CWE-89: SQL Injection vulnerabilities

CVE-2026-65520 is a critical unauthenticated SQL Injection vulnerability affecting miniOrange WP OAuth Server versions up to and including 6.2.0. This flaw allows an attacker to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently confirmed from the vendor. Users should monitor vendor advisories for updates and apply fixes once available.

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

CVE-2026-5134 is a critical SQL injection vulnerability in Loca Software Informatics Technology Ltd. Co. CMS. It allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. The vulnerability affects all CMS versions up to and including 06082026. The vendor has not responded to disclosure attempts, and no official patch or remediation guidance is available. The CVSS score is 9.8, indicating a high impact on confidentiality, integrity, and availability.

SourceCodester Computer Repair Shop Management System 1.0 contains a SQL injection vulnerability in the /classes/Master.php?f=delete_product endpoint. The vulnerability allows remote attackers to manipulate the ID parameter, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS score of 7.3, indicating a medium severity level. No patch or official remediation has been provided yet. Public exploit details have been disclosed, but no known exploitation in the wild has been reported.

A critical SQL injection vulnerability exists in the WPCargo Track & Trace WordPress plugin before version 8.0.4. The plugin fails to properly sanitize and escape a parameter used in a SQL statement, allowing unauthenticated attackers to perform SQL injection. This vulnerability affects a different code path than a previously known issue (CVE-2024-44004).

A SQL injection vulnerability exists in the Welcart e-Commerce WordPress plugin before version 2.11.32. The flaw arises because the plugin does not properly sanitize values imported from CSV files before using them in SQL statements. This vulnerability allows users with Editor role or higher, including custom shop-management roles, to perform SQL injection attacks.

Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.

Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.

Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -.

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.

ZTE Smart Life app has an SQL injection vulnerability that allows attackers to execute UNION SELECT queries on the feedback.db database. This can expose sensitive data including user accounts, phone numbers, feedback content, and local debug log paths. The vulnerability has a low CVSS score of 3.9 and does not have a confirmed patch or remediation guidance yet.

JoomSport – for Sports: Team & League, Football, Hockey & more WordPress plugin versions up to and including 5.7.9 contain a time-based SQL Injection vulnerability via the 'order' parameter. This vulnerability arises from insufficient escaping of user input and lack of query preparation. It can be exploited by attackers with administrator-level access or higher. The affected admin page lacks nonce or CSRF protection on the GET request, enabling unauthenticated attackers to trick administrators into executing malicious requests. The vulnerability requires the 'orderby' parameter to be present and non-empty alongside 'order'.

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars WordPress plugin contains a SQL Injection vulnerability in the 'wpma_metabox_authors_list' parameter in all versions up to and including 3.9.1. Authenticated users with author-level access or higher can exploit this by injecting SQL commands during post creation or editing, which are then executed when an admin views the post list screen. This vulnerability allows extraction of sensitive database information without impacting data integrity or availability.

The WP TripAdvisor Review Slider WordPress plugin up to version 14.3 contains an SQL Injection vulnerability via the 'curselrevs[]' parameter. This flaw allows authenticated users with administrator-level privileges or higher to inject additional SQL queries due to improper input sanitization and insufficient query preparation. The vulnerability can lead to unauthorized disclosure of sensitive database information. No official patch or remediation guidance has been provided yet.

The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.

The Askeet WordPress plugin for WooCommerce data is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions in all versions up to and including 3.0. The vulnerability arises because the askeet_is_safe_query() filter can be bypassed using MySQL conditional comments, allowing authenticated administrators to append additional SQL queries. This can lead to unauthorized extraction of sensitive database information. The CVSS score is 4.9 (medium severity). No official patch or remediation guidance is currently available.

The TableOn – WordPress Posts Table Filterable plugin up to version 1.0.5.1 is vulnerable to blind SQL Injection via the filter_data[comment_count] parameter in an AJAX action. This vulnerability arises from improper sanitization and direct interpolation of user input into SQL queries, allowing unauthenticated attackers to extract sensitive database information.

The User Access Manager plugin for WordPress contains a second-order SQL injection vulnerability in the 'id' parameter of the wp_ajax_save-attachment-compat AJAX action in versions up to and including 2.3.12. This vulnerability arises from insufficient validation and unparameterized concatenation of a stored value used in a SQL NOT IN() clause. Authenticated users with subscriber-level access or higher can exploit this to append additional SQL queries, potentially extracting sensitive database information.