Base de CVEs

CVE-2026-2912 Crítica · 9.8 CWE-89 22/02/2026

Injeção de SQL no studentresult-view.php do Online Reviewer System da code-projects

Foi identificada uma vulnerabilidade no code-projects Online Reviewer System 1.0. Afetada está uma função desconhecida do arquivo /system/system/students/assessments/results/studentresult-view.php. A manipulação do argumento test_id resulta em injeção de SQL. É possível lançar o ataque remotamente. O exploit foi tornado público e pode ser utilizado.

CVE-2026-2865 Crítica · 9.8 CWE-89 21/02/2026

itsourcecode Agri-Trading Online Shopping System - injeção de SQL em productcontroller.php

Foi identificada uma vulnerabilidade no itsourcecode Agri-Trading Online Shopping System 1.0. Ela afeta uma função não especificada do arquivo admin/productcontroller.php, no componente HTTP POST Request Handler. A manipulação do argumento Product resulta em injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi tornado público e poderia ser utilizado.

CVE-2026-27470 Alta · 8.8 CWE-89 21/02/2026

ZoneMinder: Second-Order SQL Injection in `getNearEvents()` via Stored Event Name and Cause Fields

ZoneMinder is a free, open source closed-circuit television software application. In versions 1.36.37 and below and 1.37.61 through 1.38.0, there is a second-order SQL Injection vulnerability in the web/ajax/status.php file within the getNearEvents() function. Event field values (specifically Name and Cause) are stored safely via parameterized queries but are later retrieved and concatenated directly into SQL WHERE clauses without escaping. An authenticated user with Events edit and view permissions can exploit this to execute arbitrary SQL queries.

CVE-2019-25438 Alta · 7.5 CWE-89 20/02/2026

LabCollector 5.423 SQL Injection via login.php

LabCollector 5.423 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the login parameter of login.php or the user_name parameter of retrieve_password.php to extract sensitive database information without authentication.

CVE-2019-25432 Alta · 7.5 CWE-89 20/02/2026

Part-DB 0.4 Authentication Bypass via login.php

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to the application.

CVE-2019-25431 Alta · 8.2 CWE-89 20/02/2026

delpino73 Blue-Smiley-Organizer 1.32 SQL Injection via datetime

delpino73 Blue-Smiley-Organizer 1.32 contains an SQL injection vulnerability in the datetime parameter that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through POST requests to extract sensitive data using boolean-based blind and time-based blind techniques, or write files to the server using INTO OUTFILE statements.

CVE-2019-25444 Crítica · 9.1 CWE-89 20/02/2026

Fiverr Clone Script 1.2.2 SQL Injection via page Parameter

Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the page parameter. Attackers can supply malicious SQL syntax in the page parameter to extract sensitive database information or modify database contents.

CVE-2026-2848 Crítica · 9.8 CWE-89 20/02/2026

Injeção de SQL no registro de usuários do SourceCodester Simple Responsive Tourism Website (Master.php)

Foi identificada uma falha no SourceCodester Simple Responsive Tourism Website 1.0. Afeta uma funcionalidade desconhecida do arquivo /classes/Master.php?f=register do componente Registration. A manipulação do argumento Username causa injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi publicado e pode ser utilizado.

CVE-2026-26745 Média · 5.3 CWE-89 20/02/2026

SQL Injection em Opensourcepos Open Source Point Of Sale

OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.

CVE-2026-24959 Alta · 8.5 CWE-89 20/02/2026

WordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.

CVE-2026-24956 Crítica · 9.3 CWE-89 20/02/2026

WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor: from n/a through <= 1.3.0.

CVE-2025-69366 Crítica · 9.3 CWE-89 20/02/2026

WordPress Emerce Core plugin <= 1.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Emerce Core emerce-core allows Blind SQL Injection.This issue affects Emerce Core: from n/a through <= 1.8.

CVE-2025-69365 Crítica · 9.3 CWE-89 20/02/2026

WordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Uroan Core uroan-core allows Blind SQL Injection.This issue affects Uroan Core: from n/a through <= 1.4.4.

CVE-2025-69337 Crítica · 9.3 CWE-89 20/02/2026

WordPress Wolmart Core plugin <= 1.9.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Wolmart Core wolmart-core allows Blind SQL Injection.This issue affects Wolmart Core: from n/a through <= 1.9.6.

CVE-2025-69310 Crítica · 9.3 CWE-89 20/02/2026

WordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Injection.This issue affects Woodly Core: from n/a through <= 1.4.

CVE-2025-69309 Crítica · 9.3 CWE-89 20/02/2026

WordPress Saasplate Core plugin <= 1.2.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through <= 1.2.8.

CVE-2025-69308 Crítica · 9.3 CWE-89 20/02/2026

WordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL Injection.This issue affects Nestbyte Core: from n/a through <= 1.2.

CVE-2025-69307 Crítica · 9.3 CWE-89 20/02/2026

WordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL Injection.This issue affects Medinik Core: from n/a through <= 1.3.6.

CVE-2025-69306 Crítica · 9.3 CWE-89 20/02/2026

WordPress Electio Core plugin <= 1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL Injection.This issue affects Electio Core: from n/a through <= 1.4.

CVE-2025-69305 Crítica · 9.3 CWE-89 20/02/2026

WordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injection.This issue affects Crete Core: from n/a through <= 1.4.3.

CVE-2025-69304 Crítica · 9.3 CWE-89 20/02/2026

WordPress Allmart plugin <= 1.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Allmart allmart-core allows Blind SQL Injection.This issue affects Allmart: from n/a through <= 1.1.

CVE-2025-69295 Crítica · 9.3 CWE-89 20/02/2026

WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Coven Core coven-core allows Blind SQL Injection.This issue affects Coven Core: from n/a through <= 1.3.

CVE-2025-67987 Alta · 8.5 CWE-89 20/02/2026

WordPress Quiz And Survey Master plugin <= 10.3.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.

CVE-2025-10970 Crítica · 9.8 CWE-89 20/02/2026

Injeção de SQL cega no Talentics da Kolay Software (CVE-2025-10970)

Neutralização imprópria de elementos especiais usados em um comando SQL ('Injeção de SQL') em vulnerabilidade na Kolay Software Inc. Talentics permite Injeção de SQL cega. Esta questão afeta o Talentics: até 20022026. OBSERVAÇÃO: o fornecedor foi contatado antecipadamente sobre esta divulgação, mas não respondeu de nenhuma forma.

CVE-2026-2822 Alta · 8.8 CWE-89 20/02/2026

JeecgBoot Backend airag_app,1,create_by sql injection

A security vulnerability has been detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file /jeecgboot/sys/dict/loadDict/airag_app,1,create_by of the component Backend Interface. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.