Base de CVEs

CVE-2026-108124 Média · 4.9 CWE-89 09/10/2026

WordPress Post Author Authenticated SQLi

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0.

CVE-2026-108107 Crítica · 9.8 CWE-89 09/10/2026

PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to extract customer records and credentials via time-based blind SQL injection.

CVE-2026-108100 Média · 6.5 CWE-89 09/10/2026

HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter

HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted include_info values to the /api/locations/list endpoint. Attackers can place subqueries in include_info, which PlantsModel::getSpecificInfo() concatenates into the column list, to read any database table including user password hashes.

CVE-2026-107803 Média · 6.5 CWE-89 09/10/2026

ProcessMaker has SQL injection in the tasks endpoint through the order_by parameter

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is vulnerable to SQL injection through the order_by parameter because `ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering()` concatenates a user-controlled process_requests column name into a DB::raw() SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account. This issue is fixed in version 2026.14.3.

CVE-2026-89235 Média · 6.8 CWE-89 09/10/2026

Testimonials by BestWebSoft 1.0.5 - 1.0.8 - Unauthenticated SQLi via 'offset' Parameter

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.

CVE-2026-96809 Crítica · 9.3 CWE-89 09/10/2026

Plugin EduAdmin Booking para WordPress - injeção de SQL

Neutralização imprópria de elementos especiais usados em um comando SQL ('SQL Injection') na vulnerabilidade em MultiNet Interactive AB EduAdmin Booking eduadmin-booking permite SQL Injection cego. Este problema afeta EduAdmin Booking: de n/a antes de 6.0.0.

CVE-2026-96331 Crítica · 9.3 CWE-89 09/10/2026

WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.

CVE-2026-96330 Crítica · 9.3 CWE-89 09/10/2026

Plugin tagDiv Opt-In Builder para WordPress até 1.7.6 - Injeção de SQL

Neutralização imprópria de elementos especiais usados em um comando SQL ('Injeção de SQL') na vulnerabilidade em tagDiv tagDiv Opt-In Builder td-subscription permite Injeção de SQL cega. Este problema afeta tagDiv Opt-In Builder: de n/a até 1.7.6.

CVE-2026-96329 Alta · 8.5 CWE-89 09/10/2026

WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.

CVE-2026-96328 Crítica · 9.3 CWE-89 09/10/2026

WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.

CVE-2026-96327 Crítica · 9.3 CWE-89 09/10/2026

WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.

CVE-2026-95610 Alta · 8.5 CWE-89 09/10/2026

WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core allows Blind SQL Injection.This issue affects UpSolution Core: from n/a through 9.3.

CVE-2026-95607 Alta · 8.5 CWE-89 09/10/2026

WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.

CVE-2026-95599 Alta · 8.5 CWE-89 09/10/2026

WordPress Taskbuilder plugin <= 6.0.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.

CVE-2026-94663 Alta · 8.5 CWE-89 09/10/2026

WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.

CVE-2026-93947 Crítica · 9.3 CWE-89 09/10/2026

WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

CVE-2026-106097 Média · 6.8 CWE-89 09/10/2026

Code Snippets < 3.10.0 - Admin+ SQLi in Migration Importers Leading to Network-Wide Credential Disclosure (Multisite)

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.

CVE-2026-84209 Crítica · 9.8 CWE-89 08/10/2026

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

CVE-2026-80381 Crítica · 9.8 CWE-89 08/10/2026

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection.

CVE-2026-81932 Crítica · 9.8 CWE-89 08/10/2026

Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2025-71428 Média · 4.9 CWE-89 08/10/2026

Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike() that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents, including other accounts' password hashes.

CVE-2026-16830 Média · 5.4 CWE-89 08/10/2026

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability.

CVE-2026-107385 Alta · 7.4 CWE-89 08/10/2026

MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

CVE-2026-107384 Alta · 8.1 CWE-89 08/10/2026

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

CVE-2026-107375 Alta · 8.8 CWE-89 08/10/2026

JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request parameter from paginated entity-list endpoints into createOrderByFields in generators/spring-boot/generators/data-relational/templates/src/main/java/package/repository/EntityManager_reactive.java.ejs. The generated code renders these properties into the SQL ORDER BY clause without validation or quoting, and the R2DBC simple query protocol can execute additional statements separated by semicolons. A normal authenticated user can consequently read sensitive tables, modify or delete data, or drop tables, while non-reactive JPA applications and NoSQL backends are outside this root cause. This issue is fixed in 9.4.0.