#SQL Injection
All CosmicBytez Labs articles tagged #SQL Injection, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-110911: Unauthenticated SQL Injection in Wheels CFML Framework
Wheels 1.1.8 through 4.1.1 lets attackers break out of dynamic finders and query-builder calls to inject arbitrary SQL. No auth required.
- Security
CVE-2026-97668: Abandoned Cart Pro for WooCommerce Unauthenticated SQL Injection
Unauthenticated SQL injection in Abandoned Cart Pro's guest-cart meta_value lets attackers read data and escalate to full admin takeover.
- Security
CVE-2026-108799: SQL Injection in XCMS Password Recovery Endpoint
High-severity SQLi (CVSS 7.3) in jackq XCMS's password recovery mail endpoint lets remote, unauthenticated attackers inject SQL via the email field.
- Security
CVE-2026-108571: Unauthenticated SQL Injection in Xinhu Rainrock RockOA
CVE-2026-108571 is an unauthenticated SQL injection in RockOA's Openkqj Action OpenAPI endpoint (CVSS 7.3, ≤ 2.7.6); no vendor patch is available.
- Security
CVE-2026-103695: Unauthenticated SQL Injection in Mobile Builder's vendor_id Parameter
Mobile builder ≤ 1.4.2 fails to sanitize the vendor_id parameter, letting unauthenticated attackers run SQL injection attacks.
- Security
CVE-2026-108107: Unauthenticated SQL Injection in PHPNuxBill's radius.php
PHPNuxBill ≤ 2025.3.20 lets unauthenticated attackers extract customer records via blind SQLi in its FreeRADIUS REST endpoint (CVSS 9.8).
- News
Japan Sees Sharp Rise in Web Data Leaks Amid Mobile API Abuse and Metabase Attacks
JPCERT/CC says Japan logged 119 web data-leak incidents in 2026, driven by mobile API abuse and an unauthenticated Metabase SQLi flaw (CVE-2026-72898).
- Security
CVE-2026-88395: GouGuOA SQL Injection in Keywords Parameter Enables Database Compromise
Critical SQL injection (CVSS 9.8) in GouGuOA ≤6.0.5 lets attackers compromise the OA database via the keywords parameter, no auth required.
- Security
CVE-2026-105158: RainyGao DocSys SQL Injection via Database Management Component
Unauthenticated SQL injection in DocSys's createDBForMysql function lets remote attackers manipulate backend database operations.
- Security
CVE-2026-105182: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System via Title Parameter
SourceCodester Online Reviewer Management System 1.0 lets remote, unauthenticated attackers inject SQL via the Title parameter in btn_functions.php.
- Security
CVE-2026-103355: Unlimited Elements For Elementor Blind SQL Injection
A critical, unauthenticated blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (≤ 2.0.20) exposes site databases.
- Security
CVE-2026-62071: Unauthenticated SQL Injection in WordPress File Upload Plugin
Critical unauthenticated SQLi (CVSS 9.3) in WordPress File Upload ≤ 5.1.10 lets attackers read or alter site databases. Patched in 5.2.0.
- Security
CVE-2023-54400: Fumasoft Fumeng Cloud Unauthenticated SQL Injection
Unauthenticated CVSS 9.8 SQL injection in Fumasoft Fumeng Cloud's AjaxMethod.ashx endpoint allows full database compromise via UNION-based SQLi.
- Security
CVE-2026-63713: Time-Based Blind SQL Injection in Toptech TMS7 and TopHAT Audit Logs
Critical CVSS 9.0 time-based blind SQL injection in Toptech TMS7/TopHAT audit log search hits fuel terminal ICS/OT systems worldwide; patched in 7.8.
- Security
CVE-2026-68068: Toptech TMS7 and TopHAT Critical SQL Injection in Transaction Queue Viewer
Critical CVSS 9.0 time-based blind SQL injection in Toptech TMS7/TopHAT terminal management software's transaction queue viewer; patched in v7.8.
- Security
CVE-2026-102909: SQL Injection in SourceCodester Online Reviewer Management System via access_code
CVE-2026-102909: SourceCodester Online Reviewer Management System 1.0 allows remote SQL injection via the access_code parameter in btn_functions.php.
- Security
CVE-2026-102908: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System
SourceCodester Online Reviewer Management System v1.0's questions-view.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-100314: SQL Injection in CloudClassroom-PHP-Project Student Details Update
CloudClassroom-PHP-Project is vulnerable to remote SQL injection via the eno parameter in updatedetailsfromstudent.php; the vendor has not responded.
- Security
CVE-2026-100315: SQL Injection in CloudClassroom-PHP-Project Faculty Details Lookup
CloudClassroom-PHP-Project is vulnerable to remote SQL injection via the myfid parameter in mydetailsfaculty.php; a public PoC exploit exists.
- Security
CloudClassroom-PHP-Project viewresult.php SQL Injection (CVE-2026-100739)
An unpatched SQL injection in CloudClassroom-PHP-Project's viewresult.php lets remote attackers manipulate the seno parameter to steal data.
- Security
CVE-2026-42324: Piwigo Second-Order SQL Injection via image_order[]
A high-severity second-order SQL injection (CVSS 7.2) in Piwigo lets an admin-stored sort value reach ORDER BY clauses unsanitized. Fixed in 16.4.0.
- News
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
The Canadian Centre for Cyber Security warns CVE-2026-48842, a pre-auth SQL injection flaw in Roundcube webmail, is being exploited in the wild.
- Security
CVE-2026-93973: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System (Subject Module)
Online Reviewer Management System v1.0's subject btn_functions.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93974: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System (Databank Module)
Online Reviewer Management System v1.0's databank btn_functions.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93997: Unauthenticated SQL Injection in SourceCodester Drug Recommendation System
Drug Recommendation System v1.0's edit_symptom.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93959: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System
Online Reviewer Management System v1.0's btn_functions.php lets remote, unauthenticated attackers inject SQL via the Course parameter. PoC public.
- Security
CVE-2026-20284: SQL Injection in Cisco ISE SXP REST API
Authenticated SQL injection in Cisco ISE's SXP REST API (CVSS 9.1) lets admins view, modify, or crash the ISE policy database.
- News
Cisco Warns Customers of Actively Exploited Zero-Day in Email Gateways
Cisco confirms CVE-2026-76461, a critical unauthenticated SQL injection in Secure Email Gateway, was exploited as a zero-day before patches shipped.
- Security
CVE-2026-90854: SQL Injection in SourceCodester Online Food Ordering System
SourceCodester's Online Food Ordering System 1.0 is vulnerable to remote SQL injection via the ID parameter in category-foods.php; a public exploit exists.
- Security
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection Vulnerability
Cisco Secure Email Gateway has a critical, unauthenticated SQL injection (CVSS 9.8) enabling root code execution. CISA KEV-listed as actively exploited.
- Security
SQL Injection in SourceCodester School Registration and Fee System 1.0
CVE-2026-90514 lets unauthenticated remote attackers inject SQL via the Status parameter in save_stud.php, with a public PoC exploit already live.
- Security
SQL Injection in Feng Office ≤ 3.11.13.11 Legacy API
CVE-2026-90495 lets remote attackers inject SQL via the auth parameter of Feng Office's Legacy API, with a public PoC exploit already circulating.
- Security
CVE-2026-67401: cPanel EmailTrack SQL Injection Leads to Root Code Execution
A mail-privileged cPanel account can abuse EmailTrack's SQL injection flaw to write arbitrary files and execute code as root on the server.
- Security
Unauthenticated SQL Injection Hits SourceCodester Online Voting System
CVE-2026-86290: an unauthenticated SQL injection in SourceCodester's Online Voting System via ajax.php's Category parameter, PoC public.
- News
Trezor Data Breach Impact Now Reaches 81,000 Customers
Trezor says a ShipMonk data breach via a Metabase SQLi zero-day now affects 81,000 customers, up from 14,000 in the initial disclosure.
- Security
SQL Injection in SourceCodester Class & Exam Timetabling System
CVE-2026-86208: an unauthenticated SQL injection in delete_teacher.php lets remote attackers manipulate the ID parameter. Public exploit code exists.
- Security
Second SQL Injection Hits SourceCodester Timetabling System
CVE-2026-86209: SourceCodester's Class and Exam Timetabling System 1.0 has a second unauthenticated SQLi, this time in delete_user.php.
- Security
SQL Injection Hits SourceCodester Timetabling System Again
CVE-2026-86220: an unauthenticated SQLi in SourceCodester's Class and Exam Timetabling System lets attackers inject via modal_add_course.php.
- Security
Third SourceCodester Timetabling SQLi Hits the Admin Product Form
CVE-2026-86224: a pre-auth SQL injection in SourceCodester's Timetabling System admin panel via the fname parameter in modal_add_product.php.
- Security
SQL Injection in SourceCodester Online Voting System Risks Election Data
An unauthenticated SQL injection in SourceCodester's Online Voting System lets attackers manipulate voter, admin, and configuration records.
- News
Over 3 Million WordPress Sites Exposed by Migration Plugin SQL Injection Flaw
A high-severity SQL injection in All-in-One WP Migration and Backup lets attackers chain trackback abuse into remote code execution.
- Security
Unauthenticated SQL Injection in WCFM Marketplace ≤ 3.8.1
A critical unauthenticated SQL injection (CVSS 9.3) in the WCFM Marketplace WordPress plugin exposes vendor and customer database records.
- News
Hackers Exploit Sangoma Switchvox Flaw to Deploy Reverse Shells
A critical unauthenticated SQL injection in Sangoma Switchvox is under active exploitation, dropping reverse shells on roughly 4,000 exposed PBXs.
- News
WordPress Backup Plugin Flaw Exposes Millions of Sites to Takeover Attacks
A second-order SQL injection in All-in-One WP Migration and Backup can leak a secret key and lead to full site takeover; 3.25M sites still exposed.
- Security
CVE-2026-82610: SQL Injection in itsourcecode Online Medicine Delivery System
An unauthenticated SQL injection in the employee login of itsourcecode's Online Medicine Delivery System 1.0 has a public exploit available.
- Security
Shinobi NVR: Hardcoded Child-Node Key Enables Unauthenticated Database Compromise (CVE-2026-82448)
CVE-2026-82448 (CVSS 9.8): a hardcoded key in Shinobi's child-node service lets attackers run arbitrary SQL against user and camera data.
- Security
IBM Concert SQL Injection Flaw Allows Unauthenticated Database Compromise
CVE-2026-3627 (CVSS 9.1) lets remote attackers run arbitrary SQL against IBM Concert 1.0.0-2.3.1 with no authentication, exposing the backend DB.
- Security
CVE-2026-32479: Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro
Critical unauthenticated SQL injection (CVSS 9.3) in the WordPress plugin Visitor Traffic Real Time Statistics Pro ≤ 11.17. Patch to 11.18.
- Security
CVE-2026-78143: SQL Injection in Barangay Resident Profiling Management System
High-severity SQL injection in Barangay Resident Profiling System 1.0 lets remote attackers extract personal data via the residents.php Search parameter.
- Security
Critical SQL Injection in Maps Marker Pro WordPress Plugin (CVE-2026-73183)
An unauthenticated SQL injection flaw (CVSS 9.3) in Maps Marker Pro <= 4.32 exposes WordPress databases to full read and write access.
- Security
CVE-2026-15162: WordPress Object Sync for Salesforce — SQLi via REST API
High-severity unauthenticated SQL injection in Object Sync for Salesforce plugin allows attackers to extract data via a misconfigured REST API push endpoint.
- Security
CVE-2026-72811: SiYuan SQL Injection in Backlink Search Scores Perfect 10.0
SiYuan note-taking app up to v3.7.2 is vulnerable to SQL injection via stored block metadata in the backlink search query path.
- News
Hackers Exploiting Unpatched GeoServer Zero-Day With SQL Injection to RCE
Active exploitation attempts targeting an unpatched GeoServer zero-day began within hours of public disclosure. No patch available — restrict access now.
- News
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius
A maximum-severity zero-day vulnerability in Metabase — the widely used open-source business analytics platform — allows remote attackers to gain...
- Security
CVE-2026-19425: Critical SQL Injection in Travel Agency Management System
A critical unauthenticated SQL injection vulnerability in Win Men International's Travel Agency Management System allows remote attackers to read, modify,...
- Security
CVE-2026-19384: SQL Injection in SourceCodester Simple Doctors Appointment System
A remotely exploitable SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0 allows unauthenticated attackers to manipulate...
- News
Metabase SQLi Zero-Day Exploited in Customer Data-Theft Attacks
A CVSS 10.0 unauthenticated SQL injection zero-day in Metabase's open-source analytics platform was actively exploited against cloud and self-hosted...
- Security
CVE-2026-12713: Critical SQL Injection in WPCargo Track & Trace Plugin
An unauthenticated SQL injection vulnerability (CVSS 9.1) in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows attackers to read and...
- Security
CVE-2026-65321: PyAthena SQL Injection via Improper Quote Escaping
A critical SQL injection vulnerability in PyAthena prior to 3.35.4 allows unauthenticated attackers to inject arbitrary SQL through improper...
- Security
CVE-2025-65336: Critical SQL Injection in Fruits Bazar PHP Ecommerce
CVSS 9.8 SQL injection vulnerability in the show_price_by_pdtId.php endpoint of the Fruits Bazar PHP/MySQLi ecommerce project allows unauthenticated...
- Security
CVE-2025-69941: Critical SQL Injection in Tailor Management System — Measurement Endpoint
CVSS 9.8 SQL injection in SourceCodester Tailor Management System 1.0 allows unauthenticated attackers to read, modify, or delete all database records...
- Security
CVE-2025-69947: Critical SQL Injection in Tailor Management System — Customer Edit Endpoint
CVSS 9.8 SQL injection in SourceCodester Tailor Management System 1.0 exposes full customer records through an unsanitized id parameter in...
- Security
CVE-2025-67403: Critical SQL Injection in CASAP Enrollment System update_class.php
A critical-severity SQL injection vulnerability (CVSS 9.8) in Sourcecodester CASAP Automated Enrollment System 1.0 allows unauthenticated remote attackers...
- Security
CVE-2025-67404: Critical SQL Injection in CASAP Enrollment System save_stud.php
A critical-severity SQL injection vulnerability (CVSS 9.8) in Sourcecodester CASAP Automated Enrollment System 1.0 allows unauthenticated attackers to...
- Security
CVE-2026-16462: PROCON-WEB SCADA Unauthenticated SQL Injection (CVSS 9.8)
A critical SQL injection vulnerability in PROCON-WEB SCADA's GetGridData endpoint allows unauthenticated remote attackers to execute arbitrary SQL...
- Security
CVE-2026-63232: Koollab LMS SQL Injection and RCE via Unsafe Deserialisation
A critical CVSS 9.9 vulnerability in Koollab LMS allows authenticated attackers to exploit SQL injection and unsafe PHP deserialisation in the assessment...
- Security
CVE-2026-59527: Critical SQL Injection in MapSVG WordPress Plugin
A CVSS 9.3-rated unauthenticated SQL injection vulnerability in the MapSVG WordPress plugin (versions up to 8.14.0) allows remote attackers to read and...
- Security
CVE-2026-12877: Critical SQL Injection in WordPress Project Management Plugin
An unauthenticated SQL injection flaw with a CVSS score of 9.1 affects the Project Management, Bug and Issue Tracking Plugin for WordPress before version...
- Security
CVE-2026-16227: SQL Injection in SourceCodester Class and Exam Timetabling System
A remotely exploitable SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated attackers to manipulate...
- Security
CVE-2026-16228: SQL Injection in SourceCodester Class and Exam Timetabling System via edit_schoolyr.php
A second SQL injection flaw in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to remote unauthenticated...
- Security
CVE-2026-16152: SQL Injection in SourceCodester Class and Exam Timetabling System
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester Class and Exam Timetabling System 1.0. The flaw in /edit_rooma.php...
- Security
CVE-2026-16154: SQL Injection in SourceCodester Timetabling Room Management
A second SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 has been disclosed, this time affecting the /edit_room1.php...
- Security
CVE-2026-38158: Critical SQL Injection in UReport v2.2.9 (CVSS 9.8)
A critical SQL injection vulnerability in the /ureport/datasource/previewData endpoint of ureport v2.2.9 allows unauthenticated attackers to exfiltrate...
- Security
CVE-2026-15482: SQL Injection in Aster Telecom Azcall Admin Panel
A high-severity SQL injection vulnerability in Aster Telecom Azcall 10/11 allows attackers to manipulate HTTP handler parameters and access the underlying...
- Security
CVE-2026-15489: SQL Injection in TOKO-ONLINE-ROTI Login Endpoint
A high-severity SQL injection vulnerability in the TOKO-ONLINE-ROTI bakery management system allows remote attackers to manipulate the login.php Username...
- Security
CVE-2026-15490: SQL Injection in TOKO-ONLINE-ROTI Product Add Endpoint
A high-severity SQL injection vulnerability in the TOKO-ONLINE-ROTI PHP bakery system allows remote attackers to manipulate the kode_produk and kd_cs...
- Security
CVE-2026-60090: PraisonAI SQL Injection via Unvalidated Dimension Parameter in Vector Store Backends
A CVSS 9.8 critical SQL injection vulnerability in PraisonAI before 4.6.78 allows attackers to exploit the unvalidated dimension argument in PGVector and...
- Security
CVE-2026-5955: BiEticaret E-Commerce SQL Injection (CVSS 9.8)
A critical SQL injection vulnerability in Inrove Software's BiEticaret e-commerce platform (versions before v3.3.57) allows unauthenticated attackers to...
- Security
CVE-2026-15062: Critical SQL Injection in Snowflake Snowpark Python SDK
A critical-severity SQL injection vulnerability (CVSS 9.6) in the Snowflake Snowpark Python SDK allows authenticated low-privilege users to execute SQL...
- Security
CVE-2026-14732: SQL Injection in SourceCodester Timetabling System via /edit_exam.php
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database via...
- Security
CVE-2026-14733: SQL Injection in SourceCodester Timetabling System via /edit_coursea.php
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database via...
- Security
CVE-2026-14734: SQL Injection in SourceCodester Timetabling System via /edit_product.php
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database via...
- Security
CVE-2026-14770: SQL Injection in SourceCodester Class and Exam Timetabling System
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate backend database...
- Security
CVE-2026-14771: SQL Injection in SourceCodester Class and Exam Timetabling System
An unauthenticated remote SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows attackers to manipulate the id...
- Security
CVE-2026-14641: Remote SQL Injection in SourceCodester Class and Exam Timetabling System
A high-severity SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to dump the...
- Security
CVE-2026-14642: Remote SQL Injection in SourceCodester Timetabling System edit_class2.php
A high-severity SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to fully...
- Security
CVE-2026-14652: SQL Injection in SourceCodester Shopping Cart Admin Login
A high-severity SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 allows remote attackers to manipulate the admin...
- Security
CVE-2026-14653: SQL Injection in Shopping Cart Men's Product Delete Endpoint
A high-severity SQL injection flaw in SourceCodester Simple and Nice Shopping Cart Script 1.0 exposes the men's product delete query to remote...
- Security
CVE-2026-14654: SQL Injection in Shopping Cart Girls Product Delete Endpoint
A high-severity SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 allows remote attackers to exploit the girls...
- Security
CVE-2026-14688: SQL Injection in itsourcecode Hotel Management Admin Login
A high-severity SQL injection vulnerability in itsourcecode Online Hotel Management System 1.0 allows remote attackers to exploit the admin login page via...
- Security
SQL Injection in Multi-Vendor Online Grocery Management System (CVE-2026-14695)
A high-severity SQL injection vulnerability in SourceCodester's Multi-Vendor Online Grocery Management System 1.0 allows remote attackers to manipulate...
- Security
SQL Injection in Pizzafy E-Commerce System Exposes Order Data (CVE-2026-14713)
A remotely exploitable SQL injection flaw in SourceCodester Pizzafy E-Commerce System 1.0 allows attackers to manipulate the confirm_order endpoint via an...
- Security
CVE-2026-4321: Critical SQL Injection in Raera Destekz Plugin (No Patch Available)
A CVSS 9.8 critical SQL injection in the Destekz plugin by Raera - Ankara Web Design allows unauthenticated remote attackers full database access. The...
- Security
UniFi Talk SQL Injection Chain Enables Host Privilege Escalation CVE-2026-50747
Multiple authenticated SQL injection vulnerabilities in Ubiquiti's UniFi Talk Application can be chained to escalate privileges to host-level access on...
- Security
CVE-2026-52186: Critical SQL Injection RCE in UTT nv518G Router
A critical SQL injection vulnerability (CVSS 9.8) in the UTT nv518G router allows unauthenticated remote attackers to execute arbitrary code via the...
- Security
CVE-2026-9711: Critical SQL Injection in EventON WordPress Plugin (CVSS 9.8)
A critical unauthenticated SQL injection vulnerability in the EventON WordPress Virtual Event Calendar Plugin affects versions up to 5.0.11, exposing...
- Security
CVE-2026-13550: SQL Injection in itsourcecode Baptism Information Management System 1.0
A high-severity SQL injection vulnerability has been identified in itsourcecode Baptism Information Management System 1.0, allowing remote attackers to...
- Security
CVE-2026-13551: SQL Injection in itsourcecode Baptism Information Management System 1.0 (editBaptism.php)
A second high-severity SQL injection vulnerability has been disclosed in itsourcecode Baptism Information Management System 1.0, this time affecting the...
- Security
CVE-2026-13521: SQL Injection in SourceCodester Class and Exam Timetabling System
A remotely exploitable SQL injection vulnerability affects SourceCodester Class and Exam Timetabling System 1.0 via the course_year_section parameter in...
- Security
CVE-2026-13526: SQL Injection in SourceCodester Class and Exam Timetabling System
A remotely exploitable SQL injection flaw in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated attackers to manipulate...
- Security
CVE-2026-49048: Critical SQL Injection in JoomCCK Joomla Extension
A critical unauthenticated SQL injection vulnerability (CVSS 9.8) in the JoomCCK Joomla extension allows attackers to read, modify, or delete database...
- Security
CVE-2026-13485: SQL Injection in SourceCodester Class and Exam Timetabling System
A high-severity SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to...
- Security
CVE-2026-13486: SQL Injection in SourceCodester Class and Exam Timetabling System (preview6.php)
A second high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 targets /preview6.php via the...
- Security
CVE-2026-13487: SQL Injection in SourceCodester Timetabling System (/archive.php)
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated attackers to manipulate the...
- Security
CVE-2026-13488: SQL Injection in SourceCodester Timetabling System (/preview7.php)
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated attackers to manipulate the...
- Security
CVE-2026-13498: SQL Injection in Restaurant Management System via Password Reset
A high-severity SQL injection vulnerability in yashpokharna2555's restaurant management system allows unauthenticated attackers to exploit the...
- Security
CVE-2026-54820: Critical SQL Injection in JetBooking WordPress Plugin
A critical unauthenticated SQL injection vulnerability (CVSS 9.3) in the JetBooking WordPress plugin affects all versions up to 4.0.4.1, potentially...
- Security
CVE-2026-49772: The Events Calendar Blind SQL Injection (CVSS 9.3)
A critical blind SQL injection vulnerability in The Events Calendar WordPress plugin by StellarWP affects versions 6.15.12 through 6.16.2, allowing...
- Security
CVE-2026-52715: GEO my WordPress Unauthenticated SQL Injection (CVSS 9.3)
A critical unauthenticated SQL injection vulnerability in GEO my WordPress versions 4.5.5 and earlier allows attackers to extract database contents...
- Security
CVE-2026-39574: Critical SQL Injection in InPost Gallery WordPress Plugin
A critical unauthenticated SQL injection vulnerability (CVSS 9.3) in the InPost Gallery WordPress plugin allows attackers to extract sensitive database...
- Security
CVE-2026-11334: SQL Injection in College Management System
A high-severity SQL injection vulnerability (CVSS 7.3) in CollegeManagementSystem allows attackers to manipulate the department_code parameter in…
- Security
CVE-2026-10263: SQL Injection in SourceCodester Computer Repair Shop Management System
A CVSS 7.3 SQL injection vulnerability in SourceCodester's Computer Repair Shop Management System v1.0 allows remote attackers to extract sensitive data via…
- Security
CVE-2026-10184: SourceCodester Hospital Records SQL Injection via Delete
A SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0 allows remote attackers to extract database contents by…
- Security
CVE-2026-10185: SourceCodester Hospital Records SQL Injection via Save
A SQL injection vulnerability in SourceCodester Hospitals Patient Records Management System 1.0 enables remote attackers to extract database contents by…
- Security
CVE-2026-48188: OTRS Database Layer SQL Injection — Authentication Bypass
A critical SQL injection vulnerability (CVSS 9.1) in OTRS and ((OTRS)) Community Edition allows unauthenticated attackers to bypass authentication entirely…
- Security
CVE-2026-49489: OpenCATS ATS SQL Injection via sortDirection Parameter
A SQL injection vulnerability in OpenCATS through 0.9.7.4 allows authenticated attackers to extract database contents by injecting malicious SQL via the…
- Security
CVE-2018-25405: Multiple SQL Injections in eNdonesia Portal 8.7
Multiple unauthenticated SQL injection vulnerabilities in eNdonesia Portal 8.7 allow attackers to extract sensitive database contents via the artid, cid,...
- Security
CVE-2018-25406: SQL Injection Across eNdonesia Portal 8.7 Modules
Multiple unauthenticated SQL injection vulnerabilities in eNdonesia Portal 8.7 expose the publisher, artikel, and info modules to database extraction...
- Security
CVE-2018-25411: SQL Injection in MGB OpenSource Guestbook 0.7.0.2
An unauthenticated SQL injection vulnerability in MGB OpenSource Guestbook 0.7.0.2 allows attackers to extract sensitive database contents via the 'id'...
- Security
CVE-2026-10178: SQL Injection in Online Music Site 1.0 Admin Panel
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Online Music Site 1.0, affecting the Administrator PHP AdminEditAlbum…
- Security
CVE-2026-10110: SQL Injection in Student Details Management System 1.0
A remotely exploitable SQL injection vulnerability in code-projects Student Details Management System 1.0 allows attackers to manipulate database queries...
- Security
CVE-2026-9757: GEO my WP Plugin SQL Injection via Query String Bypass
The GEO my WP WordPress plugin (versions up to 4.5.5) is vulnerable to unauthenticated SQL injection via the swlatlng and nelatlng parameters, which...
- Security
CVE-2026-45288 — Marten .NET Document DB SQL Injection via regConfig
A CVSS 9.8 critical SQL injection vulnerability in the Marten .NET document database library allows untrusted user input to be interpolated directly into...
- Security
CVE-2018-25362: Twitter-Clone SQL Injection via follow.php
Twitter-Clone 1 contains a high-severity SQL injection vulnerability in follow.php that allows attackers to extract sensitive database information through.
- Security
CVE-2026-9525: SQL Injection in itsourcecode Electronic
A remotely exploitable SQL injection vulnerability in the admin panel of itsourcecode Electronic Judging System 1.0 allows attackers to manipulate database.
- News
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
CISA has added CVE-2026-9082, a SQL injection vulnerability in Drupal Core, to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild...
- News
Drupal: Critical SQL Injection Flaw Now Targeted in Attacks
Drupal is warning that hackers are actively attempting to exploit a 'highly critical' SQL injection vulnerability, CVE-2026-9082, announced earlier this...
- Security
CVE-2026-39531: WP Directory Kit Blind SQL Injection (CVSS
A critical blind SQL injection vulnerability in the WP Directory Kit WordPress plugin allows unauthenticated attackers to exfiltrate the entire WordPress...
- Security
WP ERP Pro SQL Injection via search_key Parameter
A CVSS 7.5 SQL injection vulnerability in the WP ERP Pro WordPress plugin (all versions up to 1.5.1) allows unauthenticated attackers to extract sensitive...
- Security
CVE-2026-8785: SQL Injection in Hospital Management System
A high-severity SQL injection vulnerability (CVE-2026-8785, CVSS 7.3) has been disclosed in projectworlds Hospital Management System in PHP 1.0, allowing...
- Security
Critical Blind SQL Injection in Akilli E-Commerce Website
A CVSS 9.8 blind SQL injection vulnerability in Akilli Commerce's e-commerce platform allows unauthenticated attackers to extract the entire database...
- Security
CVE-2026-2993: SQL Injection in AIWU AI Chatbot WordPress
A high-severity SQL injection vulnerability (CVE-2026-2993) in the AI Chatbot & Workflow Automation by AIWU WordPress plugin allows unauthenticated...
- Security
CVE-2026-34260 — SAP S/4HANA SQL Injection via ABAP
A critical SQL injection vulnerability in SAP S/4HANA Enterprise Search for ABAP allows authenticated attackers to inject malicious SQL statements via...
- Security
CVE-2026-6433: WordPress Plugin SQLi Enables
The Custom css-js-php WordPress plugin through version 2.0.7 fails to sanitize user input before using it in a SQL query, and passes the result to dynamic...
- Security
CVE-2026-37431: Beauty Parlour Management System SQL
A critical unauthenticated SQL injection vulnerability in Beauty Parlour Management System v1.1 allows attackers to dump the entire backend database via a...
- Security
CVE-2026-42208: LiteLLM AI Gateway Pre-Auth SQL Injection
A critical SQL injection vulnerability in LiteLLM's proxy server allows unauthenticated attackers to manipulate database queries during API key...
- News
Hackers Are Exploiting a Critical LiteLLM Pre-Auth SQLi Flaw
Threat actors are actively exploiting CVE-2026-42208, a critical pre-authentication SQL injection vulnerability in the LiteLLM open-source LLM gateway,...
- Security
CVE-2024-46636: NASA EOSDIS MODAPS v8.1 SQL Injection
A critical SQL injection vulnerability in NASA's Earth Observing System Data and Information System MODAPS v8.1 allows unauthenticated attackers to...
- Security
CVE-2026-41462: ProjeQtor Unauthenticated SQL Injection in Login
A critical unauthenticated SQL injection vulnerability in ProjeQtor project management software allows attackers to inject arbitrary SQL via the login...
- Security
CVE-2026-7224: SQL Injection in Pizzafy Ecommerce System 1.0
A high-severity SQL injection vulnerability has been discovered in SourceCodester Pizzafy Ecommerce System 1.0, allowing remote attackers to manipulate...
- Newsletter
Apr 28 Digest: Medtronic 9M Breach, GitHub RCE, LiteLLM
ShinyHunters hits Medtronic and ADT in the same week, exposing millions of records; a critical one-push RCE lands in GitHub; LiteLLM's pre-auth SQL...
- Security
CVE-2026-7077: SQL Injection in itsourcecode Courier
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Courier Management System 1.0, affecting the edit_parcel.php file...
- Security
CVE-2026-7002: SQL Injection in KLiK SocialMediaWebsite
CVE-2026-7002 is a CVSS 7.3 SQL injection vulnerability in KLiK SocialMediaWebsite up to version 1.0.1, exploitable remotely via the c_id parameter in the...
- Security
CVE-2026-41478: Saltcorn SQL Injection Allows Full Database
A critical SQL injection vulnerability in Saltcorn's mobile-sync routes allows any authenticated low-privilege user with read access to a single table to...
- Security
SocialEngine Unauthenticated SQL Injection via Activity
A critical SQL injection vulnerability in SocialEngine versions 7.8.0 and prior allows unauthenticated remote attackers to execute arbitrary SQL queries...
- Security
CVE-2026-6887: Borg SPM 2007 SQL Injection Exposes Full
A critical SQL injection vulnerability in the end-of-life Borg SPM 2007 application allows unauthenticated remote attackers to inject arbitrary SQL...
- Security
CVE-2026-41167: Jellystat Authenticated SQL Injection in Multiple API Endpoints (CVSS 9.1)
A critical SQL injection vulnerability in Jellystat, the open-source statistics app for Jellyfin, allows authenticated users to execute arbitrary SQL...
- Security
CVE-2026-6595: SQL Injection in ProjectsAndPrograms School
A medium-severity SQL injection vulnerability has been disclosed in ProjectsAndPrograms School Management System, allowing remote attackers to manipulate...
- Security
CVE-2026-37749: SQL Injection Auth Bypass in CodeAstro
A critical SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows unauthenticated remote attackers to bypass login...
- Security
CVE-2026-40285: WeGIA SQL Injection via PHP extract()
A high-severity SQL injection vulnerability in WeGIA, a web manager for charitable institutions, allows authenticated attackers to escalate privileges by...
- Security
CVE-2026-6004: SQL Injection in code-projects Simple IT
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Simple IT Discussion Forum 1.0, affecting the /delete-category.php...
- Security
CVE-2026-5637: SQL Injection in projectworlds Car Rental
A remotely exploitable SQL injection vulnerability (CVE-2026-5637) has been disclosed in projectworlds Car Rental System 1.0. The flaw exists in...
- Security
CVE-2019-25662: ResourceSpace 8.6 Unauthenticated SQL
An unauthenticated SQL injection vulnerability in ResourceSpace 8.6 allows attackers to execute arbitrary database queries via the 'ref' parameter in...
- Security
CVE-2026-5554: SQL Injection in Concert Ticket Reservation
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Concert Ticket Reservation System 1.0, affecting the...
- Security
CVE-2026-5555: SQL Injection in Concert Ticket Reservation
An unauthenticated SQL injection vulnerability has been disclosed in code-projects Concert Ticket Reservation System 1.0, affecting the login.php file via...
- Security
CVE-2026-5575: SQL Injection in SourceCodester Record
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester/jkev Record Management System 1.0, affecting the Login page's...
- Security
CVE-2026-5534 — SQL Injection in itsourcecode Online
A high-severity SQL injection vulnerability in itsourcecode Online Enrollment System 1.0 allows remote unauthenticated attackers to manipulate the USERID...
- Security
CVE-2026-5540 — SQL Injection in code-projects Simple
A high-severity SQL injection vulnerability in code-projects Simple Laundry System 1.0 allows remote unauthenticated attackers to manipulate the firstName...
- Security
CVE-2026-5551: SQL Injection in itsourcecode Free Hotel
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Free Hotel Reservation System 1.0, affecting the login page's email...
- Security
CVE-2026-33615: Critical Unauthenticated SQL Injection in setinfo Endpoint
A critical unauthenticated SQL injection vulnerability (CVSS 9.1) in the setinfo endpoint allows remote attackers to corrupt data and cause denial of...
- Security
CVE-2026-32714: Critical SQL Injection in SciTokens
A critical SQL injection vulnerability in the SciTokens Python library allows attackers to manipulate authentication token validation via unsanitized...
- Security
CVE-2026-5017: SQL Injection in code-projects Simple Food
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Simple Food Order System 1.0, affecting the /all-tickets.php file...
- Security
CVE-2026-5018: SQL Injection in code-projects Simple Food
A remotely exploitable SQL injection vulnerability exists in code-projects Simple Food Order System 1.0, where the Name parameter in register-router.php...
- Security
CVE-2026-5019: SQL Injection in code-projects Simple Food
A SQL injection vulnerability has been disclosed in code-projects Simple Food Order System 1.0, where the Status parameter in all-orders.php enables...
- Security
CVE-2026-5033: SQL Injection in code-projects Accounting
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Accounting System 1.0, where the cos_id parameter in...
- Security
CVE-2026-5034: SQL Injection in code-projects Accounting
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Accounting System 1.0, allowing unauthenticated attackers to...
- Security
CVE-2025-62319: Critical SQL Injection in HCL Unica (CVSS
A critical unauthenticated Boolean-based SQL injection vulnerability (CVSS 9.8) has been disclosed in HCL Unica versions 25.1.1 and below, allowing remote...
- Security
CVE-2026-3730: SQL Injection in itsourcecode Free Hotel
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Free Hotel Reservation System 1.0, affecting the amenities admin...
- Security
CVE-2026-3740: SQL Injection in itsourcecode University
A high-severity SQL injection vulnerability has been disclosed in itsourcecode University Management System 1.0, allowing remote attackers to execute...
- Security
CVE-2026-3746: SQL Injection in SourceCodester Simple
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester Simple Responsive Tourism Website 1.0, allowing attackers to...
- Security
CVE-2018-25165: SQL Injection Disclosed in Galaxy Forces MMORPG
A SQL injection vulnerability in Galaxy Forces MMORPG version 0.5.8 has been formally catalogued by NVD, enabling authenticated attackers to extract...
- Security
Critical Fortinet FortiClientEMS SQL Injection
Fortinet patches a CVSS 9.8 SQL injection in FortiClientEMS 7.4.4 allowing unauthenticated remote code execution. Endpoint management servers across...