CVE Database

CVE-2026-18658 Critical · 9.8 CWE-89 Sep 4, 2026

IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

CVE-2026-85689 Medium · 6.5 CWE-89 Sep 4, 2026

llmware 0.4.6 SQL Injection via unescaped filter values

llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, in both the SQLite and PostgreSQL backends. The filter validator only checks keys against an allow-list and never sanitizes values. Attacker-controlled filter values reaching the public API via Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker can neutralize the intended filter to disclose rows the caller was scoped out of (cross-document/cross-collection disclosure); on PostgreSQL the flaw permits boolean- and UNION-based SQL injection.

CVE-2026-52691 High · 8.8 CWE-89 Sep 4, 2026

Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module

** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Griffin Hive Metastore Module. This issue affects Apache Griffin Hive Metastore Module: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVE-2026-18198 High · 8.8 CWE-89 Sep 4, 2026

SQL Injection in TAC Information's GoldenHorn

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe.

CVE-2026-85540 High · 8.8 CWE-89 Sep 4, 2026

Interinfo｜DreamMaker - SQL Injection

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

CVE-2026-57777 High · 7.6 CWE-89 Sep 4, 2026

WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.

CVE-2026-82186 Medium · 4.1 Public exploit CWE-89 Sep 4, 2026

WPLP Cookie Consent < 4.4.2 - Admin+ SQLi via 'offset' Parameter

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

CVE-2026-82527 High · 7.5 CWE-89 Sep 3, 2026

R2R 3.6.6 SQL Injection via Retrieval Search Filter Key

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates into the chunks search query by manipulating the filter key parameter in the retrieval search endpoint. Attackers can exploit the direct interpolation of filter keys into the SQL WHERE clause without parameterization or escaping to perform time-based and boolean-based data exfiltration from the application database.

CVE-2026-85388 High · 8.1 CWE-89 Sep 3, 2026

Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.

CVE-2026-82526 Critical · 9.8 CWE-89 Sep 3, 2026

R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint

R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements by manipulating the index name parameter in the vector index creation endpoint. The index name is interpolated directly into a CREATE INDEX statement via string formatting without identifier quoting or allowlist validation, enabling arbitrary DDL and DML execution through semicolon-separated statements under the PostgreSQL superuser account.

CVE-2026-84813 Critical · 9.3 CWE-89 Sep 3, 2026

WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.

CVE-2026-84768 Critical · 9.3 CWE-89 Sep 3, 2026

WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions.

CVE-2026-85155 High · 7.5 CWE-89 Sep 3, 2026

WWBN AVideo SQL Injection via get.json.php APIName channels

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the full query statement and database schema.

CVE-2026-78080 Critical · 9.3 CWE-89 Sep 3, 2026

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors.

CVE-2026-76176 High · 8.6 CWE-89 Sep 3, 2026

Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.

CVE-2026-76175 High · 8.6 CWE-89 Sep 3, 2026

Multiple vulnerabilities in Ocsreports for OCS Inventory NG

SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.

CVE-2026-79991 High · 7.1 CWE-89 Sep 2, 2026

Authenticated SQL Injection via nested eager-loading criteria

Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.

CVE-2026-81286 Critical · 9.3 CWE-89 Sep 2, 2026

WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

CVE-2026-14828 High · 8.8 CWE-89 Sep 2, 2026

SQL Injection in Zohocorp Manageengine Password Manager Pro

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.

CVE-2026-82182 Medium · 4.1 CWE-89 Sep 2, 2026

WPvivid Backup & Migration < 0.9.133 - Admin+ SQLi via Upload Cleaner Isolation

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.

CVE-2026-19704 Medium · 5.3 CWE-89 Sep 2, 2026

Comments – wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi

The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private and draft posts. The injected text reaches the query as grammar rather than as data and does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed comment content rather than the database at large.

CVE-2026-19754 High · 8.6 CWE-89 Sep 2, 2026

Baserow 2.3.3 - SQL injection in formula index() JSONB array extraction

Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The generated SQL executes through Baserow's database connection with the Baserow PostgreSQL role permissions, allowing data outside the user's workspace permissions to be read or modified.

CVE-2026-84208 High · 7.5 CWE-89 Sep 1, 2026

AVideo User_Location Plugin Unauthenticated SQL Injection

AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and cities.json.php endpoints. The country and region GET parameters are passed directly into SQL queries without escaping or prepared statement binding, allowing unauthenticated attackers to execute UNION-based SQL injection to read arbitrary database contents including password hashes and sensitive data.

CVE-2026-73721 High · 7.2 CWE-89 Sep 1, 2026

Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the underlying database potentially leading to complete compromise of the HPE Networking Fabric Composer host.

CVE-2026-18630 High · 8.8 CWE-89 Sep 1, 2026

SQL Injection in TMT Machine's Talassoft Industrial Management Software

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.