CWE-89: SQL Injection vulnerabilities

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.

The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes.

The CubeWP Framework WordPress plugin before 1.1.31 does not properly sanitize and escape a parameter before using it in a SQL statement through an AJAX action, and does not include a capability check on that action, allowing users with Subscriber-level access and above to perform SQL injection attacks.

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

The Iptanus File Upload WordPress plugin before 5.1.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by unauthenticated users.

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

CVE-2026-66838 is a medium severity SQL Injection vulnerability in the elixir-ecto postgrex library. It arises from improper neutralization of special elements in the :comment option of Postgrex.stream/4, allowing an attacker who can control this value to inject SQL clauses within the streamed statement. The injection is limited to the streamed statement and cannot chain further commands. This affects postgrex versions from 0.19.3 up to but not including 0.22.4.

A SQL injection vulnerability exists in the Content Views WordPress plugin versions before 4.5. The flaw arises because the plugin does not perform a capability check on one of its AJAX actions and fails to properly sanitize attacker-supplied input before using it in a SQL query. This allows any authenticated user, including those with minimal privileges such as Subscribers, to execute SQL injection attacks.

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used.

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the `field` and `order` parameters in paginated list endpoints

A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument delid results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

The Creative Mail WordPress plugin versions 1.6.5 through 1.6.9 contain an unauthenticated SQL injection vulnerability due to improper sanitization and escaping of a parameter used in an SQL statement when managing abandoned cart emails. This flaw allows remote attackers to execute SQL injection attacks without authentication.

CVE-2026-34191 is a critical SQL Injection vulnerability in the Apache Portable Runtime Utility affecting versions 1.6.0 through 1.6.3. It arises from improper neutralization of special elements in SQL commands via the apr_dbd_oracle provider. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to high confidentiality and integrity impacts without affecting availability.

CVE-2026-66447 is a critical unauthenticated SQL Injection vulnerability affecting the nickboss WordPress File Upload plugin versions up to and including 5.1.7. This flaw allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance has been provided yet.

CVE-2026-65569 is a high severity SQL Injection vulnerability in WP Job Portal affecting versions up to and including 2.5.6. The flaw allows improper neutralization of special elements in SQL commands, specifically in the Subscriber functionality. This vulnerability can lead to a high impact on confidentiality with limited impact on availability and no impact on integrity as per CVSS 3.1 scoring. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-65546 is a critical unauthenticated SQL Injection vulnerability affecting Qode Tours versions up to and including 3.1.3.1. This flaw allows remote attackers to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently available from the vendor.