Base de CVEs

CVE-2026-5577 Alta · 8.6 CWE-89 05/04/2026

Song-Li cross_browser details Endpoint uniquemachine_app.py sql injection

A vulnerability has been found in Song-Li cross_browser up to ca690f0fe6954fd9bcda36d071b68ed8682a786a. This affects an unknown part of the file flask/uniquemachine_app.py of the component details Endpoint. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-34934 Crítica · 9.8 CWE-89 03/04/2026

PraisonAI: Second-Order SQL Injection in `get_all_user_threads`

PraisonAI is a multi-agent teams system. Prior to version 4.5.90, the get_all_user_threads function constructs raw SQL queries using f-strings with unescaped thread IDs fetched from the database. An attacker stores a malicious thread ID via update_thread. When the application loads the thread list, the injected payload executes and grants full database access. This issue has been patched in version 4.5.90.

CVE-2026-34788 Média · 6.5 CWE-89 03/04/2026

Emlog: SQL Injection in tag_model::updateTagName() via unsanitized parameters

Emlog is an open source website building system. In versions 2.6.2 and prior, a SQL injection vulnerability exists in include/model/tag_model.php at line 168. The updateTagName() function directly interpolates user input into the SQL query string without using parameterized queries or proper escaping ($this->db->escape_string()), making it vulnerable to SQL injection attacks. At time of publication, there are no publicly available patches.

CVE-2026-34612 Crítica · 9.0 CWE-89 03/04/2026

Kestra: Remote Code Execution via SQL Injection

Kestra is an open-source, event-driven orchestration platform. Prior to version 1.3.7, Kestra (default docker-compose deployment) contains a SQL Injection vulnerability that leads to Remote Code Execution (RCE) in the following endpoint "GET /api/v1/main/flows/search". Once a user is authenticated, simply visiting a crafted link is enough to trigger the vulnerability. The injected payload is executed by PostgreSQL using COPY ... TO PROGRAM ..., which in turn runs arbitrary OS commands on the host. This issue has been patched in version 1.3.7.

CVE-2026-27885 Alta · 7.2 CWE-89 03/04/2026

Piwigo: SQL Injection in Activity.getList

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to extract sensitive data from the database, including user credentials, email addresses, and all stored content. This issue has been patched in version 16.3.0.

CVE-2026-27834 Alta · 7.2 CWE-89 03/04/2026

Piwigo: SQL Injection in pwg.users.getList API Method via filter Parameter

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without proper sanitization, allowing authenticated administrators to execute arbitrary SQL commands. This issue has been patched in version 16.3.0.

CVE-2026-27634 Crítica · 9.8 CWE-89 03/04/2026

Piwigo: injeção de SQL pré-autenticação no filtro de datas de imagens

O Piwigo é uma aplicação de galeria de fotos para a web, de código aberto. Antes da versão 16.3.0, os quatro parâmetros de filtro de data (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) em ws_std_image_sql_filter() são concatenados diretamente em SQL, sem nenhum escape ou validação de tipo. Isso pode resultar em um atacante não autenticado lendo o banco de dados completo, incluindo hashes de senhas de usuários. Este problema foi corrigido na versão 16.3.0.

CVE-2026-25773 Média · 6.5 CWE-89 03/04/2026

Focalboard Second-Order SQL Injection in category reorder endpoint allows data exfiltration (unsupported product, no fix)

** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before incorporating them into dynamic SQL statements when reordering categories. An attacker can inject a malicious SQL payload into the category id field, which is stored in the database and later executed unsanitized when the category reorder API processes the stored value. This Second-Order SQL Injection (Time-Based Blind) allows an authenticated attacker to exfiltrate sensitive data including password hashes of other users. NOTE: Focalboard as a standalone product is not maintained and no fix will be issued.

CVE-2026-34825 Média · 6.5 CWE-89 02/04/2026

NocoBase Has SQL Injection via template variable substitution in workflow SQL node

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.30, NocoBase plugin-workflow-sql substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL. This issue has been patched in version 2.0.30.

CVE-2026-5368 Crítica · 9.8 CWE-89 02/04/2026

Projectworlds Car Rental Project: injeção de SQL em login.php pelo parâmetro uname

Foi identificada uma vulnerabilidade no projectworlds Car Rental Project 1.0. O elemento afetado é uma função desconhecida do arquivo /login.php do componente Parameter Handler. A manipulação do argumento uname causa injeção de SQL. A exploração remota do ataque é possível. O exploit foi divulgado publicamente e pode ser utilizado.

CVE-2026-34717 Alta · 8.1 CWE-89 02/04/2026

OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into SQL WHERE clauses without parameterization. This issue has been patched in version 17.2.3.

CVE-2026-5334 Crítica · 9.8 CWE-89 02/04/2026

Injeção de SQL no Online Enrollment System da itsourcecode via index.php

Foi identificada uma fraqueza no itsourcecode Online Enrollment System 1.0. Afetada está uma função desconhecida do arquivo /enrollment/index.php?view=edit&id=3 do componente Parameter Handler. Essa manipulação do argumento deptid causa injeção de SQL. O ataque pode ser realizado remotamente. O exploit foi disponibilizado ao público e pode ser usado em ataques.

CVE-2026-35168 Alta · 8.8 CWE-89 02/04/2026

OpenSTAManager: SQL Injection via Aggiornamenti Module

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in OpenSTAManager contains a database conflict resolution feature (op=risolvi-conflitti-database) that accepts a JSON array of SQL statements via POST and executes them directly against the database without any validation, allowlist, or sanitization. An authenticated attacker with access to the Aggiornamenti module can execute arbitrary SQL statements including CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, SELECT INTO OUTFILE, and any other SQL command supported by the MySQL server. Foreign key checks are explicitly disabled before execution (SET FOREIGN_KEY_CHECKS=0), further reducing database integrity protections. This issue has been patched in version 2.10.2.

CVE-2026-28805 Alta · 8.8 CWE-89 02/04/2026

OpenSTAManager: Time-Based Blind SQL Injection via `options[stato]` Parameter

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the options[stato] GET parameter. The user-supplied value is read from $superselect['stato'] and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and any other information stored in the MySQL database. This issue has been patched in version 2.10.2.

CVE-2026-33616 Alta · 7.5 CWE-89 02/04/2026

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the mb24api Endpoint

An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVE-2026-33615 Crítica · 9.1 CWE-89 02/04/2026

MB connect line mbCONNECT24 injeção SQL não autenticada no endpoint setinfo

Um atacante remoto não autenticado pode explorar uma vulnerabilidade de injeção SQL não autenticada no endpoint setinfo devido à neutralização inadequada de elementos especiais em um comando SQL UPDATE. Isso pode resultar em perda total de integridade e disponibilidade.

CVE-2026-33614 Alta · 7.5 CWE-89 02/04/2026

MB connect line mbCONNECT24 vulnerable to an unauthenticated SQL injection in the getinfo endpoint

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVE-2026-34747 Alta · 8.2 CWE-89 01/04/2026

Payload has an SQL Injection via Query Handling

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.

CVE-2026-34455 Alta · 8.8 CWE-89 01/04/2026

Hi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository Classes

Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, enabling SQL injection. The application uses PostgreSQL which supports stacked queries. This issue has been patched in version 1.7.1-beta.

CVE-2026-30273 Alta · 7.3 CWE-89 01/04/2026

SQL Injection em Gabrieleventuri Pandasai

pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query component.

CVE-2026-21630 Alta · 8.8 CWE-89 01/04/2026

Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

CVE-2025-13855 Alta · 8.8 CWE-89 31/03/2026

IBM Storage Protect Server is affected by a vulnerability that could allow authenticated users to access administrative metadata through the JSON-RPC endpoint .

IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2026-4668 Média · 6.5 CWE-89 31/03/2026

Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter

The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the `sort` parameter in the payments listing endpoint in all versions up to, and including, 2.1.2. This is due to insufficient escaping on the user-supplied `sort` parameter and lack of sufficient preparation on the existing SQL query in `PaymentRepository.php`, where the sort field is interpolated directly into an ORDER BY clause without sanitization or whitelist validation. PDO prepared statements do not protect ORDER BY column names. GET requests also skip Amelia's nonce validation entirely. This makes it possible for authenticated attackers, with Manager-level (`wpamelia-manager`) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection.

CVE-2026-34400 Crítica · 9.8 CWE-89 31/03/2026

alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.

CVE-2026-30520 Média · 5.4 CWE-89 31/03/2026

SQL Injection em Oretnom23 Loan Management System

A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save_loan action). The application fails to properly sanitize user input supplied to the "borrower_id" parameter in a POST request, allowing an authenticated attacker to inject malicious SQL commands.