Total
20709 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-65877 | 2026-07-27 | N/A | N/A | ||
| Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector. | |||||
| CVE-2026-65766 | 2026-07-27 | N/A | N/A | ||
| Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector. | |||||
| CVE-2026-14189 | 2026-07-27 | N/A | 3.8 LOW | ||
| The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to perform SQL injection that executes when a visitor triggers a search. | |||||
| CVE-2026-59550 | 2026-07-27 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. | |||||
| CVE-2026-59537 | 2026-07-27 | N/A | 7.6 HIGH | ||
| Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions. | |||||
| CVE-2026-59549 | 2026-07-27 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. | |||||
| CVE-2026-59527 | 2026-07-27 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |||||
| CVE-2026-59538 | 2026-07-27 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. | |||||
| CVE-2026-66427 | 2026-07-27 | N/A | 7.6 HIGH | ||
| Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. | |||||
| CVE-2026-59551 | 2026-07-27 | N/A | 8.5 HIGH | ||
| Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. | |||||
| CVE-2026-59533 | 2026-07-27 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. | |||||
| CVE-2026-57308 | 1 Apache | 1 Syncope | 2026-07-27 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue. | |||||
| CVE-2025-14179 | 1 Php | 1 Php | 2026-07-25 | N/A | 9.8 CRITICAL |
| In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. | |||||
| CVE-2021-47941 | 2026-07-25 | N/A | 8.2 HIGH | ||
| WordPress Plugin Survey & Poll 1.5.7.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the wp_sap cookie parameter. Attackers can craft SQL payloads in the cookie to extract sensitive database information including usernames, passwords, and other confidential data from the WordPress database. | |||||
| CVE-2021-47930 | 2026-07-25 | N/A | 8.2 HIGH | ||
| Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbitrary SQL queries. Attackers can send POST requests to the com_baforms component with malicious JSON payloads in the 'id' field parameter to extract sensitive database information. | |||||
| CVE-2021-47928 | 2026-07-25 | N/A | 8.2 HIGH | ||
| Opencart TMD Vendor System 3.x contains a blind SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the product_id parameter. Attackers can craft malicious SQL queries using time-based or content-based blind injection techniques to enumerate usernames, emails, and password reset codes from the oc_user table. | |||||
| CVE-2026-24913 | 1 Icz | 1 Matcha Invoice | 2026-07-25 | N/A | 8.8 HIGH |
| SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the database may be obtained or altered by a user who can log in to the product. | |||||
| CVE-2026-33088 | 1 Sixapart | 1 Movable Type | 2026-07-24 | N/A | 9.8 CRITICAL |
| Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement. | |||||
| CVE-2026-33350 | 1 Mcgill | 1 Loris | 2026-07-24 | N/A | 7.5 HIGH |
| LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI feedback popup window of the imaging browser. Attackers can use SQL ingestion to access/alter data on the server. This vulnerability is fixed in 27.0.3 and 28.0.1. | |||||
| CVE-2026-33324 | 1 Fit2cloud | 1 Sqlbot | 2026-07-24 | N/A | 8.8 HIGH |
| SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to prompt injection. The user-provided question parameter is directly concatenated into the LLM prompt without filtering or escaping, and the SQL extracted from the LLM response is executed against the database without validation or sanitization. An authenticated attacker can craft a malicious question to manipulate the LLM into generating and executing arbitrary SQL statements. When connected to a PostgreSQL data source, this can lead to remote code execution via COPY FROM PROGRAM. This issue has been fixed in version 1.7.1. | |||||