CVE-2026-4978 is a critical SQL Injection vulnerability in the UMAI Vision Traffic Analysis System affecting versions from 29 up to but not including 34. This flaw allows improper neutralization of special elements in SQL commands, potentially enabling attackers to execute arbitrary SQL queries. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. A fix is available in version 34.
CVE-2026-17543 is a high-severity SQL injection vulnerability in PHP caused by improper escaping of backslashes in attacker-supplied parameters. It affects multiple PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9. This flaw allows attackers to perform SQL injection attacks due to improper neutralization of special elements in SQL commands. No official patch or remediation level is currently confirmed.
CVE-2026-22620 is a high severity SQL injection vulnerability in the authentication component of Eaton's Tripp Lite PADM firmware. This flaw allows an unauthenticated remote attacker to bypass authentication and gain privileged user access to the device. The vulnerability arises from improper input validation of special elements used in SQL commands. No specific affected versions or patches have been disclosed yet.
CVE-2026-58046 is a critical SQL injection vulnerability in the WebPros Plesk XML-RPC API. It allows a remote authenticated user with low privileges to inject SQL commands, enabling them to read arbitrary data from the Plesk database and potentially achieve full control over the panel. The vulnerability affects all Plesk versions prior to 18.0.79.4. A fix is available in version 18.0.79.4.
CVE-2026-13395 is a high-severity SQL injection vulnerability in the Online Scheduling and Appointment Booking System WordPress plugin. Versions before 27.8 do not properly sanitize or cast a user-supplied parameter in unauthenticated front-end booking requests, allowing attackers to perform SQL injection. This can lead to extraction of sensitive data such as password hashes from the database. No official patch or remediation guidance is currently available.
A SQL injection vulnerability exists in the WP Hotel Booking WordPress plugin versions before 2.3.2. The flaw occurs because an administrative search parameter is not properly sanitized or escaped before being used in a SQL query. This allows users with booking-management roles to perform SQL injection attacks. The vulnerability has a CVSS score of 6.8, indicating medium severity.
The Improved Save Button plugin for WordPress up to version 1.2.1 is vulnerable to a second-order SQL Injection via the 'meta_key' custom field when using the 'Save and Duplicate' action. This vulnerability arises from insufficient escaping of user-supplied input and inadequate preparation of SQL queries, allowing authenticated users with author-level access or higher to append additional SQL commands. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level.
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issue does not require user interaction. Scope is changed.
CVE-2026-15929 is a high-severity SQL injection vulnerability in LG Electronics SmartShare affecting versions up to and including 2.3.1712.1202. The flaw involves improper neutralization of special elements in SQL commands, which could allow an attacker to manipulate database queries. This vulnerability affects SmartShare running on Microsoft Windows 10 and earlier versions. No official patch or remediation guidance has been provided yet.
A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands.
CVE-2026-33385 is a Blind SQL Injection vulnerability in OpenSolution Quick.CMS version 6.8. It arises from improper neutralization of input fields in the administration panel, which is accessible to high-privileged users. The vulnerability allows bypassing front-end validation and could lead to database manipulation or destruction. The vendor has not provided a patch or remediation, citing the trust model of the administration panel and its existing modification capabilities. No known exploits are reported in the wild.
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.
The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.8.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with shop manager-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
WP Photo Album Plus plugin for WordPress versions up to and including 9.2.04.002 contains a SQL Injection vulnerability via the 'table' parameter. Authenticated users with administrator privileges can exploit this to append additional SQL queries and extract sensitive database information. The vulnerability can also be triggered via CSRF due to the lack of a nonce check on the export-table endpoint.
CVE-2026-6881 is a critical SQL Injection vulnerability in the Giving Reports functionality of Ellucian Advance Web and Legacy Advance. An authenticated attacker can exploit this flaw by injecting crafted SQL queries into the class credit field to extract sensitive database information. Ellucian CRM Advance is not affected by this issue. No patch or official remediation guidance has been provided yet.
The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.
The Plugin Organizer plugin for WordPress is vulnerable to SQL Injection via the 'PO_plugin_path' parameter in versions up to, and including, 10.2.4. This is due to insufficient escaping on the user-supplied parameter in the perform_plugin_search() function, where esc_sql() output is passed as the replacement string to preg_replace(), which collapses backslash escapes and defeats the quoting protection; additionally, the AJAX handler lacks both nonce verification and capability checks. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.