SQL Injection

CWE-89 · 35 records · 13 with a public proof-of-concept

Records the NVD classes as SQL Injection (CWE-89), highest CVSS first.

  1. CRITICAL 9.8CVE-2026-71248public PoC

    Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication byp

    AI risk analysis on Exploit-DB.ai →

  2. CRITICAL 9.8CVE-2026-71237public PoC

    Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An u

    AI risk analysis on Exploit-DB.ai →

  3. CRITICAL 9.8CVE-2026-71231public PoC

    IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding wi

    AI risk analysis on Exploit-DB.ai →

  4. CRITICAL 9.8CVE-2026-71207public PoC

    The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script

    AI risk analysis on Exploit-DB.ai →

  5. CRITICAL 9.1CVE-2026-15360

    The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to perform time-based blind SQL injection and extract sensitive data from the database.

    AI risk analysis on Exploit-DB.ai →

  6. HIGH 8.8CVE-2026-71288public PoC

    Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bo

    AI risk analysis on Exploit-DB.ai →

  7. HIGH 8.8CVE-2026-71287public PoC

    Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column),

    AI risk analysis on Exploit-DB.ai →

  8. HIGH 8.8CVE-2026-70373

    Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel param

    AI risk analysis on Exploit-DB.ai →

  9. HIGH 8.8CVE-2026-70372

    Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read

    AI risk analysis on Exploit-DB.ai →

  10. HIGH 8.8CVE-2026-70371

    Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in ident

    AI risk analysis on Exploit-DB.ai →

  11. HIGH 8.8CVE-2026-70370

    Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.

    AI risk analysis on Exploit-DB.ai →

  12. HIGH 8.8CVE-2026-70369

    Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, item

    AI risk analysis on Exploit-DB.ai →

  13. HIGH 7.5CVE-2026-18881

    The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to blind SQL Injection via the `filter_data[comment_count]` parameter of the public `tableon_get_table_data` AJAX action in all versions up to, and including, 1.0.5.1. This is du

    AI risk analysis on Exploit-DB.ai →

  14. HIGH 7.5CVE-2026-15918

    VikAppointments Service Booking Calendar wordpress plugin is vulnerable to unauthenticated SQL injection due to one of the parameters that controls how the public reviews list is sorted is taken from the incoming request and used to build a database query with

    AI risk analysis on Exploit-DB.ai →

  15. HIGH 7.3CVE-2026-18859

    A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit

    AI risk analysis on Exploit-DB.ai →

  16. HIGH 7.3CVE-2026-18854

    A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads t

    AI risk analysis on Exploit-DB.ai →

  17. HIGH 7.2CVE-2026-71292public PoC

    Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not pr

    AI risk analysis on Exploit-DB.ai →

  18. HIGH 7.1CVE-2026-71276public PoC

    Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/m

    AI risk analysis on Exploit-DB.ai →

  19. HIGH 7.1CVE-2026-71245public PoC

    Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), a

    AI risk analysis on Exploit-DB.ai →

  20. MEDIUM 6.8CVE-2026-14872

    The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is

    AI risk analysis on Exploit-DB.ai →

  21. MEDIUM 6.5CVE-2026-71282public PoC

    ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-boun

    AI risk analysis on Exploit-DB.ai →

  22. MEDIUM 6.5CVE-2026-15281

    The User Access Manager plugin for WordPress is vulnerable to Second-Order SQL Injection via the 'id' parameter of the wp_ajax_save-attachment-compat AJAX action in versions up to, and including, 2.3.12. This is due to insufficient validation on the objectId v

    AI risk analysis on Exploit-DB.ai →

  23. MEDIUM 6.5CVE-2026-11977

    The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping

    AI risk analysis on Exploit-DB.ai →

  24. MEDIUM 6.5CVE-2026-49004

    The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the

    AI risk analysis on Exploit-DB.ai →

  25. MEDIUM 6.5CVE-2026-15941

    The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-cont

    AI risk analysis on Exploit-DB.ai →

  26. MEDIUM 6.5CVE-2026-11421

    The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied pa

    AI risk analysis on Exploit-DB.ai →

  27. MEDIUM 6.5CVE-2026-69704public PoC

    Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp() deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GE

    AI risk analysis on Exploit-DB.ai →

  28. MEDIUM 6.3CVE-2026-18896public PoC

    A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to lau

    AI risk analysis on Exploit-DB.ai →

  29. MEDIUM 6.3CVE-2026-18766public PoC

    A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php. Executing a manipulation of the a

    AI risk analysis on Exploit-DB.ai →

  30. MEDIUM 4.9CVE-2026-5651

    The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (askeet_execute_sql_query, askeet_export_all_results) in all versions up to, and including, 3.0. This is due to the askeet_is_safe_query() fil

    AI risk analysis on Exploit-DB.ai →

  31. MEDIUM 4.9CVE-2026-11969

    The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs[]' Parameter in all versions up to, and including, 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation

    AI risk analysis on Exploit-DB.ai →

  32. MEDIUM 4.9CVE-2026-11920

    The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter

    AI risk analysis on Exploit-DB.ai →

  33. MEDIUM 4.9CVE-2026-5062

    The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to SQL Injection via the 's' (search) parameter on the Pretty Links listing page in all versions up to, and including, 3.6.

    AI risk analysis on Exploit-DB.ai →

  34. LOW 3.9CVE-2026-8029

    The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug

    AI risk analysis on Exploit-DB.ai →

  35. UNSCOREDCVE-2026-64631

    A vulnerability allowing a low-privileged user to inject SQL and extract database contents.

    AI risk analysis on Exploit-DB.ai →