicating no observed exploitation activity yet.

SQL injection in the mbCONNECT24 / myREX24V2 family of industrial remote-maintenance platforms (all editions at version 2.20.0 and earlier) lets unauthenticated remote attackers manipulate a SQL SELECT statement in the getAlarmProfiles function and read arbitrary database contents. The flaw (CWE-89) carries a CVSS 4.0 base score of 8.7 with a confidentiality-only impact and requires no authentication or user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.05%, 15th percentile), indicating no observed mass-exploitation pressure despite the high base score.

SQL injection in MB connect line's mbCONNECT24, mymbCONNECT24, and myREX24V2 remote-maintenance portals (all versions up to and including 2.20.0) lets an unauthenticated remote attacker inject crafted SQL through the _mb24confi_getTagAlarm function in mb24alarm.php, resulting in a total loss of database confidentiality. The CVSS 4.0 base score of 8.7 reflects network reach with no authentication or user interaction (AV:N/AC:L/PR:N/UI:N), but impact is scoped to confidentiality only (VC:H, VI:N, VA:N) - an attacker can read data but cannot directly alter or disrupt the system through this flaw. No public exploit identified at time of analysis, and the EPSS score is very low (0.05%, 15th percentile), indicating no observed broad exploitation activity despite the high base score.

Unauthenticated SQL injection in the mbCONNECT24/myREX24 industrial remote-maintenance platform (all variants up to and including 2.20.0) lets remote attackers extract database contents through the _mb24api_getUserAccount API function via a crafted SQL SELECT command (CWE-89). The CVSS 4.0 score of 8.7 reflects a confidentiality-only impact (VC:H, VI:N, VA:N) reachable over the network with no authentication and no user interaction. No public exploit has been identified at time of analysis and EPSS rates exploitation probability very low (0.05%, 15th percentile), but the no-auth, network-reachable design makes credential and account-data theft a credible concern.

SQL injection in MB connect line's mbCONNECT24 remote-maintenance platform (and the related myREX24V2, mymbCONNECT24 and myREX24V2.virtual products through version 2.20.0) lets unauthenticated remote attackers read arbitrary database contents. The flaw lives in the _mb24confi_getTagAlarm function of dataapi.php, where attacker-controlled input is concatenated into a SQL SELECT statement, yielding a total loss of confidentiality. There is no public exploit identified at time of analysis, the EPSS probability is very low (0.05%), and the issue is not on CISA KEV; it was reported by CERT@VDE (advisory VDE-2026-044).

SQL injection in the mbCONNECT24 / myREX24V2 industrial remote-maintenance platforms (versions up to and including 2.20.0) lets a remote, unauthenticated attacker read arbitrary database contents by manipulating the tagid parameter of the getLiveValues function. The CVSS 4.0 base score is 8.7 with a confidentiality-only impact (VC:H, VI:N, VA:N), and no public exploit has been identified at the time of analysis. EPSS is very low (0.05%, 15th percentile), and the issue is not in CISA KEV, so widespread automated exploitation is not currently indicated despite the network-reachable, no-auth attack surface.

Unauthenticated SQL injection in MB connect line's mbCONNECT24 and myREX24V2 industrial remote-maintenance portals (all editions through 2.20.0) lets remote attackers inject SQL through the 'sn' parameter of the getLiveValues function, producing a total loss of confidentiality. Disclosed via CERT@VDE advisory VDE-2026-044 and tracked as EUVD-2026-32112, the flaw carries a CVSS 4.0 base score of 8.7 and requires no authentication or user interaction, though it has no integrity or availability impact. No public exploit is identified at time of analysis and EPSS rates near-term exploitation probability low at 0.05% (15th percentile).

Unauthenticated SQL injection in the mbCONNECT24 / myREX24V2 industrial remote-maintenance platforms (all variants at versions ≤2.20.0) lets a remote attacker inject crafted input into a SQL SELECT statement handled by the ssoabstractservice (single sign-on) component, yielding read access to backend database contents and a total loss of confidentiality. The flaw requires no authentication, no privileges, and no user interaction over the network. No public exploit has been identified at time of analysis, and the EPSS score is very low (0.05%, 15th percentile), but the issue affects internet-exposed OT remote-access portals, raising its practical exposure.

SQL injection in the MB connect line / Red Lion remote-maintenance platform (mbCONNECT24, mymbCONNECT24, myREX24V2 and myREX24V2.virtual, all versions up to and including 2.20.0) lets a remote, unauthenticated attacker inject crafted SQL into the userinfo endpoint, resulting in total loss of confidentiality of the backing database. The flaw was reported by CERT@VDE (advisory VDE-2026-044) and tracked in the ENISA EUVD as EUVD-2026-32110. There is no public exploit identified at time of analysis and EPSS is very low (0.05%), but the CVSS 4.0 base score is 8.7 and CISA's SSVC framework rates the issue as automatable.

SQL injection in dotCMS Core (versions 25.11.04-1 through 26.04.28-02) lets remote unauthenticated attackers read, modify, or destroy arbitrary database content through the Publish Audit API endpoints /api/auditPublishing/get and /api/auditPublishing/getAll, which neither enforced authentication nor sanitized input before constructing SQL. The flaw carries a maximum CVSS 4.0 base score of 10.0, reflecting full confidentiality, integrity, and availability impact extending to subsequent systems. No public exploit was identified at time of analysis and EPSS is low (0.38%, 60th percentile), but the network-reachable, no-privilege, no-interaction profile makes this an urgent patch for affected (non-LTS) deployments.

SQL injection in Pimcore's admin-ui-classic-bundle (versions <= 2.3.5) allows an authenticated user holding only the translations-view permission to read arbitrary database contents by injecting into the translation grid's date filter. The user-controlled 'property' field of the filter JSON is interpolated directly into a UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...))) expression at the POST /admin/translation/translations endpoint, behind only a trivially bypassable str_replace('--','') filter. A working proof-of-concept and publicly available exploit code exist; the reporter notes it can be chained with an unsafe-unserialize flaw (GM-249) to reach remote code execution. No EPSS score or CISA KEV listing was supplied.

SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config permission inject arbitrary SQL through the custom-report column-config endpoint, which concatenates user-supplied 'sql', 'from', and 'where' fields directly into a query executed via Doctrine's fetchAssociative(). Because the controller returns raw database error messages in its JSON response, attackers can perform error-based extraction (e.g. EXTRACTVALUE) to read credentials and arbitrary tables, and can bypass the keyword denylist using inline /**/ comments to reach UPDATE/INSERT/DELETE - compromising confidentiality and integrity. Publicly available exploit code exists (a full PoC is published in the GitHub advisory); no CISA KEV listing or EPSS score is present in the provided data.

SQL injection in Chatwoot versions 2.2.0 through 4.11.1 allows any authenticated account user to execute arbitrary SQL via time-based blind injection by abusing unparameterized values in custom-attribute filter operators on the conversation, contact, and custom attribute definition APIs. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.03%, 8th percentile), but CVSS 8.5 with scope-changed confidentiality impact reflects the ability to read data beyond the attacker's account boundary. The vulnerability is fixed in Chatwoot 4.11.2.

Remote code execution in Twenty CRM versions 1.7.7 through 1.16.7 allows authenticated users to execute arbitrary OS commands on the database server by chaining SQL injection in the REST API groupBy endpoint with PostgreSQL's COPY TO PROGRAM functionality. The unsanitized timeZone parameter is interpolated directly into raw SQL via JavaScript template literals, and exploitation succeeds whenever the application's Postgres role holds superuser privileges. Publicly available exploit code exists per SSVC, though EPSS scoring (0.15%) suggests exploitation activity has not yet become widespread.

Authenticated SQL injection in OpenKM Community Edition (≤6.3.12) and Professional Edition (≤7.1.47) lets administrative users execute arbitrary SQL against the application database through the /admin/DatabaseQuery endpoint's qs parameter. Publicly available exploit code exists (Exploit-DB 52520 and a Nuclei template from Terra System Labs), enabling dumping of password hashes from OKM_USER, permission tampering, and data destruction. EPSS is very low (0.03%) and the bug requires high privileges (PR:H), so real-world risk is bounded but meaningful for any internet-facing OpenKM instance with weak admin credentials.

Blind SQL injection in the eMagicOne Store Manager WordPress plugin (versions up to and including 1.3.2) allows remote unauthenticated attackers to inject malicious SQL through improperly sanitized parameters. With a CVSS 9.3 score and changed scope, successful exploitation can expose confidential database contents across the WordPress installation, though EPSS remains very low (0.03%) and no public exploit identified at time of analysis.

SQL injection in Crocoblock JetEngine (a WordPress plugin) through version 3.8.8.1 allows remote unauthenticated attackers to inject crafted SQL into backend queries, leading to high-impact confidentiality disclosure and limited availability impact with a scope change to other components. The flaw carries a CVSS 9.3 rating and was disclosed by Patchstack, but there is no public exploit identified at time of analysis and EPSS is very low at 0.03%.

Blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (versions up to and including 2.0.8) allows authenticated low-privilege attackers to inject arbitrary SQL into backend database queries. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 8.5 due to scope change and high confidentiality impact, though no public exploit identified at time of analysis and EPSS probability remains low at 0.03%. The scope change (S:C) indicates the injection crosses a trust boundary, amplifying impact beyond the vulnerable component.

Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to bypass input sanitization through a preg_replace() backslash escape flaw and inject arbitrary SQL against the backing database. Versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1 are affected. Vendor patches are available, no public exploit identified at time of analysis, and EPSS is low (0.08%), but SSVC rates technical impact as total.

Authenticated SQL injection in Best Practical's Request Tracker (RT) ticketing system affects versions 5.0.0-5.0.9 and 6.0.0-6.0.2 via the entry_aggregator parameter in the JSON search endpoint, allowing any logged-in RT user to read or modify arbitrary data in the underlying database. The flaw was disclosed alongside the rt-5.0.10/6.0.3 release on 2026-05-20 and carries CVSS 8.8 due to high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Unauthenticated SQL injection in YesWiki's Bazar form-import path allows any remote visitor to inject arbitrary SQL into an INSERT statement and exfiltrate the entire database, including yeswiki_users.password hashes. Affects YesWiki 4.6.1, 4.6.2, and the doryphore-dev branch prior to 4.6.4. Publicly available exploit code exists (a working Python PoC is published in the GHSA advisory), though no public exploit identified in CISA KEV at time of analysis.

SQL injection in STER (Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy) versions prior to 9.5 allows authenticated attackers to extract sensitive data by injecting crafted input into multiple Search Filter parameters. The CVSS 4.0 score of 8.7 reflects high confidentiality and integrity impact over the network with low attacker privileges required, and a vendor patch is available in version 9.5. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Unauthenticated SQL injection in the WP ERP Pro WordPress plugin (versions through 1.5.1) allows remote attackers to extract sensitive database contents by manipulating the 'search_key' parameter. The flaw stems from missing input escaping and unprepared SQL statements, enabling UNION-based or appended query attacks against any WordPress site running the affected plugin. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

SQL injection in Open ISES Tickets before 3.44.2 lets authenticated users tamper with backend database queries through the ajax/statistics.php endpoint by injecting payloads into the tick_id and f_tick_id POST parameters. The CVSS 4.0 score of 7.1 reflects high confidentiality impact with lower integrity impact, and while no public exploit is identified at time of analysis, this flaw is one of 19 SQL injection issues bundled into a single critical security release that the vendor urges all users to install immediately.

SQL injection in Open ISES Tickets before 3.44.2 lets authenticated users tamper with the incidents summary report query via the tick_id POST parameter in ajax/reports.php, enabling arbitrary read, modification, or destruction of database contents. The v3.44.2 release notes confirm the fix was part of a broader security overhaul addressing 19 SQL injection flaws and 69 XSS issues. No public exploit identified at time of analysis, and SSVC classifies exploitation status as 'none' with partial technical impact.

SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate database queries via the unsanitized `id` GET parameter in `ajax/mobile_main.php`. The flaw permits arbitrary read, modification, or destruction of database contents, and is part of a broader batch of 19 SQL injection fixes shipped in v3.44.2. No public exploit identified at time of analysis, but the vendor explicitly classifies v3.44.2 as a 'Critical Security Update' urging immediate upgrade.

SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate backend database queries via the message.php endpoint, enabling unauthorized read, modification, or destruction of database contents. The flaw stems from unsanitized concatenation of the frm_ticket_id and frm_resp_id POST parameters into SELECT and UPDATE statements. No public exploit identified at time of analysis, though VulnCheck has published a dedicated advisory and the vendor's 3.44.2 release bundles fixes for 19 SQL injection issues across the codebase.

SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate database queries via unsanitized POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) in db_loader.php, enabling read, modification, or destruction of database contents. The vendor confirms this is one of 19 SQL injection flaws patched in v3.44.2, reported by VulnCheck. No public exploit identified at time of analysis, and the vulnerability requires low-privilege authentication (PR:L per CVSS 4.0 vector).

SQL injection in Open ISES Tickets before 3.44.2 allows attackers controlling or impersonating an InstaMapper or Google Latitude GPS tracking endpoint to inject malicious SQL via unsanitized latitude, longitude, callsign, mph, altitude, and timestamp values parsed by incs/remotes.inc.php. The CVSS 4.0 base score of 8.8 reflects unauthenticated network exploitation with high confidentiality impact, and no public exploit is identified at time of analysis. The flaw was disclosed by VulnCheck and is one of 19 SQL injection issues patched in the v3.44.2 release.

SQL injection in Open ISES Tickets versions prior to 3.44.2 allows authenticated attackers to manipulate ORDER BY clauses via the sort and dir GET parameters in portal/ajax/list_requests.php, enabling unauthorized read, modification, or destruction of database contents. The CVSS 4.0 score of 7.1 reflects network-reachable exploitation with low privileges and no user interaction required. No public exploit identified at time of analysis, but the vendor's own release notes describe this as part of a critical security update patching 19 SQL injection flaws across 11 files.

SQL injection in Open ISES Tickets prior to 3.44.2 allows authenticated attackers to manipulate database queries via the unsanitized 'offset' GET parameter in ajax/sit_incidents.php, which is concatenated directly into a LIMIT clause. Successful exploitation enables reading, modifying, or destroying database contents. No public exploit identified at time of analysis, though the underlying flaw is one of 19 SQL injection issues patched in the same release, indicating broad code-level weakness.

SQL injection in Open ISES Tickets versions prior to 3.44.2 allows authenticated attackers to manipulate database queries through the unsanitized offset parameter in ajax/fullsit_incidents.php. The flaw enables reading, modifying, or destroying database contents and is part of a broader v3.44.2 security release that patched 19 SQL injection issues. No public exploit identified at time of analysis, but the vendor classifies the update as critical and urges immediate upgrade.

SQL injection in Open ISES Tickets prior to 3.44.2 lets authenticated users tamper with database contents by abusing unsanitized POST parameters (tablename, indexname, sortby) in tables.php that are concatenated directly into SELECT, UPDATE, and DELETE identifier positions. The flaw is one of 19 SQLi issues fixed in the v3.44.2 release; no public exploit identified at time of analysis, but the vendor labels the release a Critical Security Update and urges immediate upgrade.

Blind SQL injection in the WP Directory Kit WordPress plugin (versions up to and including 1.5.0) allows remote unauthenticated attackers to inject SQL commands through improperly neutralized input. With a CVSS 9.3 (scope-changed) rating from Patchstack, successful exploitation can expose sensitive database contents and partially impact availability across the WordPress installation. No public exploit identified at time of analysis and the plugin is not currently listed in CISA KEV.

SQL injection in Netatalk 3.1.0 through 4.4.2 allows authenticated remote attackers to compromise the MySQL-backed CNID (Catalog Node ID) database used to track AppleTalk/AFP file metadata. The high CVSS 8.8 score (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) reflects network-reachable exploitation with low privileges and high impact to confidentiality, integrity, and availability; no public exploit identified at time of analysis.

SQL injection in Drupal core (versions 8.9.0 through the fixed 10.4.10/10.5.10/10.6.9 and 11.x branches through 11.3.10) allows attackers to inject arbitrary SQL against the site database, per SA-CORE-2026-004. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code (Exploit-DB 52608 and multiple public PoCs), and the CVSS 9.8 vector indicates unauthenticated remote exploitation. Notably, EPSS remains extremely low (0.01%) and SSVC lists exploitation as 'none', signaling either targeted rather than widespread activity or conflicting source data that defenders should treat cautiously while still prioritizing the patch given KEV status.

Blind SQL injection in YITH WooCommerce Product Add-Ons (WordPress plugin) through version 4.29.0 allows high-privileged authenticated users to inject malicious SQL into database queries, leading to confidentiality compromise and limited availability impact across a changed security scope. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.6; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

SQL injection in SureCart WordPress plugin versions prior to 4.2.1 allows authenticated high-privileged attackers to extract arbitrary database contents via the /surecart/v1/integrations/{id} REST endpoint. The flaw stems from a sanitization bypass in the wp-query-builder component where payloads containing a dot character skip $wpdb->prepare() escaping entirely, enabling UNION-based data exfiltration. No public exploit identified at time of analysis, though Tenable Research has published technical details (TRA-2026-43).

Authenticated SQL injection in NextGEN Gallery (WordPress plugin by Awesome Motive/Imagely) before version 4.2.1 allows attackers holding the 'NextGEN Gallery overview' capability - granted to Administrators by default - to inject arbitrary SQL via the 'orderby' parameter on the '/imagely/v1/galleries' and '/imagely/v1/albums' REST endpoints. CVSS 4.0 rates this 9.3 due to high confidentiality, integrity, and scope impact; no public exploit identified at time of analysis, but the issue was reported by Tenable Research (TRA-2026-42) and a vendor patch is available.

SQL injection in TONNET's E-LAN Hybrid Recording System allows unauthenticated remote attackers to execute arbitrary SQL queries and exfiltrate database contents over the network. The CVSS 4.0 score of 8.7 reflects high confidentiality impact with no required privileges or user interaction, and no public exploit identified at time of analysis. The flaw is reported through TWCERT and affects TONNET's TPR7308 product line per CPE data.

Unauthenticated SQL injection in the PixelYourSite Boost plugin for WordPress (versions up to and including 2.0.3) allows remote attackers to extract sensitive database contents via time-based blind SQLi in the 'current_url' and 'user_name' parameters. Wordfence reported the issue with a CVSS 7.5 (confidentiality-only impact); no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Unauthenticated SQL injection in the Creative Mail - Easier WordPress & WooCommerce Email Marketing plugin (versions up to and including 1.6.9) allows remote attackers to append arbitrary SQL clauses through the 'checkout_uuid' parameter handled by the has_checkout_consent() method. The flaw stems from missing escaping and the absence of a prepared statement, enabling extraction of sensitive database contents from any WordPress site running the vulnerable plugin. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

SQL injection in the Contest Gallery WordPress plugin (versions through 28.1.6) allows unauthenticated remote attackers to extract sensitive database contents by abusing the 'form_input' parameter handled by the 'post_cg_gallery_form_upload' AJAX action. The endpoint is gated only by a public nonce that is exposed in the page source of any public gallery page, effectively offering no protection against external attackers. No public exploit identified at time of analysis, but the issue was disclosed by Wordfence and affects a publicly reachable PHP endpoint.

SQL injection in the TYPO3 'address_list' extension's AddressRepository::getSqlQuery() method allows remote attackers to manipulate database queries when the method is called with untrusted input. The flaw is latent - the vulnerable method is not invoked anywhere within the extension itself, so default installations are not exposed, but custom or third-party extensions that reuse this method become injection sinks. No public exploit identified at time of analysis, and no EPSS or KEV signal accompanies the advisory.

SQL injection in the TYPO3 'news' extension allows unauthenticated remote attackers to inject arbitrary SQL through a URL parameter on pages that render the 'Date Menu of news articles' plugin. The flaw stems from missing sanitization of user input before it reaches a database query, and exposure is limited to sites that both use the affected plugin and have not enabled the TypoScript/plugin setting disableOverrideDemand. No public exploit identified at time of analysis.

SQL injection in BillaBear (all versions prior to January 2026) allows authenticated users holding the ROLE_ACCOUNT_MANAGER role to execute arbitrary SQL commands via the EventRepository component. The flaw stems from unsanitized filter identifier keys being concatenated into queries through sprintf(), and while no public exploit identified at time of analysis is listed in KEV, two CVE-referenced gists suggest detailed technical write-ups are publicly available. EPSS is very low (0.01%), but the high CVSS of 8.8 and clear exploitation path make this a meaningful risk for any deployed instance.

SQL injection in SOGo 5.12.7 (Alinto's open-source groupware/webmail platform) allows authenticated users to exfiltrate arbitrary database contents by injecting subqueries through the uid parameter of the addUserInAcls endpoint, then reading the staged data back via the /acls API. The flaw, reported by VulnCheck (with credit to dninh of SACOMBANK), is fixed in 5.12.8; no public exploit identified at time of analysis and the CVE is not on CISA KEV.

SQL injection in the WP Photo Album Plus WordPress plugin before 9.1.11.001 allows unauthenticated attackers to inject arbitrary SQL through an improperly sanitized parameter, exposing backend database contents such as user credentials and hashed passwords. The CVSS vector (PR:N, S:C, C:H) indicates no authentication is required and that a successful attack reaches data beyond the plugin's own scope. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, though the EPSS score is very low at 0.04% (14th percentile).

SQL injection in Vvveb CMS versions before 1.0.8.3 allows authenticated frontend users to execute arbitrary SQL queries through the order history page. The vulnerability exists in the /user/orders endpoint where order_by and direction parameters are directly concatenated into SQL queries without sanitization, enabling database compromise with low-privileged user credentials. The vendor has released version 1.0.8.3 to address this issue.

Unauthenticated SQL injection in phpMyFAQ before 4.1.2 allows remote attackers to extract credentials, admin tokens, and SMTP secrets by sending a crafted User-Agent header to the public GET /api/captcha endpoint. The flaw sits in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha(), which interpolate the header into DELETE and INSERT statements via sprintf with no escaping. No public exploit identified at time of analysis, though VulnCheck has published a detailed reachability writeup and a verified time-based blind PoC payload appears in the GHSA advisory.

SQL injection in phpMyFAQ prior to 4.1.2 allows attackers authenticating through Azure AD/Entra ID OAuth to execute arbitrary database queries by embedding SQL metacharacters in their identity provider display name or JWT claims. The CurrentUser::setTokenData() method interpolates OAuth token fields into an UPDATE statement via sprintf without calling the database escape routine, while sibling methods in the same file correctly escape input. Publicly available exploit code exists per VulnCheck and the GHSA advisory, though EPSS is low (0.03%, 9th percentile) and the issue is not in CISA KEV.

SQL injection in ClipBucket v5's admin panel allows authenticated administrators to exfiltrate database contents via the action_logs.php endpoint. The type parameter is directly concatenated into SQL queries without parameterization, enabling UNION-based attacks to extract sensitive data including user credentials, video metadata, and system configuration. Affects all versions prior to 5.5.3 - #122. No active exploitation confirmed (not in CISA KEV), but the technical barrier is low given the straightforward injection point and admin access requirement.

SQL injection in Marten's PostgreSQL full-text search APIs allows remote unauthenticated attackers to execute arbitrary database commands when applications pass user-controlled input to the regConfig parameter. The vulnerability affects all five search method overloads (SearchAsync, PlainTextSearchAsync, PhraseSearchAsync, WebStyleSearchAsync, PrefixSearchAsync) where the regConfig parameter is interpolated directly into SQL without validation. Confirmed exploit payloads demonstrate time-based blind extraction, information disclosure via SELECT statements, and DDL execution including table drops. Vendor-released patch available in Marten 8.37.0 via GitHub PR #4343. No public exploit identified at time of analysis, though the advisory includes working proof-of-concept payloads for all affected methods.

SQL injection in n8n workflow automation platform allows an attacker with write access to a connected git repository to execute arbitrary SQL against the internal PostgreSQL database when an administrator performs a Source Control Pull. The flaw stems from unsafe handling of column names within Data Table JSON files imported during sync. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.04%.

Stack buffer overflow in PostgreSQL's refint module allows low-privileged database users to execute arbitrary code as the database operating system user across all supported versions before 14.23, 15.18, 16.14, 17.10, and 18.4. The vulnerability enables two distinct attack paths: direct stack overflow leading to OS-level code execution, and SQL injection when applications expose user-controlled columns configured as refint cascade primary keys. With CVSS 8.8 (AV:N/AC:L/PR:L) and network-based exploitation requiring only low-privilege database credentials, this represents a critical privilege escalation risk for PostgreSQL deployments. No active exploitation (CISA KEV) or public POC identified at time of analysis.

SQL injection in PostgreSQL's pg_createsubscriber utility escalates privileges from pg_create_subscription to superuser, enabling arbitrary SQL execution. Affects PostgreSQL versions 17.0-17.9 and 18.0-18.3; exploitation requires high-privilege access (pg_create_subscription rights) but occurs remotely without additional complexity. Attack triggers when pg_createsubscriber next executes. Fixed in PostgreSQL 18.4 and 17.10. No CISA KEV listing or public exploit identified at time of analysis, but the technical simplicity (AC:L) and privilege escalation nature present moderate risk for multi-tenant or hosted PostgreSQL environments where subscription management permissions are delegated.

SQL injection in SOGo versions prior to 5.12.7 allows authenticated users to inject arbitrary SQL when changing their password, provided the deployment uses PostgreSQL or MariaDB as the user backend and stores cleartext passwords. The flaw resides in the changePasswordForLogin routine where the new password value is interpolated directly into an UPDATE statement (c_password = '%@'). No public exploit identified at time of analysis, EPSS is very low (0.03%), and SSVC marks exploitation as 'none' - but the patched upstream code (PR #379, fixed in 5.12.7) confirms the vulnerability.

SQL injection in Alinto SOGo versions prior to 5.12.7 allows authenticated remote attackers to manipulate database queries when the groupware is deployed against a PostgreSQL backend. The flaw stems from improper quoting in the SQLSource authentication and contact-lookup paths, which an attacker can leverage to read or modify data with high confidentiality and integrity impact. No public exploit identified at time of analysis and EPSS is very low (0.03%), but a vendor patch and upstream code fix are available.

SQL injection in the cPanel/WHM sqloptimizer utility script allows attackers to execute arbitrary SQL queries as the MySQL root user when Slow Query logging is enabled. The flaw affects multiple cPanel branches (11.86 through 11.136), WP Squared, and the CloudLinux 6/CentOS 6 builds, with no public exploit identified at time of analysis. EPSS is low (0.03%) and SSVC marks exploitation as 'none', but technical impact is rated total because the injection runs with full database privileges.

SQL injection in ERPNext versions prior to 16.9.0 allows authenticated remote attackers to extract sensitive data by sending specially crafted requests to vulnerable endpoints. The Frappe-maintained ERP platform requires low-privileged authentication (PR:L) but has high impact on confidentiality, integrity, and availability per CVSS 8.8. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%).

SQL injection in ERPNext (Frappe's open-source ERP platform) prior to 15.104.3 and 16.14.0 allows authenticated remote attackers to extract sensitive database contents by sending crafted requests to vulnerable endpoints. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though EPSS sits at 0.04% and SSVC reports no observed exploitation, indicating this is a high-severity but currently unexploited issue. No public exploit identified at time of analysis.

SQL injection in EcclesiaCRM 8.0.0 and earlier allows authenticated remote attackers to execute arbitrary SQL queries through the query view feature. The flaw stems from an incomplete fix for CVE-2026-35184: the ValidateInput() function's default case passes user-supplied POST parameters directly into str_replace-based SQL construction without sanitization when non-standard validation types are used. No public exploit identified at time of analysis, and EPSS rates exploitation likelihood at just 0.03%.

SQL injection in MISP threat intelligence platform versions prior to 2.5.37 allows remote unauthenticated attackers to manipulate ORDER BY clauses in event and shadow attribute listing endpoints by supplying crafted ordering parameters. The CVSS 4.0 score of 9.3 reflects high impact across confidentiality, integrity, and availability, though EPSS exploitation probability sits at just 0.04% and no public exploit identified at time of analysis. Given MISP's role as a repository of sensitive threat-intelligence data shared between organizations, successful exploitation could expose IOCs, attribution data, and partner-shared intelligence.

Authenticated SQL injection in CubeCart v6.x prior to 6.6.0 allows administrative users to execute arbitrary SQL commands through unsanitized sorting parameters on Products and Logs endpoints. Per SSVC, a proof-of-concept exists but the vulnerability is not in CISA KEV, and EPSS scoring (0.03%) reflects very low predicted exploitation activity due to the high-privilege prerequisite.

Database query injection in Strapi's Content-Type Builder write API allows an authenticated administrator to execute arbitrary SQL statements through the `column.defaultTo` attribute. This can lead to file read, denial of service, or remote code execution on the database server, depending on the database engine. No active exploitation or public exploit code has been reported at the time of analysis; patched versions are available.

Time-based SQL injection in Avada Builder for WordPress allows remote unauthenticated attackers to extract sensitive database information via the 'product_order' parameter. CVSS 7.5 (High) reflects network-accessible attack vector with no authentication required, but exploitation is limited to specific deployments where WooCommerce was previously installed then deactivated. No active exploitation confirmed (not in CISA KEV), but vulnerability disclosed by Wordfence Threat Intelligence with technical details publicly available.

Time-based blind SQL injection in JoomSport WordPress plugin (all versions ≤5.7.7) enables unauthenticated remote attackers to extract sensitive database contents including credentials, user data, and configuration secrets via the unsanitized 'sortf' parameter. CVSS 7.5 (High) with network attack vector, low complexity, and no authentication required. EPSS data not provided; no CISA KEV listing indicates exploitation not yet confirmed in the wild. Wordfence Threat Intel reported this vulnerability with proof-of-concept code references pointing to specific vulnerable functions in class-jsport-getplayers.php and class-jsport-playerlist.php, enabling straightforward exploitation by security researchers and threat actors alike.

SQL injection in multiple Advantech industrial IoT platforms allows remote authenticated attackers with high privileges to execute arbitrary database commands. Affected products include WebAccess/SCADA, SaaS Composer, IoTSuite Growth/Starter, and IoT Edge across Windows and Linux Docker deployments. The vulnerability enables complete database compromise - attackers can read sensitive industrial control system data, modify configurations, or delete critical operational information. CVSS 7.2 reflects high impact across confidentiality, integrity, and availability, though exploitation requires administrative credentials (PR:H), significantly limiting attack surface compared to unauthenticated SQL injection vulnerabilities.

SQL injection in the Court Reservation - Manage Your Court Bookings Online WordPress plugin (versions ≤ 1.10.11) lets unauthenticated attackers inject arbitrary SQL through the 'id' parameter, enabling extraction of sensitive database contents such as user credentials and booking data. The flaw stems from an unescaped, unprepared query and is network-reachable with no authentication or user interaction. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), but SSVC flags exploitation as automatable with partial technical impact.

SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into backend database queries reachable through the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS of the wireless controller/gateway. Multiple 8.10.x, 8.12.x, 8.13.x, 10.4.x, 10.7.x and 10.8.0.0 releases are affected. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), consistent with the SSVC 'Exploitation: none' finding.

Arbitrary OS command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) is achievable when an administratively-privileged operator injects crafted input into CLI and management-protocol parameters that reach backend database queries unsanitized. Multiple underlying service components are affected across the WLAN controller/gateway software family, and successful exploitation escalates from SQL injection to full command execution on the host OS. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 8th percentile), and CISA SSVC rates exploitation as none but technical impact as total.

SQL injection in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) lets an authenticated administrator inject crafted input into unsanitized parameters within several backend service components reached via the CLI and management protocol, ultimately achieving arbitrary command execution on the underlying OS. It affects a broad range of AOS 8.10 through 8.13 and 10.4 through 10.8 releases and carries a CVSS 7.2 (High) rating. There is no public exploit identified at time of analysis, and EPSS is very low at 0.03%.

Command execution in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows an authenticated administrator to inject SQL into several backend service components reachable via the CLI and management protocol, ultimately running arbitrary OS-level commands. The flaw affects multiple 8.x and 10.x AOS branches and carries CVSS 7.2; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 8th percentile). CISA's SSVC framework rates exploitation as none but technical impact as total, reflecting high potential damage if the high-privilege prerequisite is met.