Total
19913 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-25347 | 2026-07-23 | N/A | 7.1 HIGH | ||
| WordPress Contact Form Maker Plugin 1.12.20 contains SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries through the FormMakerSQLMapping and generete_csv_fmc AJAX actions. Attackers can inject malicious SQL code via the 'name' and 'search_labels' parameters to extract sensitive database information or escalate privileges. | |||||
| CVE-2026-48236 | 2026-07-23 | N/A | 7.1 HIGH | ||
| Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are concatenated into mysqli connection arguments and dynamic SQL operating against an attacker-controlled database without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. | |||||
| CVE-2026-9082 | 1 Drupal | 1 Drupal | 2026-07-23 | N/A | 9.8 CRITICAL |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10. | |||||
| CVE-2026-25606 | 2026-07-23 | N/A | N/A | ||
| A SQL injection vulnerability has been identified in STER. Improper neutralization of input provided by user into multiple Search Filters allows for SQL Injection attacks. It allows an authenticated attacker to view sensitive data such as data belonging to other users, or any other data that the application itself is able to access This issue was fixed in version 9.5. | |||||
| CVE-2026-48240 | 2026-07-23 | N/A | 7.1 HIGH | ||
| Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents. | |||||
| CVE-2026-47255 | 2026-07-23 | N/A | 8.2 HIGH | ||
| AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched. | |||||
| CVE-2016-20096 | 2026-07-23 | N/A | 9.8 CRITICAL | ||
| Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges. | |||||
| CVE-2026-63080 | 2026-07-23 | N/A | 6.5 MEDIUM | ||
| Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through EventName, CountryCode, OsName, DeviceModel, AppVersion, or SessionId parameters to inject a UNION ALL statement that bypasses the app_id tenant isolation filter across thirteen of the fifteen stats API endpoints. | |||||
| CVE-2026-65462 | 2026-07-23 | N/A | 7.6 HIGH | ||
| Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. | |||||
| CVE-2026-61950 | 2026-07-23 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | |||||
| CVE-2026-61948 | 2026-07-23 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | |||||
| CVE-2026-15906 | 2026-07-23 | N/A | 6.5 MEDIUM | ||
| The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |||||
| CVE-2026-13119 | 2026-07-23 | N/A | 6.5 MEDIUM | ||
| The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL Injection via JSON keys in the 'standard' parameter handled by the rtec_records_edit AJAX action in versions up to and including 3.2. The handler decodes attacker-controlled JSON from $_POST['standard'] and uses the JSON array keys directly as column identifiers in the SET clause of an UPDATE statement built inside RTEC_Db_Admin::update_entry(). Only esc_sql() (mysqli_real_escape_string) is applied to the identifier; that function escapes quotes, backslashes, and a few control characters but does not escape spaces, equals signs, parentheses, or hyphens, so an attacker can break out of the identifier context and inject subqueries (terminated with a SQL comment). This makes it possible for authenticated attackers, with Contributor-level access and above who can edit the targeted event, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | |||||
| CVE-2026-15761 | 2026-07-23 | N/A | 6.5 MEDIUM | ||
| The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied. | |||||
| CVE-2026-44047 | 2026-07-23 | N/A | 8.8 HIGH | ||
| An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data, modify data, or cause a denial of service. | |||||
| CVE-2026-7253 | 1 Ibm | 1 Watson Speech Services Cartridge | 2026-07-23 | N/A | 6.0 MEDIUM |
| IBM Sterling B2B Integrator and IBM Sterling File Gateway are vulnerable to SQL injection. A privileged user could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. | |||||
| CVE-2026-65494 | 2026-07-23 | N/A | 7.1 HIGH | ||
| Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. | |||||
| CVE-2026-65451 | 2026-07-23 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in MapSVG <= 8.14.0 versions. | |||||
| CVE-2026-65450 | 2026-07-23 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in MapSVG <= 8.14.0 versions. | |||||
| CVE-2026-59526 | 2026-07-23 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |||||