CWE-89: SQL Injection vulnerabilities

Efence, a product by Thinking Software Technology, contains a SQL Injection vulnerability that allows unauthenticated remote attackers to access file upload functionality and read database contents. This vulnerability is identified as CVE-2026-80236 and is classified under CWE-89. The vulnerability has a high severity with a CVSS score of 8.2. No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.

CVE-2026-9668 is an SQL injection vulnerability in ZTE SCP that allows attackers with legitimate user credentials to execute arbitrary database queries by crafting malicious SQL statements. This can bypass authentication logic, cause slow database queries, and expand query coverage. The vulnerability has a low exploitation threshold and does not require external privilege escalation. It is classified as a medium-severity issue with a CVSS score of 6.3.

The WooCommerce Lottery plugin for WordPress contains a high-severity SQL Injection vulnerability in all versions up to and including 2.2.9. This flaw allows unauthenticated attackers to manipulate the 'orderby' and 'order' GET parameters to inject additional SQL commands. Exploitation can lead to unauthorized extraction of sensitive database information. No official patch or remediation guidance is currently available.

The RegistrationMagic WordPress plugin before 6.0.9.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

Tutor LMS WordPress plugin versions 4.0.0 and 4.0.0 have a SQL injection vulnerability due to improper validation of values used in database queries. This allows unauthenticated users to inject SQL and access question and answer content from non-public courses. The vulnerability does not allow extraction of arbitrary database data beyond the course content disclosed.

A SQL injection vulnerability exists in the country-code lookup endpoint of GazellePW (GazellePosterWall) at commit 86c4bedf727691b5a97af42a4864869d18446449. This flaw allows remote authenticated users with users_view_ips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to tools.php?action=get_cc. The vulnerability has a CVSS score of 4.3, indicating medium severity.

CVE-2026-79804 is a SQL injection vulnerability in the SililaWijesinghe Food Ordering System affecting the /search.php file. The issue arises from manipulation of the search_box argument, allowing remote attackers to perform SQL injection. The product uses a rolling release model, so specific affected or fixed versions are not clearly defined. The vendor did not respond to early disclosure attempts. Public exploit code is available. The vulnerability has a CVSS score of 6.9, indicating medium severity.

CVE-2026-75498 is a high-severity SQL injection vulnerability in Webkul QloApps. It arises because the application does not validate request parameters before executing database queries. An authenticated attacker with administrative privileges can exploit this by sending a crafted SQL query to the 'bo_query' parameter in the 'Address.php' file. The vulnerability allows for full compromise of confidentiality, integrity, and availability of the affected system. A fix has been committed in the codebase (commit 123c97c), but no official patch release or advisory is provided yet.

CVE-2026-75497 is a high-severity SQL injection vulnerability in Webkul QloApps. It arises because the application does not validate request parameters before executing database queries. An authenticated attacker with administrative privileges can exploit this by sending a crafted SQL query to the 'bo_query' parameter in the 'CustomerMessage.php' file. The vulnerability allows full compromise of confidentiality, integrity, and availability of the affected system. A fix has been committed in the codebase (commit 123c97c), but no official patch or advisory is currently provided.

The Media Sweep – WordPress Media Cleaner plugin is vulnerable to an SQL Injection flaw via the 'fields' parameter in all versions up to and including 1.1.3. This vulnerability allows authenticated users with administrator-level privileges or higher to inject additional SQL queries due to insufficient escaping and lack of proper query preparation. The vulnerability can lead to unauthorized extraction of sensitive database information. The CVSS score is 4.9, indicating a medium severity risk. No official patch or fix information is provided in the available data.

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This can be leveraged to obtain the ai1wm_secret_key when a site administrator performs an archive restore and achieve remote code execution once able to leverage the ai1wm_secret_key value.

An SQL injection vulnerability exists in the TYPO3 Extension "Forms Export" due to improper sanitization of user input. A low-privileged backend user with read access to the "Forms Export" backend module can exploit this by injecting arbitrary SQL through a URL parameter. The vulnerability affects multiple versions of the extension and has a high severity rating.

WP Project Manager Pro plugin for WordPress versions up to 4.0.1 is vulnerable to SQL Injection due to improper sanitization of user input. Authenticated users with Subscriber-level access or higher can exploit this vulnerability to append malicious SQL queries, potentially extracting sensitive database information. The vulnerability has a CVSS score of 6.5, indicating medium severity.

The Events Manager plugin for WordPress contains a SQL injection vulnerability in versions up to and including 7.4.0. Authenticated users with contributor-level access or higher can exploit this by injecting SQL metacharacters into a custom meta key, which is later used unsafely in a database query during event or location duplication actions. This vulnerability allows attackers to extract sensitive information from the database without requiring user interaction.

CVE-2026-32555 is a critical unauthenticated SQL Injection vulnerability in PixelYourSite Professional Boost plugin versions up to and including 2.0.4. This flaw allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-32554 is a critical SQL Injection vulnerability in WooBeWoo Product Filter Pro versions up to and including 3.1.8. The flaw allows unauthenticated attackers to inject SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and low availability impact, with no privileges or user interaction required for exploitation.

A SQL injection vulnerability exists in itsourcecode Online Clinic Management System 1.0 within the Admin Login component's success/login.php file. The vulnerability allows remote attackers to manipulate the Username argument to execute unauthorized SQL commands. The vulnerability has a CVSS score of 7.3 (medium severity) and public exploit details have been disclosed. No patch or remediation information is currently available.

A SQL injection vulnerability exists in itsourcecode Real Estate Management System 1.0 within the search.php file. The issue arises from manipulation of the search, delivery_type, search_price, or property_type arguments. This vulnerability can be exploited remotely and has a CVSS score of 7.3, indicating a medium severity. No patch or remediation information is currently available, and no known exploits are reported in the wild.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DiviNext Woo Essential allows SQL Injection. This issue affects Woo Essential: from n/a through 4.3.0.

CVE-2026-32478 is a high-severity SQL Injection vulnerability affecting WP Project Manager Pro versions up to and including 4.0.1. The flaw involves improper neutralization of special elements in SQL commands, specifically in the Subscriber component. This vulnerability could allow an attacker with low privileges to execute unauthorized SQL commands, potentially leading to data confidentiality breaches and limited availability impact. No official patch or remediation guidance is currently available from the vendor.