Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-15258
High · 8.1
CWE-89 Jul 31, 2026
Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter
The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.
CVE-2026-14554
Medium · 6.5
CWE-89 Jul 31, 2026
Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters
The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.
CVE-2026-12721
High · 8.6
CWE-89 Jul 31, 2026
Kirki < 6.0.13 - Unauthenticated SQL Injection
The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
CVE-2026-63221
Critical · 9.4
CWE-89 Jul 31, 2026
CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.
CVE-2026-62845
Medium · 4.7
CWE-89 Jul 30, 2026
Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers
Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have no format validation, so a value containing a quote character breaks out of the quoted identifier — SQL injection executed over Kamaji's root connection to the shared datastore. etcd driver is not affected.This issue is fixed in version 26.7.4-edge.
CVE-2025-69941
Critical · 9.8
CWE-89 Jul 30, 2026
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in…
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.
CVE-2025-69947
Critical · 9.8
CWE-89 Jul 30, 2026
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in…
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
CVE-2025-69938
Critical · 9.8
CWE-89 Jul 30, 2026
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
CVE-2025-69937
Critical · 9.8
CWE-89 Jul 30, 2026
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
CVE-2025-69936
Critical · 9.8
CWE-89 Jul 30, 2026
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
CVE-2025-69935
Critical · 9.8
CWE-89 Jul 30, 2026
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the…
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.
CVE-2025-69934
Critical · 9.8
CWE-89 Jul 30, 2026
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
CVE-2025-69933
Critical · 9.8
CWE-89 Jul 30, 2026
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
CVE-2025-69931
Critical · 9.8
CWE-89 Jul 30, 2026
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
CVE-2025-69930
Critical · 9.8
CWE-89 Jul 30, 2026
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in…
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.
CVE-2025-65336
Critical · 9.8
CWE-89 Jul 30, 2026
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in ...
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.
CVE-2026-4978
Critical · 9.8
CWE-89 Jul 30, 2026
SQLi in UMAI Vision's Traffic Analysis System
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection.
This issue affects Traffic Analysis System: from 30 before 34.
CVE-2026-54368
High · 8.8
CWE-89 Jul 30, 2026
CentreStack < 17.4 SQL Injection via x-glad-filter Header
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to the server filesystem via PostgreSQL lo_from_bytea() and lo_export() functions, enabling remote code execution.
CVE-2026-17543
Critical · 9.8
CWE-89 Jul 30, 2026
SQL injection in ext-pgsql via E'...' backslash breakout
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
CVE-2026-22620
High · 8.6
CWE-89 Jul 30, 2026
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM...
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device.
CVE-2026-58046
Critical · 9.9
CWE-89 Jul 30, 2026
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged...
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
CVE-2026-15153
Medium · 6.8
CWE-89 Jul 30, 2026
WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks.
CVE-2026-13395
High · 8.6
CWE-89 Jul 30, 2026
Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.
CVE-2026-48448
High · 8.6
CWE-89 Jul 30, 2026
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-16092
Medium · 6.5
CWE-89 Jul 30, 2026
Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'meta_key' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.