CWE-89: SQL Injection vulnerabilities

The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection vulnerabilities. This service listens on a specific port, runs with root privileges, and is protected by weak credentials. The database supports the COPY FROM PROGRAM syntax, allowing local attackers to bypass Android's permission sandbox and gain full root access.

Ajax Load More WordPress plugin versions before 8.0.1 contain a SQL injection vulnerability. This flaw allows unauthenticated attackers to perform time-based blind SQL injection by exploiting improper sanitization and escaping of a parameter used in SQL queries. The vulnerability can lead to extraction of sensitive data from the database. The CVSS score is 9.1, indicating a critical severity level.

The PrettyLinks WordPress plugin up to version 3.6.20 contains an SQL Injection vulnerability in the 's' (search) parameter on the Pretty Links listing page. This flaw allows authenticated users with Administrator-level access or higher to inject additional SQL queries due to insufficient escaping and lack of proper query preparation in the search_links_table() function. The vulnerability can lead to unauthorized disclosure of sensitive database information.

CVE-2026-15941 is a medium severity SQL injection vulnerability in the Relevanssi Premium WordPress plugin. It affects the Admin Search page where authenticated users with the edit_posts capability can perform searches. The vulnerability arises because user-controlled taxonomy query data is sanitized as text but not properly parameterized before being used in an SQL query. This allows an authenticated contributor-level attacker to perform time-based blind SQL injection against the WordPress database via an AJAX request.

CVE-2026-11421 is a SQL Injection vulnerability in the WordPress plugin 'ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce' affecting all versions up to and including 1.17.4. The flaw arises from improper sanitization of the 'erpadvancefilter' parameter, allowing authenticated users with CRM Agent role or higher to inject SQL code. This vulnerability can be exploited to extract sensitive database information. The CVSS score is 6.5 (medium severity). No official patch or remediation guidance is currently available.

The VikAppointments Services Booking Calendar WordPress plugin contains an unauthenticated SQL injection vulnerability. This flaw arises because a parameter controlling the sorting of the public reviews list is used directly in a database query without proper validation or sanitization. An attacker can exploit this to inject arbitrary SQL commands and read sensitive data such as WordPress user credentials without needing to authenticate or have special privileges.

CVE-2026-64631 is a high-severity SQL Injection vulnerability in Veeam ONE that allows a low-privileged user to inject SQL commands and extract database contents. This vulnerability does not have a confirmed patch or official remediation at the time of publication. No known exploits in the wild have been reported. The vulnerability impacts confidentiality and integrity with high scope and impact metrics according to CVSS 4.0 scoring.

Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.

Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.

Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.

Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.

Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.

A SQL Injection vulnerability exists in the Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before version 1.5.5. This flaw arises because the plugin does not properly sanitize and escape a parameter before using it in a SQL statement. Exploitation requires a user with a specific capability, which by default is limited to administrators but can be delegated to lower privileged roles. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

The LogMyTrip WordPress plugin up to version 1.9 contains a SQL injection vulnerability due to improper sanitization and escaping of a cookie value used in SQL queries. This flaw allows unauthenticated attackers to inject SQL code via any page rendering the plugin's shortcodes. The vulnerability has a high severity score of 8.6 and impacts confidentiality but not integrity or availability.

The sm page duplicator WordPress plugin version 1.0.0 and earlier contains a SQL Injection vulnerability. This flaw occurs because the plugin does not properly sanitize and escape stored values used in SQL statements when duplicating a page. Users with Editor role or higher privileges can exploit this vulnerability to perform SQL Injection attacks. The vulnerability has a high severity score of 8.1 and impacts confidentiality and integrity without affecting availability.

The Super Store Finder WordPress plugin before 7.11 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.

A critical SQL injection vulnerability exists in the Link Library WordPress plugin before version 7.9.3. The plugin does not properly sanitize and escape user-supplied input before including it in SQL queries, allowing unauthenticated attackers to execute arbitrary SQL commands. This can lead to full compromise of the confidentiality and integrity of the affected database. No official patch or remediation guidance is currently confirmed.

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than doubling them. Because Athena and Trino do not treat backslashes as escape characters inside string literals, attacker-supplied input such as a single quote followed by SQL syntax causes the parser to terminate the string literal prematurely, enabling data exfiltration via UNION SELECT, execution of destructive statements, and attacker-controlled CTAS destination and content.