Base de CVEs

CVE-2026-18198 Alta · 8.8 CWE-89 04/09/2026

SQL Injection in TAC Information's GoldenHorn

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe.

CVE-2026-85540 Alta · 8.8 CWE-89 04/09/2026

Interinfo｜DreamMaker - SQL Injection

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

CVE-2026-57777 Alta · 7.6 CWE-89 04/09/2026

WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.

CVE-2026-82186 Média · 4.1 CWE-89 04/09/2026

WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

CVE-2026-82527 Alta · 7.5 CWE-89 03/09/2026

R2R 3.6.6 SQL Injection via Retrieval Search Filter Key

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping to perform time-based and boolean-based data exfiltration from the application database.

CVE-2026-85388 Alta · 8.1 CWE-89 03/09/2026

Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.

CVE-2026-82526 Crítica · 9.8 CWE-89 03/09/2026

R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.

CVE-2026-84813 Crítica · 9.3 CWE-89 03/09/2026

WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.

CVE-2026-84768 Crítica · 9.3 CWE-89 03/09/2026

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

CVE-2026-85155 Alta · 7.5 CWE-89 03/09/2026

WWBN AVideo SQL Injection via get.json.php APIName channels

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.

CVE-2026-78080 Crítica · 9.3 CWE-89 03/09/2026

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors.

CVE-2026-76176 Alta · 8.6 CWE-89 03/09/2026

Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.

CVE-2026-76175 Alta · 8.6 CWE-89 03/09/2026

Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.

CVE-2026-79991 Alta · 7.1 CWE-89 02/09/2026

Authenticated SQL Injection via nested eager-loading criteria

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.

CVE-2026-81286 Crítica · 9.3 CWE-89 02/09/2026

WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

CVE-2026-14828 Alta · 8.8 CWE-89 02/09/2026

SQL Injection em Zohocorp Manageengine Password Manager Pro

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

CVE-2026-82182 Média · 4.1 CWE-89 02/09/2026

WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.

CVE-2026-19704 Média · 5.3 CWE-89 02/09/2026

Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

CVE-2026-19754 Alta · 8.6 CWE-89 02/09/2026

Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates Formula-field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user, allowing data to be read or modified outside the user's workspace permissions.

CVE-2026-84208 Alta · 7.5 CWE-89 01/09/2026

AVideo User_Location Plugin Unauthenticated SQL Injection

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.

CVE-2026-73721 Alta · 7.2 CWE-89 01/09/2026

Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the HPE Networking Fabric Composer host.

CVE-2026-18630 Alta · 8.8 CWE-89 01/09/2026

SQL Injection in TMT Machine's Talassoft Industrial Management Software

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

CVE-2026-18210 Crítica · 9.8 CWE-89 01/09/2026

SQL Injection in TRtek Technological Products's Store

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2.

CVE-2026-18765 Crítica · 9.8 CWE-89 01/09/2026

SQL Injection in Teracity Sotware's Teracity E-OSB Platform

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-OSB allows SQL Injection. This issue affects E-OSB: before V02.26.07.08.01.

CVE-2026-77189 Média · 6.5 CWE-89 01/09/2026

Charitable <= 1.8.12.1 - Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute

The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.