Base de CVEs

CVE-2026-62071 Crítica · 9.3 CWE-89 01/10/2026

WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

CVE-2026-62060 Alta · 7.6 CWE-89 01/10/2026

WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2.

CVE-2026-62059 Alta · 7.6 CWE-89 01/10/2026

WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

CVE-2026-103338 Alta · 8.5 CWE-89 01/10/2026

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

CVE-2026-102379 Alta · 8.5 CWE-89 01/10/2026

WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

CVE-2026-103253 Alta · 8.7 CWE-89 01/10/2026

n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.

CVE-2026-103248 Crítica · 9.0 CWE-89 01/10/2026

n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supabase node's Filters (String) mode that fails to escape field values. Attackers can inject filter expressions from untrusted input to read all table rows, update all records, or delete entire tables in a single request.

CVE-2026-75786 Alta · 7.2 CWE-89 01/10/2026

SQL Injection in Grafana Integration Endpoint (query.php)

Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pandora FMS from 777 onwards.

CVE-2026-89296 Alta · 8.6 CWE-89 01/10/2026

Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

CVE-2026-81809 Alta · 7.5 CWE-89 01/10/2026

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

CVE-2026-102109 Alta · 7.1 CWE-89 30/09/2026

Kiteworks Secure Data Forms SQL injection

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use.

CVE-2026-102098 Alta · 7.2 CWE-89 30/09/2026

Kiteworks Core SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an existing, authenticated administrative account with access to the affected reporting function.

CVE-2026-76570 Crítica · 9.1 CWE-89 30/09/2026

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

CVE-2026-62097 Alta · 7.6 CWE-89 30/09/2026

WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.

CVE-2026-18782 Crítica · 9.8 CWE-89 30/09/2026

SQL Injection in Trex Digital Manufacturing's Trex MES

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

CVE-2026-82307 Crítica · 9.8 CWE-89 30/09/2026

Multiple Vulnerabilities in Dolusoft Software's SOPLOG

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.

CVE-2026-97293 Alta · 8.5 CWE-89 30/09/2026

WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

CVE-2026-97287 Alta · 8.5 CWE-89 30/09/2026

WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

CVE-2026-96828 Alta · 7.6 CWE-89 30/09/2026

WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

CVE-2026-96827 Alta · 7.6 CWE-89 30/09/2026

WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

CVE-2026-96822 Crítica · 9.3 CWE-89 30/09/2026

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

CVE-2026-96346 Alta · 7.6 CWE-89 30/09/2026

WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability

Author SQL Injection in WP ERP <= 1.17.9 versions.

CVE-2026-96345 Alta · 7.6 CWE-89 30/09/2026

WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

Administrator SQL Injection in Estatik <= 4.3.5 versions.

CVE-2026-94177 Alta · 8.5 CWE-89 30/09/2026

WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.

CVE-2026-94115 Alta · 8.5 CWE-89 30/09/2026

WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.