CWE-89: SQL Injection vulnerabilities

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.

CubeCart v6 prior to version 6.7.5 contains a SQL Injection vulnerability in the admin/sources/settings.index.inc.php file. The vulnerability arises because the administrator-controlled download_expire POST parameter is directly concatenated into an SQL UPDATE statement without numeric validation. This allows an authenticated administrator to manipulate database columns and potentially other data within the application's database privileges. The issue is fixed in version 6.7.5.

CubeCart v6 prior to version 6.7.5 contains a SQL Injection vulnerability in the admin maintenance script. An authenticated administrator can manipulate tablename values used in SQL statements without proper validation or escaping, allowing injection of malicious SQL. This can compromise database confidentiality, integrity, and availability. The issue is fixed in version 6.7.5.

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe identifier handling. When the same datasource is later removed through DELETE /api/v1/datasource/{id}, the stored value is interpolated into datasource cleanup SQL and executed by PostgreSQL. This second-order SQL injection can invoke PostgreSQL COPY TO PROGRAM and execute arbitrary operating-system commands with the privileges of the postgres process inside the SQLBot container. This issue is fixed in version 1.9.0.

CVE-2026-53556 is an SQL injection vulnerability in dataease SQLBot prior to version 1.9.0. The issue occurs in the POST /api/v1/datasource/previewData endpoint, where the client-controlled table_name parameter is incorporated into SQL queries without proper safe identifier handling. This allows an authenticated user to execute read-only SELECT operations that can invoke PostgreSQL functions to read filesystem contents. In default configurations, the internal PostgreSQL connection accepts invalid credentials and runs with superuser privileges, potentially exposing sensitive files such as /etc/hosts and /etc/passwd. The vulnerability is fixed in version 1.9.0.

A SQL injection vulnerability (CWE-89) exists in itflow versions prior to 26.07. Authenticated users with module_support write permission and access to credential records can exploit a time-based blind SQL injection via the expires parameter in the share_generate_link handler. This flaw allows execution of conditional database queries that can expose sensitive data including password hashes, SMTP credentials, API keys, encrypted vault data, and database metadata. The vulnerability is fixed in version 26.07.

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by agent/post/recurring_invoice.php. The handler passes recurring_invoice_frequency through sanitizeInput but interpolates it unquoted into DATE_ADD, allowing SQL syntax to escape the interval expression, assign additional INSERT columns, store subquery results in recurring_invoice_note, and expose those results through agent/recurring_invoice.php. The persisted recurring_invoice_frequency can execute again when Force Recurring uses it in a later UPDATE, allowing another legitimate user to trigger the second-order injection. This can expose password hashes, SMTP credentials, user records, and database metadata, modify database fields, and enable administrative takeover after credential cracking. This issue is fixed in version 26.07.

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.

Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.

Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.

Shop manager SQL Injection in WP-Lister Lite for eBay <= 3.8.11 versions.

Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.

Administrator SQL Injection in WC Vendors Marketplace <= 2.7.2.1 versions.

Administrator SQL Injection in WPMasterToolKit <= 2.22.0 versions.

Administrator SQL Injection in Newsletters <= 4.18 versions.

Administrator SQL Injection in WP Maps <= 4.9.9 versions.

Contributor SQL Injection in Product Feed Manager <= 7.12.0 versions.

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes.

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary confirmed vector is a dictionary indexer key used by Where filters in src/Marten/Linq/Members/Dictionaries/DictionaryItemMember.cs. Additional affected sinks include SelectParser.cs, DatabaseScopedTenantPartitions.cs, and DeleteAllForTenant.cs reached through IEventStore.DeleteProjectionProgressAsync, while DictionaryContainsKeyFilter.cs (Newtonsoft serializer only; System.Text.Json is not affected) handles ContainsKey calls. Events/Daemon/Internals/EventLoader.cs contains a related per-tenant partition-pruning literal that the advisory identifies as a defense-in-depth sink. A crafted single quote can escape the generated literal, enabling filter or multi-tenant authorization bypass and blind data exfiltration, and deployments that permit semicolon-batched Npgsql statements may also allow data modification. This issue is fixed in version 9.13.0.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2.