SuiteCRM versions prior to 7.15.2 and between 8.0.0 and before 8.10.2 contain a time-based blind SQL injection vulnerability in the REST API v4.1 get_entry_list method. This vulnerability requires an authenticated user to bypass two unspecified security mechanisms simultaneously. Successful exploitation can lead to extraction of sensitive database information. The issue is fixed in versions 7.15.2 and 8.10.2.
CVE-2026-63214 is a high-severity SQL Injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The issue arises from legacy REST methods that append an authenticated user's query parameter directly into a SQL WHERE clause without sufficient validation. Exploitation requires an account with list permission on a module and can lead to bypassing user_hash filters, allowing attackers to retrieve password hashes and other sensitive database data. This can result in administrative credential compromise and full application takeover. The vulnerability is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
CVE-2026-61651 is a high-severity SQL injection vulnerability in SuiteCRM affecting versions prior to 7.15.2 and between 8.0.0 and before 8.10.2. The vulnerability exists in the get_end_date action of the Projects Controller, where a low-privileged authenticated user can inject SQL via the task_id parameter due to lack of query parameterization. This flaw allows blind SQL injection attacks that can enumerate the database schema and extract sensitive data such as credentials and customer records. The issue is fixed in SuiteCRM versions 7.15.2 and 8.10.2.
SQL injection vulnerability in DLP on-prem extensions version 11.13.1 and earlier allows a remote authenticated attacker to inject SQL queries without sanitization or parameterized queries.
A SQL Injection vulnerability exists in Apache OFBiz versions before 24.09.08 on MySQL/MariaDB-backed deployments. The flaw occurs in the entity engine's generic performFind service when handling ignore-case find requests with crafted values, allowing remote unauthenticated attackers to disclose arbitrary database rows. The issue arises because the input is inlined into SQL text with insufficient escaping for MySQL/MariaDB, enabling payloads to break out of string literals. This vulnerability does not affect Derby or PostgreSQL datasources. Upgrading to version 24.09.08 resolves the issue.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Kobikom Telecommunications and Informatics Services Inc. Kobikom allows SQL Injection.
This issue affects Kobikom: before KobiPBX-FOP3-SEC-r1.
The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting before using it in a SQL query, allowing authenticated users with upload capability (Author and above) to perform SQL injection attacks.
The IVPAY payments WordPress plugin through 1.0.8 does not sanitise a value from its payment callback before using it in a SQL statement, and treats an empty API key, which is its own default, as valid authentication, allowing unauthenticated attackers to read arbitrary data from the database.
GLPI versions from 9.4.0 up to but not including 10.0.26, and from 11.0.0 up to but not including 11.0.8, contain a SQL injection vulnerability in the dropdown values fetching endpoint. Authenticated users can submit crafted inputs that are incorporated into database queries, allowing SQL injection. The vulnerability is fixed in versions 10.0.26 and 11.0.8.
Sonatype Nexus Repository 3 versions 3.90.0 through 3.97.x contain a SQL injection vulnerability in the optional 'Reindex Search Tables By Pattern' task. This task is only available if the non-default setting nexus.reindex.search.by.pattern.visible is enabled. A user with the nexus:tasks:create privilege can supply a crafted filter condition that is executed as SQL by the database, allowing modification of Nexus database data. The vulnerability is fixed in version 3.98.0.
SQL::Abstract versions from 1.90_01 up to but not including 2.000001_04 for Perl contain a SQL injection vulnerability. The injection_guard check intended to prevent injection is bypassed when function names are passed explicitly with the -func parameter, allowing untrusted input to be used unchecked in SQL queries. This can lead to SQL injection if an application relies on injection_guard to validate function names passed this way. The issue is fixed in version 2.000001_04.
SQL::Abstract versions from 1.90_01 up to but not including 2.000001_04 for Perl contain a SQL injection vulnerability. This occurs when nested statements used as identifiers improperly handle where clause values, inserting them directly into SQL text without proper escaping unless quote_char is set. Applications passing untrusted input in these contexts may be vulnerable to SQL injection attacks.
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a restore, so a value a Subscriber stores in their own profile can break out of its string literal and inject SQL into the restore's INSERT statement when an administrator restores the backup onto a server lacking one of the source's charsets or collations.
Chamilo LMS versions prior to 1.11.40 and between 2.0.0 and before 2.0.1 contain a SQL injection vulnerability in the get_sessions action of /main/inc/ajax/model.ajax.php. An authenticated administrator can exploit this by sending a crafted JSON filters parameter with a malicious groupOp field, allowing SQL syntax injection. This flaw enables unauthorized data disclosure, modification, deletion, and denial of service via delayed queries. The vulnerability is fixed in versions 1.11.40 and 2.0.1.
CVE-2026-44265 is an improper input validation vulnerability in enspirit elo versions prior to 1.0.1. The vulnerability arises because Elo's programmatic AST API accepts arbitrary values from untyped sources and interpolates them into generated code without runtime syntax validation. This affects multiple fields such as int_literal/float_literal values, variable names, member access properties, object literal keys, datapath segments, lambda parameter names, and SQL let binding names. Exploitation can lead to arbitrary code execution in JavaScript, Ruby, and Python environments, as well as SQL injection in SQL targets. The issue is fixed in version 1.0.1.
Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify information stored in the GMS database.
A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the save_currency() AJAX handler, which lacks capability checks and allows subscriber-level users to store malicious SQL payloads that are later concatenated directly into ORDER BY clauses without proper sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries to extract sensitive information from the database.
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/<order_id>/shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.