Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2026-37344
Alta · 7.2
CWE-89 16/04/2026
SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL…
SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_location.php.
CVE-2026-37343
Alta · 7.2
CWE-89 16/04/2026
SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL…
SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_user.php.
CVE-2026-37342
Alta · 7.2
CWE-89 16/04/2026
SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL…
SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/view_parked_details.php.
CVE-2026-37341
Alta · 7.2
CWE-89 16/04/2026
SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL…
SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_category.php.
CVE-2026-37340
Crítica · 9.8
CWE-89 16/04/2026
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection…
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/edit_music.php.
CVE-2026-37339
Crítica · 9.8
CWE-89 16/04/2026
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection…
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_genre.php.
CVE-2026-37338
Crítica · 9.4
CWE-89 16/04/2026
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection…
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php.
CVE-2026-37337
Alta · 7.3
CWE-89 16/04/2026
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection…
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.
CVE-2026-37336
Alta · 7.3
CWE-89 16/04/2026
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection…
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.
CVE-2026-5785
Alta · 8.1
CWE-89 16/04/2026
SQL Injection
Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.
CVE-2026-3489
Alta · 7.5
CWE-89 16/04/2026
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Unauthenticated SQL Injection via 'packages'
The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, and including, 3.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-3773
Média · 6.5
CWE-89 16/04/2026
Accessibility Suite by Ability, Inc <= 4.20 - Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter
The Accessibility Suite by Ability, Inc plugin for WordPress is vulnerable to SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-3599
Alta · 7.5
CWE-89 16/04/2026
Riaxe Product Customizer <= 2.1.2 - Unauthenticated SQL Injection via 'options' Parameter Keys in product_data
The Riaxe Product Customizer plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter keys within 'product_data' of the /wp-json/InkXEProductDesignerLite/add-item-to-cart REST API endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied parameter and insufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-30995
Alta · 8.6
CWE-89 15/04/2026
Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via…
Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.
CVE-2026-20061
Média · 6.5
CWE-89 15/04/2026
Cisco Unity Connection SQL Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP(S) request to the web-based management interface of an affected device. A successful exploit could allow the attacker to view data on the affected device.
CVE-2025-63029
Alta · 7.6
CWE-89 15/04/2026
WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.
CVE-2026-40745
Alta · 7.6
CWE-89 15/04/2026
WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: from n/a through <= 8.4.2.
CVE-2026-40744
Alta · 8.5
CWE-89 15/04/2026
WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through <= 2.10.1.2.
CVE-2026-33714
Alta · 7.2
CWE-89 14/04/2026
Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)
Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix for CVE-2026-30881. While CVE-2026-30881 was patched by applying Security::remove_XSS() to the date_start and date_end parameters in the get_user_registration_by_month action, the same parameters remain unsanitized in the users_active action within the same file (public/main/inc/ajax/statistics.ajax.php), where they are directly interpolated into a SQL query. An authenticated admin can exploit this to perform time-based blind SQL injection, enabling extraction of arbitrary data from the database. This issue has been fixed in version 2.0.0.
CVE-2026-32176
Alta · 7.8
CWE-89 14/04/2026
SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-32167
Alta · 7.8
CWE-89 14/04/2026
SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
CVE-2026-39815
Alta · 8.8
CWE-89 14/04/2026
A improper neutralization of special elements used in an sql command ('sql injection')...
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7.2.2 may allow attacker to execute unauthorized code or commands via sending crafted HTTP requests
CVE-2026-39809
Média · 6.7
CWE-89 14/04/2026
A improper neutralization of special elements used in an sql command ('sql injection')...
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2.0 through 7.2.12, FortiClientEMS 7.0 all versions may allow attacker to execute unauthorized code or commands via sending crafted requests
CVE-2026-38528
Alta · 7.1
CWE-89 14/04/2026
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the…
Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php.
CVE-2025-65135
Crítica · 9.8
CWE-89 14/04/2026
In manikandan580 School-management-system 1.0, a time-based blind SQL injection…
In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.