CVE Database

CVE-2026-66631 High · 7.6 CWE-89 Sep 17, 2026

WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability

Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.

CVE-2026-66630 High · 7.6 CWE-89 Sep 17, 2026

WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability

Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

CVE-2026-66628 High · 7.6 CWE-89 Sep 17, 2026

WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability

Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.

CVE-2026-66626 High · 7.6 CWE-89 Sep 17, 2026

WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability

Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.

CVE-2026-66625 High · 7.6 CWE-89 Sep 17, 2026

WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability

Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.

CVE-2026-66624 High · 7.6 CWE-89 Sep 17, 2026

WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability

Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.

CVE-2026-66619 High · 7.6 CWE-89 Sep 17, 2026

WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability

Administrator SQL Injection in Newsletters <= 4.18 versions.

CVE-2026-66618 High · 7.6 CWE-89 Sep 17, 2026

WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability

Administrator SQL Injection in WP Maps <= 4.9.9 versions.

CVE-2026-66580 High · 8.5 CWE-89 Sep 17, 2026

WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability

Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.

CVE-2026-92903 High · 8.2 CWE-89 Sep 17, 2026

Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can cause Snowflake CLI to execute attacker-controlled SQL statements in the context of the victim's Snowflake session and active role. Successful exploitation requires either write or pull-request access to a project repository whose CI/CD pipeline runs Snowflake CLI under an elevated service account role, or the ability to supply untrusted input to CLI-wrapping automation. Impact is limited by the privileges held by the configured Snowflake role at execution time. The fix is available in Snowflake CLI version 3.27.0, which also addresses several additional security findings. Users must manually upgrade.

CVE-2026-87963 High · 8.6 CWE-89 Sep 17, 2026

Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

CVE-2026-76449 Medium · 4.9 CWE-89 Sep 16, 2026

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76448 Medium · 4.9 CWE-89 Sep 16, 2026

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the affected APIs before it is used to build database queries. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to execute arbitrary SQL or HQL queries against the underlying database, which could allow the attacker to view or modify data that they are not authorized to access. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76428 Medium · 4.9 CWE-89 Sep 16, 2026

Cisco ISE Profiler SQL Injection Vulnerability

A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the session database. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76426 Medium · 4.9 CWE-89 Sep 16, 2026

Cisco ISE REST API SQL Injection Vulnerability

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL statement. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements in one of the affected parameters. A successful exploit could allow the attacker to read information from the monitoring database. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-76425 High · 7.6 CWE-89 Sep 16, 2026

Cisco ISE SQL Injection Vulnerability

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could exploit this vulnerability by sending a crafted request that contains SQL statements to an affected endpoint. A successful exploit could allow the attacker to read arbitrary content from the SQL database and conduct server-side request forgery (SSRF) attacks. To exploit this vulnerability, the attacker must have valid administrative credentials.

CVE-2026-75513 Critical · 9.1 CWE-89 Sep 16, 2026

Marten: SQL injection in Marten's LINQ provider via unescaped string literals

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.

CVE-2026-20344 High · 8.8 CWE-89 Sep 16, 2026

Cisco Secure Firewall Management Center Software SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of Security Approver, Access Admin, or Network Admin. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain any data from the database, obtain the session credentials of an authenticated Administrator, and take actions with administrative privileges on the affected device.

CVE-2026-20300 High · 7.1 CWE-89 Sep 16, 2026

Cisco Identity Services Engine SQL Injection Vulnerability

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to read or modify data in the underlying database.

CVE-2026-20247 High · 7.5 CWE-89 Sep 16, 2026

Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to modify data in the underlying database.

CVE-2026-20235 Medium · 4.9 CWE-89 Sep 16, 2026

Cisco Identity Services Engine Information Disclosure Vulnerability

A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to gain access to sensitive information, including hashed credentials that could be used in future attacks.

CVE-2026-87105 High · 8.8 CWE-89 Sep 16, 2026

Tanium addressed a SQL injection vulnerability in Threat Response.

CVE-2026-87024 High · 7.2 CWE-89 Sep 16, 2026

Tanium addressed a SQL injection vulnerability in Asset.

CVE-2026-86865 High · 7.2 CWE-89 Sep 16, 2026

Tanium addressed a SQL injection vulnerability in Asset.

CVE-2026-20361 High · 8.8 CWE-89 Sep 16, 2026

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - SQL Injection

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues that are grouped under the Common Weakness Enumeration (CWE) CWE-89.