CWE-89: SQL Injection vulnerabilities

CVE-2026-100739 is a medium severity SQL injection vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting the viewresult.php file. The vulnerability arises from manipulation of the 'seno' argument, allowing remote attackers to perform SQL injection. The vendor has not responded to disclosure attempts, and no patch or fixed version information is available due to the product's rolling release model. Exploit code is publicly available, but no confirmed exploitation in the wild has been reported.

The UP plugin for Joomla by lomart.fr contains multiple SQL injection vulnerabilities in versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29. These vulnerabilities allow attackers to improperly neutralize special elements in SQL commands, potentially enabling manipulation of database queries. The issue is classified under CWE-89 and has a high severity rating with a CVSS score of 8.3.

A vulnerability in the AcyMailing extension for Joomla versions 6.0.0 through 11.0.5 allows an unauthenticated subscriber to delete arbitrary files on the server. This occurs because a subscriber can store a path in a file-type custom field, which the extension deletes when the field is cleared, including files outside the intended upload folder such as configuration.php. The vulnerability is classified as CWE-89 (SQL Injection) and has a high severity with a CVSS score of 8.3.

An unauthenticated SQL injection vulnerability exists in the YouTube Gallery extension for Joomla versions 1.0.0 through 5.7.2. The flaw affects the video search and sorting functionality, allowing attackers to inject SQL commands in read queries. This vulnerability is classified as CWE-89 and has a critical severity rating with a CVSS 4.0 score of 9.3.

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

A SQL injection vulnerability exists in the wp-review-slider-pro WordPress plugin versions before 12.7.12. The flaw arises because an AJAX handler does not sanitize input and lacks a capability check, allowing any authenticated user, including low-privileged roles like subscribers, to inject SQL commands. The results of these injections can be returned to unauthenticated visitors. This vulnerability has a CVSS score of 6.5, indicating a medium severity risk.

CVE-2026-89237 is a SQL Injection vulnerability in the Bluff Post WordPress plugin up to version 1.1.1. The plugin fails to properly sanitize and escape parameters used as SQL identifiers, allowing unauthenticated attackers to append malicious SQL code and extract sensitive database information. The vulnerability has a medium severity with a CVSS score of 6.8.

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database.

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to generic SQL Injection via 'group_id' Message Meta Parameter in all versions up to, and including, 3.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the BuddyBoss Platform plugin to be installed with its Social Groups component disabled, a state that persists on any site that has previously toggled the Groups component off since BuddyBoss does not drop the wp_bp_groups table upon deactivation.

phpMyFAQ versions prior to 4.2.0-alpha contain an authenticated SQL LIKE wildcard injection vulnerability in the chat user search feature. This flaw allows any logged-in user to bypass the intended display-name search filter and enumerate active users by exploiting unescaped SQL LIKE wildcards '%' and '_'. The issue is fixed in version 4.2.0-alpha.

phpMyFAQ versions prior to 4.1.6 contain an SQL injection vulnerability in the StopWords::add() method. This method improperly constructs an SQL INSERT statement by directly embedding user-supplied input without proper escaping. An authenticated administrator with access to the stop-word management feature can exploit this flaw to inject arbitrary SQL commands. The vulnerability is fixed in version 4.1.6.

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.

CVE-2026-78309 is a high-severity SQL Injection vulnerability in the Deltaww DIAEnergie product affecting versions before 1.11.00.022. The vulnerability allows an attacker with low privileges to execute arbitrary SQL commands remotely without user interaction, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection. This issue affects W4 Post List: from n/a through 3.0.6.

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.

Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and directly concatenated them into raw SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator could manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers (array_map('intval', ...)) and adopting parameterized ->whereIn() query construction.

Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions.

Editor SQL Injection in Ultimeter <= 3.0.8 versions.

Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.