CWE-89

html5_snmp 1.11 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries thro

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL

Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate da

Web Ofisi Emlak v2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impac

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` met

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint du

SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_e

Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jell

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taki

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulner

The GEO my WP plugin for WordPress was vulnerable to SQL Injection via the 'distance', 'lat', and 'lng' parameters in ve

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulner

SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAp

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied paramete

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action befo

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using

The Ajax Load More WordPress plugin before 8.0.1 does not properly sanitise and escape a parameter before using it in a

The WPCargo Track & Trace WordPress plugin before 8.0.4 does not properly sanitise and escape a parameter before using i

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Ru

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQ

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace ad

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arb

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that th

n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an attacker with write access

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_qu

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL

A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allo

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injectio

A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminpr

Dell Unisphere for PowerMax, version(s) 10.2.0.x, contain(s) an Improper Neutralization of Special Elements used in an S

EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components o

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor

OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior,

OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior,

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScr

FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.81, FacturaScr

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQ

Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through

Docpedia developed by Flowring has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security S

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered

phpgurukul Student Management System 1.0 is vulnerable to SQL Injection in studentms/admin/search.php via the searchdata