Koha Community's Koha software is affected by a SQL injection vulnerability in the Most-circulated items report. The vulnerability arises from unsafe concatenation of user-controlled parameters into SQL queries without proper validation or sanitization. Authenticated staff users with reports module permission can exploit this to execute arbitrary SQL commands and access sensitive database information. The issue is fixed in Koha versions 24.11.19, 25.05.14, 25.11.08, and 26.05.03.
CVE-2026-89310 is a critical SQL injection vulnerability in JTL SW GmbH's JTL-WMS product. It arises because a parameter from the request body is directly inserted into a T-SQL statement without proper parameterization or escaping. This flaw allows a remote attacker to execute arbitrary SQL commands with the application's database privileges. The vulnerability affects multiple versions prior to 2.0.7, 2.1.3, and 2.2.1. The CVSS 4.0 score is 9.4, indicating a high severity with network attack vector and no user interaction required.
CVE-2026-89288 is a high-severity SQL injection vulnerability in the Fast Courier WordPress plugin versions 5.0.0 up to but not including 5.2.4. The flaw arises because the plugin fails to sanitize and escape input on an unauthenticated REST API route, allowing attackers to inject SQL commands. This can lead to unauthorized reading of arbitrary data from the database without authentication.
CVE-2026-103307 is a high-severity SQL injection vulnerability in the Walletdoc Payment Gateway for WooCommerce WordPress plugin versions before 1.8.5. The plugin fails to properly sanitize and escape user input in SQL statements and uses a payment webhook signing secret that is empty by default. This allows unauthenticated attackers to perform SQL injection attacks and mark arbitrary orders as paid.
The Hyyan WooCommerce Polylang Integration WordPress plugin versions up to and including 1.5.0 contain an SQL Injection vulnerability via the 'variation_ids' parameter in the 'woocommerce_remove_variations' AJAX action. Authenticated users with Subscriber-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation of user-supplied input.
The Form Maker by 10Web plugin for WordPress up to version 1.15.48 is vulnerable to a blind SQL Injection via the 'inputs' parameter. This vulnerability allows unauthenticated attackers to append SQL queries due to insufficient input escaping and lack of query preparation. The nonce required to exploit this is publicly accessible on pages rendering the form, making exploitation trivial. The vulnerability can lead to unauthorized extraction of sensitive database information.
The JTL-Connector for WooCommerce WordPress plugin is vulnerable to a time-based SQL Injection via the 'product.push' identity endpoint in all versions up to and including 2.4.3. This vulnerability allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and lack of prepared statements, potentially exposing sensitive database information. Exploitation occurs before the product handling logic, enabling the attack even if downstream processes would normally reject the request.
The Gmedia Photo Gallery WordPress plugin up to version 1.25.1 contains a time-based SQL Injection vulnerability via the 'gmedia__in' parameter. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient input escaping and lack of proper query preparation. The vulnerability is exploitable without any authentication because the mobile app endpoint dispatches the library action without validating feature flags, nonces, or user sessions.
Abandoned Cart Pro for WooCommerce plugin versions up to 10.8.0 are vulnerable to an unauthenticated SQL Injection via the 'validate' parameter. This vulnerability allows attackers to append arbitrary SQL queries due to insufficient input escaping and lack of proper query preparation. The plugin uses AES-CTR encryption which is malleable, enabling attackers who obtain a legitimate token to forge SQL-carrying ciphertexts. Although an HMAC check was introduced in version 10.4.1, it is only enforced when the 'wcap_nonce' parameter is present, allowing attackers to bypass it by omitting this parameter.
Abandoned Cart Pro for WooCommerce plugin versions up to and including 10.8.0 contain a critical SQL Injection vulnerability. The flaw arises from improper sanitization of user input in the update_guest_persistent_cart() function, allowing unauthenticated attackers to inject SQL commands via the guest cart persistent meta_value. This vulnerability enables attackers to extract sensitive data and escalate privileges by modifying usermeta entries, including elevating arbitrary accounts to administrator.
Adobe Experience Manager 6.5 contains an SQL Injection vulnerability (CWE-89) that allows a low-privileged attacker to bypass security features and gain unauthorized read and limited write access. Exploitation does not require user interaction. The vulnerability affects versions up to and including 6.5.25. The CVSS 3.1 score is 7.1, indicating high severity.
CVE-2026-88075 is a high-severity SQL Injection vulnerability in Microsoft Configuration Manager. It allows an authorized attacker to elevate privileges over a network by exploiting improper neutralization of special elements in SQL commands. The vulnerability affects versions prior to 5.00.9135.1040, 5.00.9141.1039, and 5.00.9146.1026. Official patches are available for all affected versions.
CVE-2026-70049 is a high-severity SQL Injection vulnerability in Microsoft Configuration Manager. It allows an authorized attacker with limited privileges to elevate their privileges over an adjacent network by exploiting improper neutralization of special elements in SQL commands. The issue affects versions prior to 5.00.9135.1042, 5.00.9141.1041, and 5.00.9146.1027, where official fixes have been released.
CVE-2026-70266 is a high-severity SQL injection vulnerability in Microsoft SharePoint Server Subscription Edition. It allows an authorized attacker to execute malicious SQL commands, potentially elevating privileges over a network. The vulnerability affects versions from 16.0.0 up to but not including 16.0.20326.20190. An official fix is available in version 16.0.20326.20190.
A SQL injection vulnerability (CWE-89) exists in Payload CMS due to improper neutralization of user input in the 'in' and 'not_in' query parameters. This flaw allows an authenticated attacker to perform SQL injection attacks. The vulnerability affects versions prior to 3.90.0 and certain canary versions before 4.0.0-canary.34. It has a high severity with a CVSS 4.0 score of 8.7. The issue has been fixed in Payload CMS versions 3.90.0 and 4.0.0-canary.34.
CVE-2026-89201 is a high-severity SQL injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The flaw arises from improper validation or sanitization of input in device group or facility names during the Bulk Export workflow. An authenticated attacker with limited privileges could exploit this to execute arbitrary SQL commands on the underlying database, potentially compromising confidentiality, integrity, and availability.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.
CVE-2026-89197 is a high-severity SQL injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The issue arises from improper validation or sanitization of input in the Value field of notification conditions during Notification Profile configuration. An authenticated attacker with specific privileges could exploit this flaw to execute arbitrary SQL commands on the device's underlying database.
CVE-2026-89196 is a high-severity SQL injection vulnerability in Siemens RUGGEDCOM CROSSBOW affecting all versions prior to 6.0. The flaw arises from improper validation or sanitization of input in facility names during the Bulk Import/Export workflow. An authenticated attacker with specific privileges could exploit this to execute arbitrary SQL commands on the device's underlying database, potentially leading to full compromise of confidentiality, integrity, and availability.