Base de CVEs

CVE-2015-20121 Crítica · 9.8 CWE-89 16/03/2026

RealtyScript 4.0.2 SQL Injection via u_id and agent Parameters

Next Click Ventures RealtyScript 4.0.2 contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting arbitrary SQL code through the GET parameter 'u_id' in /admin/users.php and the POST parameter 'agent[]' in /admin/mailer.php. Attackers can exploit time-based blind SQL injection techniques to extract sensitive database information or cause denial of service through sleep-based payloads.

CVE-2015-20120 Crítica · 9.8 CWE-89 16/03/2026

Injeção de SQL Cega Baseada em Tempo no RealtyScript 4.0.2

A Next Click Ventures RealtyScript 4.0.2 contém múltiplas vulnerabilidades de injeção de SQL cega baseada em tempo que permitem que atacantes não autenticados extraiam informações do banco de dados ao injetar código SQL em parâmetros da aplicação. Atacantes podem elaborar requisições com payloads de atraso de tempo para inferir o conteúdo do banco de dados caractere por caractere, com base em diferenças no tempo de resposta.

CVE-2026-32459 Alta · 7.6 CWE-89 13/03/2026

WordPress UpsellWP plugin <= 2.2.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.

CVE-2026-32458 Alta · 7.6 CWE-89 13/03/2026

WordPress WOLF plugin <= 1.0.8.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 WOLF bulk-editor allows Blind SQL Injection.This issue affects WOLF: from n/a through <= 1.0.8.7.

CVE-2026-32433 Alta · 8.5 CWE-89 13/03/2026

WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: from n/a through <= 1.3.61.

CVE-2026-32422 Alta · 8.5 CWE-89 13/03/2026

WordPress WP EasyCart plugin <= 5.8.13 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through <= 5.8.13.

CVE-2026-32418 Alta · 7.6 CWE-89 13/03/2026

WordPress Meow Gallery plugin <= 5.4.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Blind SQL Injection.This issue affects Meow Gallery: from n/a through <= 5.4.4.

CVE-2026-32399 Alta · 8.5 CWE-89 13/03/2026

WordPress Media LIbrary Assistant plugin <= 3.32 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.

CVE-2026-32368 Alta · 8.5 CWE-89 13/03/2026

WordPress Geo to Lat plugin <= 1.0.19 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through <= 1.0.19.

CVE-2026-32366 Alta · 8.5 CWE-89 13/03/2026

WordPress Collapsing Categories plugin <= 3.0.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through <= 3.0.9.

CVE-2026-32365 Alta · 8.5 CWE-89 13/03/2026

WordPress Collapsing Archives plugin <= 3.0.7 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Archives collapsing-archives allows Blind SQL Injection.This issue affects Collapsing Archives: from n/a through <= 3.0.7.

CVE-2026-32358 Alta · 7.6 CWE-89 13/03/2026

WordPress Booking Calendar plugin <= 10.14.15 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdevelop Booking Calendar booking allows Blind SQL Injection.This issue affects Booking Calendar: from n/a through <= 10.14.15.

CVE-2026-32306 Crítica · 9.9 CWE-89 13/03/2026

Injeção de SQL no ClickHouse do OneUptime via parâmetros de agregação

OneUptime é uma solução para monitorar e gerenciar serviços online. Antes da versão 10.0.23, a API de agregação de telemetria aceita os parâmetros aggregationType, aggregateColumnName e aggregationTimestampColumnName controlados pelo usuário e os interpola diretamente em consultas SQL do ClickHouse por meio do método .append() (documentado como "SQL confiável"). Não há lista de permissões, vinculação de consultas parametrizadas nem validação de entrada. Um usuário autenticado pode injetar SQL arbitrário no ClickHouse, possibilitando leitura completa do banco de dados (incluindo dados de telemetria de todos os tenants), modificação de dados e potencial execução remota de código por meio de funções de tabela do ClickHouse. Esta vulnerabilidade está corrigida na versão 10.0.23.

CVE-2026-31922 Alta · 8.5 CWE-89 13/03/2026

WordPress Fox LMS plugin <= 1.0.6.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This issue affects Fox LMS: from n/a through <= 1.0.6.3.

CVE-2026-31917 Alta · 8.5 CWE-89 13/03/2026

WordPress WP ERP plugin <= 1.16.10 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through <= 1.16.10.

CVE-2026-25076 Alta · 7.3 CWE-89 13/03/2026

Anchore Enterprise GraphQL Reports API SQL injection

Anchore Enterprise versions before 5.25.1 contain an SQL injection vulnerability in the GraphQL Reports API. An authenticated attacker that is able to access the GraphQL API could execute arbitrary SQL instructions resulting in modifications to the data contained in the Anchore Enterprise database.

CVE-2026-22193 Alta · 7.5 CWE-89 13/03/2026

wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()

wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, and imported_from parameters to manipulate database queries and extract sensitive information.

CVE-2025-36368 Alta · 7.2 CWE-89 13/03/2026

IBM Sterling B2B Integrator and IBM Sterling File Gateway SQL Injection

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_1, and 6.2.1.0 through 6.2.1.1_1 are vulnerable to SQL injection. An administrative user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2026-32137 Alta · 8.8 CWE-89 12/03/2026

DataEase SQL Injection Vulnerability

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasource/previewData is directly concatenated into the SQL statement without any filtering or parameterization. Since tableName is a user-controllable string, attackers can inject malicious SQL statements by constructing malicious table names. This vulnerability is fixed in 2.10.20.

CVE-2026-26794 Alta · 8.8 CWE-89 12/03/2026

SQL Injection em GL.iNet Ar300m16 Firmware

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This vulnerability allows attackers to execute arbitrary SQL database operations via a crafted HTTP request.

CVE-2026-21708 Crítica · 9.9 CWE-89 12/03/2026

SQL Injection em Veeam Veeam Backup & Replication

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

CVE-2019-25543 Alta · 8.2 CWE-89 12/03/2026

Netartmedia Real Estate Portal 5.0 SQL Injection via index.php

Netartmedia Real Estate Portal 5.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the page parameter. Attackers can submit POST requests to index.php with malicious SQL payloads in the page field to bypass authentication, extract sensitive data, or modify database contents.

CVE-2019-25542 Alta · 8.2 CWE-89 12/03/2026

Netartmedia Real Estate Portal 5.0 SQL Injection via index.php

Netartmedia Real Estate Portal 5.0 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user_email parameter. Attackers can send POST requests to index.php with malicious payloads in the user_email field to bypass authentication, extract sensitive data, or modify database contents.

CVE-2019-25541 Alta · 8.2 CWE-89 12/03/2026

Netartmedia PHP Mall 4.1 Multiple SQL Injection

Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through unvalidated parameters. Attackers can inject time-based blind SQL payloads via the 'id' parameter in index.php or the 'Email' parameter in loginaction.php to extract sensitive database information.

CVE-2019-25540 Alta · 8.2 CWE-89 12/03/2026

Netartmedia PHP Mall 4.1 Multiple SQL Injection

Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code through various parameters. Attackers can craft malicious requests with SQL payloads to extract sensitive database information including user credentials and system data.