CWE-89: SQL Injection vulnerabilities

The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the write path correctly uses $wpdb->prepare(), but that protection is not carried forward to the read path, where the retrieved value is concatenated unsanitized into unprepared queries in both a single-quoted string context and a bare numeric context.

CVE-2026-89113 is an SQL injection vulnerability in SAP Commerce Cloud (OOTB Code) caused by insufficient validation of user-supplied input before incorporation into database queries. An authenticated user can exploit this flaw to inject arbitrary SQL commands, potentially leading to unauthorized reading, modification, or deletion of sensitive data. The vulnerability impacts confidentiality, integrity, and availability of the application with a high severity rating.

CVE-2026-105412 is an SQL Injection vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.5-1 through 17.5-35. This flaw could allow an attacker with limited privileges to read the Tuleap database. The vulnerability has a high severity rating with a CVSS score of 7.1. No official patch or remediation details are provided in the available data.

CVE-2026-1907 is a SQL Injection vulnerability in Kong Enterprise Gateway's clustering communication logic when operating in Hybrid Mode. It can be exploited by sending specially crafted RPC requests to the Control Plane, requiring network access to the Control Plane’s clustering port and valid client credentials. This vulnerability affects multiple versions of Kong Enterprise Gateway prior to specific patched releases. The CVSS 4.0 score is 7.5, indicating a high severity issue.

CVE-2026-109080 is a SQL injection vulnerability in the bulk license plate search feature of the Flock Night Shift hosted service. An authenticated user could exploit this flaw to read license plate recognition data belonging to other customer organizations. The vulnerability does not allow modification of data. Flock identified and remediated the issue on 2026-08-12, and no customer action is required.

CVE-2026-59508 is an SQL injection vulnerability in Interuse i-Bos version 3.0. It involves improper neutralization of special elements in SQL commands, which could allow an attacker to manipulate database queries. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. There is no indication of known exploits in the wild or available patches at this time.

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform blind SQL injection attacks.

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.

The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.

The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks.

The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX actions, allowing unauthenticated users to perform SQL injection attacks.