CVE Database

CVE-2026-81809 High · 7.5 CWE-89 Oct 1, 2026

Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials, allowing unauthenticated users to perform SQL injection attacks.

CVE-2026-102109 High · 7.1 CWE-89 Sep 30, 2026

Kiteworks Secure Data Forms SQL injection

A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to deployments where a specific optional feature is in use.

CVE-2026-102098 High · 7.2 CWE-89 Sep 30, 2026

Kiteworks Core SQL Injection

Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affect the availability of the service. Exploitation requires an existing, authenticated administrative account with access to the affected reporting function.

CVE-2026-76570 Critical · 9.1 Public exploit CWE-89 Sep 30, 2026

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

CVE-2026-62097 High · 7.6 CWE-89 Sep 30, 2026

WordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-directory-plugin allows Blind SQL Injection.This issue affects Business Directory: from n/a through 6.4.27.

CVE-2026-18782 Critical · 9.8 Public exploit CWE-89 Sep 30, 2026

SQL Injection in Trex Digital Manufacturing's Trex MES

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

CVE-2026-82307 Critical · 9.8 CWE-89 Sep 30, 2026

Multiple Vulnerabilities in Dolusoft Software's SOPLOG

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.

CVE-2026-97293 High · 8.5 CWE-89 Sep 30, 2026

WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

CVE-2026-97287 High · 8.5 CWE-89 Sep 30, 2026

WordPress Event Tickets plugin <= 5.29.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.

CVE-2026-96828 High · 7.6 CWE-89 Sep 30, 2026

WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

CVE-2026-96827 High · 7.6 CWE-89 Sep 30, 2026

WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

CVE-2026-96822 Critical · 9.3 CWE-89 Sep 30, 2026

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

CVE-2026-96346 High · 7.6 CWE-89 Sep 30, 2026

WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability

Author SQL Injection in WP ERP <= 1.17.9 versions.

CVE-2026-96345 High · 7.6 CWE-89 Sep 30, 2026

WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability

Administrator SQL Injection in Estatik <= 4.3.5 versions.

CVE-2026-94177 High · 8.5 CWE-89 Sep 30, 2026

WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.

CVE-2026-94115 High · 8.5 CWE-89 Sep 30, 2026

WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

CVE-2026-94082 High · 7.6 CWE-89 Sep 30, 2026

WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability

Author SQL Injection in Quiz Cat <= 3.1.1 versions.

CVE-2026-93621 High · 8.2 CWE-89 Sep 30, 2026

WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability

Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

CVE-2026-62085 High · 7.6 CWE-89 Sep 30, 2026

WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability

Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

CVE-2026-102578 High · 8.8 CWE-89 Sep 30, 2026

Moodle: sql injection in question bank web service

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

CVE-2026-102456 Medium · 6.5 CWE-89 Sep 30, 2026

DigiWin｜EasyFlow .NET - SQL Injection

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.

CVE-2026-6806 High · 7.5 CWE-89 Sep 30, 2026

Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2026-16596 Medium · 6.5 CWE-89 Sep 30, 2026

WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2026-51936 Low · 2.1 CWE-89 Sep 29, 2026

SQL Injection in Zetetic SQLCipher

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus the function temporarily clears defensive restrictions during operation. A vulnerability in the handling of the source database name parameter made it possible for a caller to supply a crafted source name, which could execute statements that defensive mode would otherwise block. This could allow direct modifications to the sqlite_schema table and database corruption. SQLCipher 4.15.0 now strictly validates the source database name and prevents the bypass.

CVE-2026-72510 Critical · 9.0 CWE-89 Sep 29, 2026

Toptech TMS7 and TopHAT SQL Injection

The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection.