Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2025-61024
Alta · 7.5
CWE-89 23/06/2026
An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11…
An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2026-44792
Crítica · 9.0
CWE-89 23/06/2026
Injeção de SQL no n8n via importação de Data Table pelo Source Control (CVE-2026-44792)
n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes das versões 1.123.43, 2.22.1 e 2.20.7, um invasor com permissão de escrita no repositório git conectado a uma configuração de Source Control do n8n poderia fazer commit de um arquivo JSON de Data Table malicioso contendo um nome de coluna elaborado. Quando um administrador executava um Source Control Pull, o n8n importava o arquivo e isso podia levar a injeção de SQL na instância interna do PostgreSQL. A exploração exige que a instância do n8n use PostgreSQL como banco de dados, que o recurso Source Control esteja habilitado e conectado a um repositório no qual o invasor possa escrever, e que um administrador acione um Source Control Pull. Esta vulnerabilidade está corrigida nas versões 1.123.43, 2.22.1 e 2.20.7.
CVE-2026-34914
Alta · 8.3
CWE-89 23/06/2026
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and...
A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.
CVE-2025-61028
Alta · 7.5
CWE-89 23/06/2026
An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows…
An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61027
Alta · 7.5
CWE-89 23/06/2026
An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows…
An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61025
Alta · 7.5
CWE-89 23/06/2026
An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows…
An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61023
Alta · 7.5
CWE-89 23/06/2026
An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows…
An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61022
Alta · 7.5
CWE-89 23/06/2026
An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11…
An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61021
Alta · 7.5
CWE-89 23/06/2026
An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11…
An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61020
Alta · 7.5
CWE-89 23/06/2026
An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11…
An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61019
Alta · 7.5
CWE-89 23/06/2026
An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11…
An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61018
Alta · 7.5
CWE-89 23/06/2026
An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11…
An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2026-54313
Alta · 7.7
CWE-89 23/06/2026
n8n: NoSQL Injection in MongoDB Node Find And Replace Operation
n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in the MongoDB node's Find And Replace operation. The value was not validated before being passed to MongoDB as a query filter, allowing unintended documents to be matched and overwritten with attacker-controlled content. This vulnerability is fixed in 2.24.0.
CVE-2026-54310
Crítica · 9.9
CWE-89 23/06/2026
n8n: Injeção de SQL nos nós TimescaleDB e Postgres v1 (CVE-2026-54310)
n8n é uma plataforma de automação de fluxos de trabalho de código aberto. Antes das versões 2.25.7 e 2.26.2, um usuário autenticado com permissão para criar ou modificar fluxos de trabalho poderia fornecer parâmetros elaborados ao nó TimescaleDB e/ou ao nó legado Postgres v1, permitindo que SQL arbitrário fosse injetado e executado contra o banco de dados conectado, dentro dos privilégios da conta de banco de dados configurada. Esta vulnerabilidade está corrigida nas versões 2.25.7 e 2.26.2.
CVE-2026-52673
Média · 6.5
CWE-89 23/06/2026
SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to…
SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component
CVE-2026-56221
Média · 6.5
CWE-89 22/06/2026
Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts
Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can inject arbitrary SQL through deviceIds, search, version_name, cursor, and actions parameters to access analytics data belonging to other users or applications.
CVE-2026-44272
Alta · 8.8
CWE-89 22/06/2026
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization...
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-44271
Alta · 8.8
CWE-89 22/06/2026
SQL Injection em Dell Wyse Management Suite
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-7253
Média · 6.0
CWE-89 22/06/2026
IBM Sterling File Gateway SQL Injection
IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2025-66336
Alta · 8.1
CWE-89 22/06/2026
Apache Doris MCP Server: SQL injection leading the authentication bypass
Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymous attacker if authentication is disabled, to bypass SQL security validation and access metadata outside the intended database scope.
Affected users are recommended to upgrade to Doris version 0.6.1 or later, which fixes the issue.
CVE-2019-25761
Alta · 7.1
CWE-89 19/06/2026
Joomla! Component JoomCRM 1.1.1 SQL Injection via deal_id
Joomla! Component JoomCRM 1.1.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the deal_id parameter. Attackers can send GET requests to index.php with option=com_joomcrm&view=contacts and inject SQL code in the deal_id parameter to extract sensitive database information including table names and schemas.
CVE-2019-25759
Alta · 7.1
CWE-89 19/06/2026
Joomla! Component vBizz 1.0.7 SQL Injection
Joomla! Component vBizz 1.0.7 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the payid parameter. Attackers can submit POST requests to the employee management interface with crafted payid array values containing SQL commands to extract sensitive database information including version and database names.
CVE-2019-25757
Alta · 7.1
CWE-89 19/06/2026
Joomla vWishlist 1.0.1 SQL Injection via vproductid Parameter
Joomla vWishlist 1.0.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vproductid and userid parameters. Attackers can send POST requests to the component with crafted SQL payloads in these parameters to extract sensitive database information including version and database names.
CVE-2019-25756
Alta · 8.2
CWE-89 19/06/2026
Joomla! Component vAccount 2.0.2 SQL Injection via vaccount-dashboard
Joomla! Component vAccount 2.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the vid parameter. Attackers can send GET requests to the vaccount-dashboard/expense endpoint with crafted SQL payloads in the vid parameter to extract sensitive database information including version and database names.
CVE-2019-25755
Alta · 8.2
CWE-89 19/06/2026
Joomla vReview 1.9.11 SQL Injection via editReview
Joomla Component vReview 1.9.11 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the cmId parameter. Attackers can send POST requests to the editReview task endpoint with URL-encoded SQL UNION statements in the cmId parameter to extract database information including usernames, passwords, and database versions.