CWE-89: SQL Injection vulnerabilities

CVE-2026-32471 is a high severity SQL Injection vulnerability affecting ProLancer Element versions up to and including 1.4.8. The flaw involves improper neutralization of special elements in SQL commands, specifically in the Subscriber component. This vulnerability allows an attacker with low privileges and no user interaction to cause a partial denial of service and potentially impact data confidentiality. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-78270 is a high severity SQL Injection vulnerability in WP ManageNinja LLC's FluentCRM Pro plugin affecting versions up to and including 3.1.12. The flaw involves improper neutralization of special elements in SQL commands, specifically related to author input. This vulnerability could allow an attacker with high privileges to execute unauthorized SQL commands, potentially leading to data confidentiality breaches and partial denial of service. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-78317 is a high severity SQL Injection vulnerability in Delta DIAEnergie version 1.11.00.002. This flaw allows an attacker with network access and low privileges to execute arbitrary code remotely without user interaction. The vulnerability arises from improper neutralization of special elements in SQL commands, classified under CWE-89.

CVE-2026-78316 is a high-severity SQL Injection vulnerability in Delta DIAEnergie version 1.11.00.002. This flaw allows an attacker with low privileges to execute arbitrary code remotely by exploiting improper neutralization of special elements in SQL commands.

CVE-2026-78315 is a high-severity SQL Injection vulnerability in Delta DIAEnergie version 1.11.00.002. This flaw allows an attacker with low privileges to execute arbitrary code remotely by exploiting improper neutralization of special elements in SQL commands.

CVE-2026-78314 is a high-severity SQL Injection vulnerability in Delta DIAEnergie version 1.11.00.002. This flaw allows an attacker with low privileges to execute arbitrary code remotely by exploiting improper neutralization of special elements in SQL commands.

A critical SQL injection vulnerability (CWE-89) exists in the Page Builder CK extension for Joomla versions up to 3.6.4. The flaw is related to the loadStyles method in the frontend page model and allows improper neutralization of special elements used in SQL commands. This vulnerability has a CVSS 4.0 base score of 9.3, indicating a high severity with network attack vector and no required privileges or user interaction.

CVE-2026-78185 is a SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0, specifically in the /pages/cust_edit.php file via manipulation of the ID argument. It allows remote attackers to inject SQL commands. The vulnerability has a medium severity with a CVSS score of 6.3. Exploit code is publicly available, but no vendor patch or remediation guidance has been provided.

CVE-2026-78199 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /fos/view_prod.php file where manipulation of the ID argument allows injection of SQL commands. This vulnerability can be exploited remotely without authentication. The exploit code is publicly available, increasing the risk of exploitation. The vulnerability has a CVSS score of 6.9, indicating a medium severity level.

SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /fos/admin/ajax.php?action=add_to_cart endpoint. The flaw is due to improper handling of the pid parameter, allowing remote attackers to manipulate SQL queries. This vulnerability has a CVSS 3.1 base score of 7.3, indicating medium severity. No official patch or remediation guidance is currently available. Public exploit details have been disclosed, but no known exploits are reported in the wild.

CVE-2026-78171 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. It affects the /pages/processlogin.php file and can be exploited remotely without authentication by manipulating the User argument. No patch or remediation information is currently available, and no known exploits are reported in the wild.

CVE-2026-78143 is a SQL injection vulnerability in version 1.0 of the Barangay Resident Profiling Management System affecting the Resident Search functionality in the residents.php file. This flaw allows remote attackers to manipulate the Search argument to execute unauthorized SQL commands. The vulnerability has a CVSS 3.1 score of 7.3, indicating medium severity. There are no known exploits in the wild and no official patch or remediation information is currently available.

An unauthenticated SQL injection vulnerability exists in the Fabrik extension for Joomla versions up to 4.7.3. The issue arises because the 'order' parameter in list models is used in SQL queries without proper validation, allowing attackers to inject SQL commands. This vulnerability is identified as CWE-89 and has a critical CVSS 4.0 score of 9.3.

An unauthenticated SQL injection vulnerability exists in the Fabrik extension for Joomla versions up to 4.7.3. The flaw occurs because the condition parameter passed to a list filter is directly concatenated into an SQL WHERE clause without proper neutralization. This allows an attacker to inject arbitrary SQL commands, potentially exposing the full database contents. The vulnerability has a critical severity with a CVSS 4.0 base score of 9.3. No official patch or remediation guidance is currently provided by the vendor.

KEDA versions prior to 2.20.0 contain an injection vulnerability in the PostgreSQL scaler component. The vulnerability arises because connection strings are constructed from tenant-controlled parameters without sufficient escaping, allowing injection of additional connection parameters. This can enable an attacker with permissions to create or modify TriggerAuthentication or ScaledObject resources to redirect database connections, expose credentials, or disable TLS protections. The issue is fixed in version 2.20.0.

An authenticated SQL injection vulnerability exists in the YOOtheme Pro extension for Joomla versions 1.0.0 through 5.0.40. This flaw allows any user with contributor-level privileges to inject arbitrary content into SQL queries, potentially compromising the database integrity. The vulnerability is classified as high severity with a CVSS score of 8.6.

A SQL injection vulnerability exists in the Media Library Assistant WordPress plugin versions before 3.40. This flaw allows users with the Author role to inject SQL code via an unvalidated search parameter in a media-library query handler. The vulnerability can lead to unauthorized disclosure of sensitive data but does not affect data integrity or availability.

CVE-2026-14601 is a SQL injection vulnerability in the Link Whisper Free WordPress plugin versions before 0.9.7. It allows authenticated users with Editor role or higher to inject SQL commands due to improper sanitization and escaping of a parameter used in a SQL query. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

CVE-2026-68782 is a critical SQL Injection vulnerability in Microsoft Azure SQL Database that allows an authorized attacker to elevate privileges over a network. The flaw involves improper neutralization of special elements in SQL commands, enabling privilege escalation. A patch is available and the vendor has issued an official fix. This vulnerability affects the cloud-hosted Azure SQL Database service.

CVE-2026-68789 is a critical SQL Injection vulnerability in Microsoft Azure SQL Database. It allows an authorized attacker to execute malicious SQL commands, potentially elevating privileges over the network. The vulnerability involves improper neutralization of special elements in SQL commands. Microsoft has issued an official fix for this cloud service vulnerability.