CWE-89

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpf

SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-su

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements use

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote

Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote

Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remot

Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows re

Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remot

Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remot

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELE

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17):

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16):

Guardian language-system passes the name GET parameter directly into an unsanitized SQL query in designer.php (line 124)

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in translate_text.php (line

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vu

A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerabili

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy My

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized

The HCM developed by MetaGuru has a SQL Injection vulnerability. Authenticated remote attackers can inject SQL commands

A SQL Injection vulnerability exists in Apache Fineract's Report Execution API (runreports endpoint) in versions up to a

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component, allo

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL inje

Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: Product Security). Su

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privi

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatin

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated use

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-con

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Colu

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request pa

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by conc

Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because

Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-name

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query ope

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injectio

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulner

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hosti

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic in

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to de

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.