The Custom Field Template plugin for WordPress is vulnerable to generic SQL Injection via the 'post_ID' parameter in all versions up to, and including, 2.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The capability check via current_user_can('edit_post', $id) is bypassable because WordPress internally casts $id to an integer for the permission evaluation while the full unsanitized string is preserved and passed to the SQL sink, and a valid nonce — which is also required — can be legitimately obtained by any Contributor-level user from the post edit screen.
The GoPay for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'log_table_filter' parameter in all versions up to, and including, 1.0.36 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable advanced-filter SQL branch is only entered when at least one of the following parameters is present in the request: linked_posts, created_after, created_before, missing_fields, post_id, a comma-separated type value, or exclude_type.
The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parse_key_compare_field() method that, when the user-supplied value matches the regex ^[(\s]*SELECT\s+, wraps the value in parentheses and embeds it directly into the SQL string without any escaping or quoting. While the normal LIKE code path correctly uses esc_sql($wpdb->esc_like(...)) and wraps the value in single quotes, this branch completely bypasses those protections. Because the attack payload (SELECT ...) contains no single quotes, WordPress's wp_magic_quotes() provides no protection. This makes it possible for authenticated attackers with administrator-level access to inject arbitrary SQL subqueries — including time-based blind payloads — that can be used to extract sensitive information from the database.
The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions.
The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks.
IBM Guardium Data Protection version 12.2 contains a SQL injection vulnerability in the New Query Builder REST Processor. This flaw allows a low-privileged authenticated user to inject SQL statements via the newQueryBuilder REST endpoint. Successful exploitation could lead to unauthorized data access and compromise the confidentiality, integrity, and availability of the system. The vulnerability has a high severity rating with a CVSS score of 8.8.
IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in unauthorized access to sensitive data and impact to the confidentiality, integrity, and availability of the affected system.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.
IBM Guardium Data Protection version 12.2 contains an SQL injection vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The flaw arises from improper neutralization of special elements in SQL commands. The vulnerability has a high severity with a CVSS score of 7.6, indicating significant confidentiality impact but no integrity impact. No patch or remediation information is currently provided.
IBM Guardium Data Protection version 12.2 contains a SQL Injection vulnerability that allows a remote authenticated attacker to obtain sensitive information. The flaw arises from improper neutralization of special elements in SQL commands, potentially leading to unauthorized data disclosure. The vulnerability has a high severity rating with a CVSS score of 7.7.
CVE-2026-52745 is a medium severity SQL injection vulnerability in CordysCRM versions prior to 1.7.0. It affects the POST /account-pool/page endpoint, allowing an authenticated user with MODULE_SETTING:UPDATE permission to inject crafted input into a dynamic SQL ORDER BY clause without proper validation. This can lead to time-based blind SQL injection, enabling attackers to confirm database expression execution, infer metadata and sensitive data, and cause database delays that degrade service. The issue is fixed in version 1.7.0.
CVE-2026-84082 is a critical SQL injection vulnerability in IBM Guardium Data Protection version 12.2. It allows a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries.
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pg_jobmon is installed and part_config.jobmon is true, exception handlers in multiple pg_partman functions place p_parent_table verbatim inside a SQL string literal used to call pg_jobmon.add_job(). A partman_user can create a parent-table name containing a single quote that terminates the literal and injects SQL when an affected exception path runs. If pg_partman_bgw reaches that path, the injected SQL executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The persistent part_config row can trigger the escalation again on later maintenance ticks. This issue is fixed in version 5.5.0.
pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually surrounds primary-key column names from pg_attribute.attname with double quotes without escaping embedded double-quote characters. A partman_user who owns a template table can create a crafted column name that breaks out of the generated ALTER TABLE ADD PRIMARY KEY identifier when the background worker applies the key to a child partition. The generated SQL then executes with pg_partman_bgw.role privileges, which default to PostgreSQL superuser, permitting database-wide compromise and operating-system command execution as the PostgreSQL service account. The crafted catalog identifier persists until removed and can trigger again during later partition creation. This issue is fixed in version 5.5.0.
CVE-2026-61817 is a high-severity SQL injection vulnerability in the pg_partman PostgreSQL extension prior to version 5.5.0. It arises from improper neutralization of special elements in dynamic SQL commands related to the part_config.time_dncoder value. A user with partman_user privileges can inject arbitrary SQL that executes with elevated privileges, potentially leading to full database compromise and operating system command execution. The issue is fixed in pg_partman version 5.5.0.
CVE-2026-61818 is a high-severity SQL injection vulnerability in the pg_partman PostgreSQL extension prior to version 5.5.0. The undo_partition() function improperly handles the part_config.time_encoder parameter by interpolating it as unrestricted text into a dynamic SQL statement without proper quoting. This allows a user with partman_user role access to inject arbitrary SQL code, which executes with the privileges of the caller invoking undo_partition(). Although this function is not part of the default background-worker path, limiting automatic superuser escalation, a privileged caller can still abuse their permissions for confidentiality, integrity, and availability impacts. The vulnerability is fixed in version 5.5.0.
CVE-2026-84073 is a critical SQL injection vulnerability in IBM Guardium Data Protection version 12.2. It allows a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability.