The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to time-based SQL Injection via the 'params[searchKey]' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-123087 is a high-severity SQL injection vulnerability in Atmira's SIREC product. The vulnerability arises because the server retrieves a field value from a user-supplied JSON object and concatenates it directly into an SQL query without proper sanitization. This flaw allows attackers to alter the original SQL query, potentially causing the database to return unauthorized or unexpected information. A fix for this vulnerability was released on October 16, 2026.
The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
CVE-2026-63774 is a critical SQL Injection vulnerability in Subnet Solutions PowerSYSTEM Center 2024. It arises from insufficient input validation in the report designer component, allowing an authenticated user to execute unauthorized SQL commands. This flaw affects versions from 6.0.x through 6.2.x and 7.0.x through 7.1.x. The vulnerability has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability. No public exploits or patches are currently documented.
A SQL Injection vulnerability (CWE-89) exists in Kubeflow Pipelines prior to version 2.17.0. The API server improperly trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter when constructing list queries. This allows an attacker with permission to invoke a pipeline or run list API to inject SQL through specific fields and read data accessible to the API server database account across namespaces. There is no evidence of database modification. The issue is fixed in version 2.17.0.
CVE-2026-111492 is a high-severity SQL injection vulnerability in the push notification handler of the MatchPoint Android app by TPC Software. The vulnerability arises from unsafe concatenation of untrusted data from Firebase Cloud Messaging into SQL queries. Exploitation allows an attacker to manipulate queries and access sensitive information stored locally on the device, including credentials. The impact is limited to the affected device and does not extend to cloud services. A patch is available for this vulnerability.
Dolibarr versions prior to 22.0.5 and between 23.0.0 and before 23.0.2 contain a SQL injection vulnerability in the Third Party company update functionality. This flaw allows an authenticated user with create or edit permissions to inject malicious SQL via the localtax1_value and localtax2_value parameters, potentially exposing sensitive data or modifying records. The vulnerability is fixed in versions 22.0.5 and 23.0.2.
CVE-2026-100359 is a SQL Injection vulnerability in SuiteCRM's Project Template module affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability arises from unsanitized, unauthenticated user input in the action_get_end_date function, allowing authenticated users to perform blind SQL injection attacks. This can lead to unauthorized reading of sensitive database contents such as customer data, internal communications, and credentials. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-71548 is a high-severity SQL injection vulnerability in SuiteCRM versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. It arises from improper input validation in the AOR_Report::build_report_query_where function, allowing authenticated users with report-saving privileges to read the entire SuiteCRM database. Sensitive data such as user hashes, OAuth2 tokens, CRM records, and configuration data may be exposed. The vulnerability does not support stacked queries, so direct data modification via injection is not possible. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69134 is a high-severity SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and 8.10.2. It involves the REST v4 JSON handler improperly handling the RAW_REQUEST value and relationship write helpers, allowing an authenticated user to inject SQL via relationship fields. This can lead to unauthorized reading or modification of database data and potentially file-write operations if the database account has elevated privileges. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Cases module access can perform blind SQL injection and extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-69142 is a high-severity SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and from 8.0.0 up to but not including 8.10.2. The vulnerability exists in the jjwg_Maps map marker endpoint, where the authenticated user's distance parameter is not strictly validated or parameterized, allowing SQL query manipulation. This flaw enables an authenticated attacker to extract database data, modify query results, and consume system resources. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69140 is a high-severity SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The flaw arises from unsafe interpolation of user input into an SQL UPDATE statement in GetLatestRevision.php. A low-privileged user with access to the Documents module can exploit this to disclose database data and mass-update linked_documents records. The vulnerability does not support stacked statements or arbitrary DROP/INSERT commands. It is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69145 is a SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The issue arises because the AOR report generation reloads and concatenates values from aor_fields.field into SQL queries without strict validation. Authenticated users with report configuration privileges can exploit this to inject SQL and disclose database contents. The vulnerability is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-69136 is a SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The flaw arises from insecure handling of the remove_attachment POST parameter array in email template attachment processing, allowing an authenticated attacker to inject SQL commands. This can lead to disclosure of database information or soft deletion of all records in the notes table. The vulnerability is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-69135 is a SQL Injection vulnerability in SuiteCRM's Project module affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability arises because the duplicateId POST parameter is directly interpolated into a SQL query without proper sanitization or parameterization. An authenticated attacker can exploit this flaw to alter the query structure and potentially disclose sensitive database information. This issue has been fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-61648 is a high-severity SQL injection vulnerability in SuiteCRM prior to versions 7.15.2 and 8.10.2. It arises from improper handling of user-controllable Multi report condition parameters that are concatenated into SQL queries without proper encoding. This flaw allows a low-privileged user with AOR Reports access to read arbitrary database tables and potentially exhaust database connections. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-61653 is a high-severity SQL injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The flaw exists in the Campaigns module where user input is improperly handled, allowing an authenticated user with Campaigns access to perform time-based blind SQL injection attacks. This issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.