CWE-89: SQL Injection vulnerabilities

CVE-2026-102109 is a SQL injection vulnerability in Kiteworks Secure Data Forms. It occurs when a value derived from an authenticated user's stored account data is used in a database query without proper sanitization. Exploitation requires an authenticated session and only affects deployments using a specific optional feature. The vulnerability affects versions prior to 9.5.1.

Kiteworks Core versions prior to 9.5.0 contain a stored SQL injection vulnerability in an administrative reporting feature. This flaw allows an authenticated administrator to read sensitive database information and potentially disrupt service availability. Exploitation requires valid administrative credentials and access to the vulnerable reporting function.

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

CVE-2026-97287 is a high-severity SQL Injection vulnerability in Liquid Web / StellarWP Event Tickets plugin. It allows Blind SQL Injection due to improper neutralization of special elements in SQL commands. The issue affects versions from the initial release up to 5.29.5. No official patch or remediation details are provided in the available data.

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

Author SQL Injection in WP ERP <= 1.17.9 versions.

CVE-2026-94177 is a high-severity SQL Injection vulnerability in the GamiPress plugin by Ruben Garcia. It allows an attacker with limited privileges to perform blind SQL injection attacks, potentially leading to high confidentiality impact and limited availability impact. The vulnerability affects all versions from initial releases up to 8.0.2 inclusive. No official patch or remediation information is provided in the available data.

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

Author SQL Injection in Quiz Cat <= 3.1.1 versions.

Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date_start/date_end leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.