CWE-89: SQL Injection vulnerabilities

CVE-2026-82609 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in the /pages/inv_edit.php file where manipulation of the ID parameter allows remote attackers to perform SQL injection. Exploit code is publicly available, but there are no known exploits in the wild. No official patch or remediation has been provided yet.

CubeCart version 6.7.4 is affected by a medium severity SQL-related vulnerability identified as CVE-2026-54646. No detailed technical information or patch status is available for this issue.

CubeCart version 6.7.4 contains a high-severity SQL injection vulnerability that allows attackers to inject malicious SQL code to manipulate backend database queries.

CVE-2026-82545 is a SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. The flaw exists in an unknown function within the /pages/sup_searchfrm.php file, where manipulation of the ID argument allows injection of SQL commands. This vulnerability can be exploited remotely without user interaction. Public exploit code has been disclosed. The vulnerability has a medium severity rating with a CVSS score of 5.3.

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0 in the /pages/pro_edit.php file via manipulation of the ID argument. This vulnerability can be exploited remotely and has been publicly disclosed. No official patch or fix is currently available. The CVSS v3.1 base score is 6.3, indicating a medium severity level.

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0, specifically in the processing of the /pages/emp_edit.php file via the ID parameter. This vulnerability allows remote attackers with low privileges to manipulate the ID argument, potentially impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level. No official patch or remediation has been provided yet. Exploit code is publicly available, but there are no confirmed reports of exploitation in the wild.

WP Ultimate CSV Importer WordPress plugin versions before 9.0 contain a SQL injection vulnerability due to improper sanitization and escaping of imported field values. This flaw allows high privilege users, such as administrators, to perform SQL injection attacks. The vulnerability has a medium severity score of 4.1 and does not have a confirmed patch or official remediation guidance yet.

CVE-2026-16061 is a high-severity SQL injection vulnerability in the Rest Routes WordPress plugin up to version 5.5.5. The plugin fails to sanitize and validate a value from the URL of a public REST route before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection. This vulnerability can lead to unauthorized disclosure of sensitive information. No official patch or remediation guidance is currently available.

MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a SQL injection vulnerability when using certain client character sets (big5, gbk, sjis, cp932, or gb18030). This occurs due to improper escaping of attacker-controlled Buffer parameters client-side, allowing an attacker to inject arbitrary SQL. The default utf8mb4 character set and prepared-statement execution paths are not affected. The vulnerability can lead to exposure or modification of data accessible to the database account. Fixed versions are available.

CVE-2026-77586 is a high-severity SQL injection vulnerability in the MongoDB Connector for BI version 2.1.0. It occurs because MongoDB object names are inserted into quoted identifiers in DDL statements without properly escaping the identifier delimiter. This allows a user with write permissions on a sampled MongoDB collection to craft object names that inject additional SQL commands. If these generated statements are replayed against a SQL server, the injected SQL executes with the privileges of that session.

CVE-2026-77184 is a medium severity SQL injection vulnerability in MongoDB Connector for BI version 2.1.0. It arises because the description text of a collection's JSON schema validator is included in the comment text of DDL statements generated by SHOW CREATE without properly escaping backslash characters. A user with permission to modify the schema validator can embed additional SQL code in this output. If this generated SQL statement is later executed against a SQL server, the injected SQL runs with the privileges of that session.

CVE-2026-55509 is a high-severity SQL injection vulnerability in the mar10 wsgidav project. It affects the sample MySQLBrowserProvider included in wsgidav versions prior to 4.3.5. This provider concatenates user-supplied keys directly into SQL queries without proper sanitization, allowing an attacker with access to a share configured with this provider to perform SQL injection via normal GET requests. The vulnerable code is part of a non-default example provider, which is not enabled by default. The issue is fixed in version 4.3.5.

CVE-2026-82227 is a high-severity SQL Injection vulnerability affecting WPBulky plugin versions up to 1.2.2. The flaw allows improper neutralization of special elements in SQL commands via the Contributor functionality. This vulnerability can be exploited remotely with low attack complexity and requires low privileges. It impacts confidentiality with high severity and availability with low severity, but does not affect integrity. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-78072 is a high severity SQL injection vulnerability in the Jefferson49 Sexy Polling Reloaded extension for Joomla versions 1.0.0 through 5.6.0. It allows unauthenticated attackers to perform blind SQL injection attacks. The vulnerability is due to improper neutralization of special elements in SQL commands. No official patch or remediation guidance is currently available.

An authenticated, privileged blind SQL injection vulnerability exists in the DP Calendar extension for Joomla versions 5.5.0 through 10.11.2. The flaw occurs when saving an article with the content plugin, requiring update permissions on articles. This vulnerability can allow an attacker with appropriate privileges to execute unauthorized SQL commands on the backend database.

The wpForo Forum plugin for WordPress contains an SQL Injection vulnerability in the 'referer' parameter affecting all versions up to and including 2.4.17. This vulnerability allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and preparation of the SQL statement. Exploitation can lead to unauthorized extraction of sensitive database information. The vulnerability has a high severity score of 7.5 (CVSS 3.1). No official patch or remediation guidance is currently available from the vendor.

YzmCMS version 7.5 contains a SQL injection vulnerability in the get_arrchildid() function located in application/admin/controller/category.class.php. The vulnerability arises because the parentid parameter is directly concatenated into a SQL FIND_IN_SET() clause without proper sanitization. This flaw allows an authenticated administrator to perform boolean-based blind SQL injection, potentially leading to full compromise of the database.

CVE-2026-78612 is an authenticated SQL injection vulnerability in WatchGuard Dimension's scheduled report feature. It allows an authenticated user with report administration permissions to execute arbitrary commands as the Dimension WebUI process user by sending specially crafted requests. The vulnerability affects version 2.0 of WatchGuard Dimension. The CVSS 4.0 base score is 8.6, indicating high severity.

WatchGuard Dimension version 2.0 contains an authenticated SQL injection vulnerability in its log viewer feature. This flaw allows an authenticated user with report administration permissions to execute arbitrary commands as the Dimension WebUI process user by sending specially crafted requests. The vulnerability is classified under CWE-89 and has a high severity score of 8.6. No official patch or remediation guidance has been provided yet.