CWE-89: SQL Injection vulnerabilities

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network those belong to subsite Administrators, allowing a subsite Administrator who is not a network Super Admin to perform UNION-based SQL injection against shared network tables and disclose network-wide data such as other users' password hashes.

CVE-2026-80381 is a critical SQL injection vulnerability in IBM Guardium Data Protection versions 12.0, 12.1, and 12.2. This flaw allows a remote attacker to execute unauthorized SQL commands without any privileges or user interaction, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 contain a SQL injection vulnerability that allows a remote unauthenticated attacker to send specially crafted SQL statements. This could enable the attacker to view, add, modify, or delete data in the back-end database. The vulnerability has a high severity score of 8.6 and affects these specific versions.

IBM Guardium Data Protection versions 12.2.2 and 12.1 contain a SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This flaw could allow a remote attacker to execute arbitrary SQL commands on the affected systems without authentication. The vulnerability has a high severity rating with a CVSS score of 8.1. No information about available patches or vendor advisories is provided.

CVE-2026-16830 is an SQL injection vulnerability in IBM Security Verify Access and IBM Verify Identity Access versions 10.0 through 10.0.9.2 and 11.0 through 11.0.3. A remote authenticated attacker could exploit this flaw to modify data and cause a denial of service. The vulnerability has a medium severity with a CVSS score of 5.4.

MariaDB Connector/Node.js versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contain a SQL injection vulnerability due to improper escaping of special characters in text-protocol mode when the NO_BACKSLASH_ESCAPES SQL mode is enabled. This allows an attacker to inject arbitrary SQL commands by closing string literals improperly. The vulnerability does not affect execute() and batch() methods that use binary protocols. Fixed versions have been released to address this issue.

MariaDB Connector/Node.js versions from 3.2.0 up to but not including 3.2.5, 3.3.0 up to 3.3.4, 3.4.0 up to 3.4.7, and 3.5.0-rc.0 up to 3.5.4 contain a SQL injection vulnerability when the permitSetMultiParamEntries option is enabled. This flaw allows attacker-controlled keys with backticks to inject arbitrary SQL commands, potentially modifying unintended database columns and executing commands with the database user's privileges. The option is disabled by default, and serialized-object handling when disabled is not affected. The issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

JHipster generator-jhipster versions from 7.0.0 up to but not including 9.4.0 contain an SQL injection vulnerability in reactive applications using Spring WebFlux, Spring Data R2DBC, and SQL databases. The vulnerability arises because attacker-controlled sort parameters are passed into SQL ORDER BY clauses without validation or quoting, allowing execution of additional SQL statements. This can enable an authenticated user to read sensitive data, modify or delete data, or drop tables. The issue is fixed in version 9.4.0.

CVE-2026-12260 is a critical SQL injection vulnerability in the NetBoard CRM Demo Platform. It affects the 'user-name' POST parameter at the '/module/auth/recovery.php' endpoint. The flaw allows blind SQL injection attacks using Boolean, error, time-based, and UNION techniques. Exploitation can lead to unauthorized data extraction, including backend version and type, data alteration, or further system compromise.

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.

CVE-2026-62251 is a high-severity SQL injection vulnerability in sipcapture homer, an open source telecom observability software. Versions prior to 11.0.283 allow authenticated users to execute arbitrary SQL commands via the V4StatisticsQuery handler, which fails to validate user-supplied SQL queries properly. This issue is patched in version 11.0.283.

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation of this vulnerability could allow the attacker to perform SQL injection attacks on the targeted system.

An unauthenticated SQL injection vulnerability exists in the OrdaSoft Simple Membership extension for Joomla versions 1.0.0 through 7.4.0. The vulnerability occurs because the extension's site/simplemembership.php script dispatches the task=checkLoginPass without any authentication or access control. It reads a login request parameter using Joomla's generic input filter, which does not sanitize quotes or SQL syntax, and directly concatenates this input into an SQL query without escaping or parameterization.

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes.

### Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. #### You are affected if: - You use `@payloadcms/db-sqlite` or `@payloadcms/db-d1-sqlite`. - You use `@payloadcms/db-postgres` or `@payloadcms/db-vercel-postgres` `< 3.73.0`. - A readable collection has a `json` field, or a` blocks` field with `blocksAsJSON: true`. - The attacker has read plus create or update access on it. #### You are not affected if: - You have no `json or `blocksAsJSON` fields. `richText` is not affected. - You run a patched version. ### Patches The patched version sanitizes the query input to prevent injection. Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.

### Impact A user can submit a request that exploits a SQL Injection vulnerability in Payload. You are affected if: - You use an affected Payload version. - Untrusted users can query readable collections using dynamic filters or joins. You are not affected if you use MongoDB (`@payloadcms/mongodb`). ### Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`. ### Workarounds Upgrading to a patched version is recommended. Until you can upgrade, restrict untrusted users from supplying dynamic query filters or join parameters and limit read access to affected collections.