CWE-89: SQL Injection vulnerabilities

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

CVE-2026-16019 is a critical SQL injection vulnerability in Faydam Innovation Inc.'s FAYDAM Datalogger. It affects versions from 2.7.1 up to but not including 2.8.0. The flaw allows improper neutralization of special elements in SQL commands, potentially enabling attackers to execute arbitrary SQL queries. This vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL Injection vulnerability (CWE-89). This flaw allows a low privileged remote attacker to potentially execute script injection. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity. No official patch or remediation details are provided in the input data.

An unauthenticated SQL injection vulnerability exists in the yootheme.com Zoo extension for Joomla versions 1.0.0 through 4.1.63. The flaw occurs in the ItemController::element() method where the filter_type request parameter is directly interpolated into an SQL query without proper quoting or escaping, allowing attackers to manipulate the query structure.

CVE-2026-73391 is a critical unauthenticated SQL Injection vulnerability affecting KlbTheme's Total Donations plugin versions up to 2.0.5. This flaw allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-73388 is a critical unauthenticated SQL Injection vulnerability affecting TeconceTheme Nikstore Core versions up to 1.5. This flaw allows remote attackers to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and partial availability impact. No patch or remediation information is currently provided by the vendor.

CVE-2026-73185 is a critical unauthenticated SQL Injection vulnerability affecting versions of wpo-HR's NGG Smart Image Search prior to 4.0.0. This flaw allows remote attackers to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity. No patch or remediation information is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-73183 is a critical unauthenticated SQL Injection vulnerability affecting Maps Marker Pro versions up to 4.32. This flaw allows an attacker with no authentication to inject SQL commands, potentially leading to high-impact confidentiality breaches and partial denial of service. The vulnerability has a CVSS score of 9.3, indicating a severe risk. No specific affected versions or patch information is provided in the input data.

CVE-2026-66668 is a high-severity SQL Injection vulnerability affecting Community by PeepSo versions up to 9.0.5.2. It involves improper neutralization of special elements in SQL commands, allowing an attacker with low privileges and no user interaction to cause a partial denial of service and potentially impact confidentiality. The vulnerability has a CVSS score of 8.5, indicating significant risk. No patch or remediation information is provided in the available data.

CVE-2026-32552 is a high-severity SQL Injection vulnerability affecting YITH WooCommerce Membership Premium versions up to and including 2.33.0. This flaw allows an attacker with low privileges and no user interaction to execute SQL commands that can compromise confidentiality and cause limited availability impact. The vulnerability is identified as CWE-89, indicating improper neutralization of special elements in SQL commands.

A SQL injection vulnerability exists in PostgreSQL's EXTRACT() expression deparse functionality, allowing an object owner to execute arbitrary SQL commands with superuser privileges via a malicious object definition. This affects various tools that consume expression deparse output, including pg_dump and psql commands like \sf. The vulnerability impacts multiple PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.6.

The Product Shortlist WordPress plugin versions up to 1.0.4 contains a SQL injection vulnerability due to improper sanitization and escaping of a parameter used in a SQL query. This flaw allows unauthenticated attackers to inject SQL code, potentially leading to data exposure. The vulnerability has a high severity score of 8.6 and affects all versions from 0 through 1.0.4.

The Dinatur WordPress plugin versions up to 1.18 contain a SQL injection vulnerability due to improper sanitization and escaping of user input. This flaw allows unauthenticated users to inject SQL commands. Additionally, the plugin's handler performs database table truncation without authorization checks, enabling any unauthenticated visitor to delete the plugin's data.

CVE-2026-76050 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /admin/ajax.php endpoint when handling the 'delete_menu' action, specifically through manipulation of the 'ID' parameter. This vulnerability can be exploited remotely without authentication. The exploit code has been publicly disclosed. The vulnerability has a medium severity rating with a CVSS score of 6.9.

CVE-2026-76049 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. It affects the /admin/ajax.php?action=save_menu endpoint by allowing remote attackers to manipulate the ID parameter to execute unauthorized SQL commands. The vulnerability has a medium severity with a CVSS score of 6.9. Public exploit details have been disclosed, but no official patch or remediation is currently documented.

CVE-2026-75986 is a medium severity SQL injection vulnerability in code-projects Online Job Portal System version 1.0. It affects the Password Recovery component, specifically the /ForPass.php file, where manipulation of the txtUserName argument allows SQL injection. The vulnerability can be exploited remotely without authentication. Public exploit details have been disclosed.

CVE-2026-47720 is a SQL injection vulnerability in FUXA, a web-based SCADA/HMI/Dashboard software. Versions prior to 1.3.2 have an issue in the TDengine DAQ storage connector where backslashes are not properly escaped in SQL queries. This allows a remote unauthenticated attacker to inject SQL via crafted requests, potentially exposing historical PLC tag values, device identifiers, and device names. The vulnerability is fixed in version 1.3.2.

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.