BigBlueButton versions prior to 3.0.23 contain a SQL injection vulnerability that allows authenticated moderators to execute arbitrary SQL commands via the meetingId and userId parameters in breakout room visibility queries. This flaw is fixed in version 3.0.23.
CVE-2026-63039 is a critical SQL Injection vulnerability in Apache InLong versions from 2.0.0 up to but not including 2.4.0. This flaw allows attackers to inject malicious SQL commands by improperly neutralizing special elements in SQL statements. The vulnerability is fixed in Apache InLong version 2.4.0. Users should upgrade to version 2.4.0 or apply the relevant patch to remediate this issue.
CVE-2026-63038 is a critical SQL Injection vulnerability in Apache InLong affecting versions from 2.0.0 up to but not including 2.4.0. The flaw allows attackers to inject arbitrary SQL code via the dbName, tableName, schemaName, and username parameters. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. Users are advised to upgrade to version 2.4.0 or apply the relevant patch to remediate the issue.
CVE-2026-63037 is a critical SQL injection vulnerability in Apache InLong affecting versions from 2.0.0 up to but not including 2.4.0. The flaw allows improper neutralization of special elements in SQL commands, specifically in the ORDER BY clause of the Manager backend database. Exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected system. Users are advised to upgrade to Apache InLong version 2.4.0 or apply the recommended patch from the official Apache issue tracker.
CVE-2026-74011 is a high-severity SQL Injection vulnerability in revmakx InfiniteWP Client that allows blind SQL injection attacks. It affects versions up to and including 1.13.9. The vulnerability involves improper neutralization of special elements in SQL commands, potentially leading to unauthorized data disclosure and partial denial of service. No patch or official remediation information is currently provided.
CVE-2026-74013 is a high severity SQL Injection vulnerability affecting WordPress.com eShipper Commerce versions up to 2.16.13. It involves improper neutralization of special elements in SQL commands, specifically in the subscriber functionality. This vulnerability allows an attacker with low privileges and no user interaction to cause a partial impact on availability and a complete impact on confidentiality. No official patch or remediation information is provided in the available data.
CVE-2026-73998 is a high-severity SQL Injection vulnerability affecting WP w3all phpBB versions up to 3.0.5. It involves improper neutralization of special elements in SQL commands, allowing an attacker with low privileges to execute crafted SQL queries. The vulnerability impacts confidentiality and availability but does not affect integrity. No patch or remediation details are provided in the available data.
CVE-2026-68566 is a critical unauthenticated SQL Injection vulnerability in BookingPress Appointment Booking Pro versions up to and including 6.0.2. It allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation details are provided in the available data.
CVE-2026-66680 is a critical unauthenticated SQL Injection vulnerability in plainware's Locatoraid Store Locator affecting versions up to 3.9.72. This flaw allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation information is provided in the available data.
CVE-2026-66649 is a critical unauthenticated SQL Injection vulnerability affecting e-plugins Directory Pro versions up to and including 2.5.8. This flaw allows remote attackers to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation details are provided in the available data.
CVE-2026-66609 is a critical unauthenticated SQL Injection vulnerability affecting TheGem (Elementor) plugin versions up to and including 5.12.3. This flaw allows remote attackers to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation details are provided in the input data.
CVE-2026-66594 is a high-severity SQL Injection vulnerability affecting WordPress Persistent Login versions up to 3.1.0. It involves improper neutralization of special elements in SQL commands, specifically impacting subscriber-level users. The vulnerability allows an attacker with low privileges to execute SQL injection attacks, potentially leading to significant confidentiality impact and limited availability impact.
CVE-2026-66593 is a critical unauthenticated SQL Injection vulnerability in the Security & Malware scan by CleanTalk affecting versions up to 2.184. This flaw allows an attacker to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. The vulnerability has a CVSS score of 9.3, indicating a severe risk. No patch or remediation information is currently provided by the vendor.
CVE-2026-66592 is a critical SQL Injection vulnerability in rtMedia for WordPress, BuddyPress, and bbPress by rtCamp Inc. Versions prior to 4.7.12 are affected. The flaw allows an attacker to perform Blind SQL Injection, potentially leading to high confidentiality impact and partial availability impact. A fix is available in version 4.7.12.
CVE-2025-15688 is a critical unauthenticated SQL Injection vulnerability affecting ThemeGoods Capella versions up to and including 2.5.5. This flaw allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. The vulnerability has a CVSS score of 9.3, indicating a severe risk. No patch or remediation information is currently provided.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.
CVE-2026-49392 is an improper input validation vulnerability in Wazuh affecting versions from 4.6.0 up to but not including 4.14.6, and from 5.0.0-beta1 up to but not including 5.0.0-beta3. The flaw arises from unsafe concatenation of monitored file paths into SQLite queries without proper escaping on non-Windows systems, allowing a local user to inject SQL UNION SELECT expressions via crafted filenames in the File Integrity Monitoring directories. This can manipulate SELECT result sets used by the File Integrity Monitoring code. The issue is fixed in versions 4.14.6 and 5.0.0-beta3.
A critical SQL injection vulnerability (CWE-89) exists in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2. The flaw occurs in the trips search functionality where search keywords and ORDER BY clauses are concatenated directly into SQL queries without proper sanitization. Version 6.2.3 addresses this by quoting keywords and allow-listing the sort clause to prevent injection.
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.