CWE-89: SQL Injection vulnerabilities

Unauthenticated SQL Injection in Listdom <= 5.6.0 versions.

Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.

Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

Subscriber SQL Injection in Do Lasso <= 358 versions.

Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call. This issue affects ash: from 1.17.0 before 3.31.3.

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command.

Winter CMS versions up to and including 1.2.12 have a SQL injection vulnerability in the backend Filter widget's numberrange scope when configured with a conditions key. This flaw allows an authenticated backend user to inject arbitrary SQL via the filter's AJAX handler, potentially reading arbitrary database contents. Exploitation requires a third-party plugin to register such a filter scope; a vanilla installation is not affected. The issue is fixed in version 1.2.13.

phpMyFAQ version 4.2.0-alpha contains an authenticated SQL LIKE wildcard injection vulnerability in its chat user search API. This flaw allows any logged-in user to inject SQL LIKE wildcards (%) and (_) into search queries, bypassing intended display-name filtering and enabling enumeration of active user IDs and display names. The vulnerability is due to improper escaping of SQL LIKE metacharacters. A patch is available to address this issue. The vulnerability has a medium severity with a CVSS score of 5.4.

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.