ARKETEAM Protectel modules PROTECTELMAJ and BDF contain an SQL injection vulnerability in the 'Utilisateur' parameter that allows low privileged users to inject SQL commands. This vulnerability has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowing SQL injection due to insufficient input neutralization. Users are recommended to upgrade to version 1.16.1, which will fix the issue.
This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint (GET /api/v1/centers) and the datatable entry read endpoints (GET /api/v1/datatables/{datatable}/{apptableId} and GET /api/v1/datatables/{datatable}/{apptableId}/{datatableId}) concatenate caller-supplied ordering parameters (orderBy, sortOrder, order) directly into the SQL ORDER BY clause. The existing regex-based input validation can be bypassed, allowing time-based blind SQL injection by any authenticated user with read access to centers or to the targeted datatable.
Users are recommended to upgrade to 1.16.1 which fixes the issue.
A SQL injection vulnerability exists in the WP Visitor Statistics (Real Time Traffic) WordPress plugin before version 8.8. This flaw arises because the plugin does not properly sanitize and escape a parameter before using it in a SQL statement. The vulnerability allows high-privilege users, such as administrators, to perform SQL injection attacks. The issue is fixed in version 8.8.
JoomSport – for Sports: Team & League, Football, Hockey & more WordPress plugin versions up to 5.7.14 contain a SQL Injection vulnerability in the 'pgroup' parameter. Authenticated users with contributor-level access or higher can exploit this by embedding a malicious shortcode in a post and previewing it, allowing them to append SQL queries to extract sensitive database information.
CVE-2026-61654 is a high-severity SQL Injection vulnerability in Lightdash versions prior to 0.3214.0. The vulnerability arises from an unauthenticated dbt Cloud webhook endpoint that lacks authentication middleware and signature validation unless a secret is configured. Unsanitized input parameters allow path traversal on the dbt Cloud API URL, potentially enabling unauthorized preview creation and API key misuse. The issue is fixed in version 0.3214.0, which adds path traversal protection and conditional HMAC signature verification.
CVE-2026-11587 is a high-severity SQL injection vulnerability in Centreon affecting versions 24.10 and 25.10. It allows an authenticated user with access to ACL management to read and modify the Centreon database. The vulnerability is fixed in centreon-web versions 24.10.28 and 25.10.15.
CVE-2026-61996 is a high-severity SQL Injection vulnerability affecting MLS On The Fly versions up to and including 1.8.1.5. This flaw allows an attacker with limited privileges to perform SQL injection attacks, potentially leading to partial data confidentiality loss and limited availability impact. No public exploits or patches are currently documented.
The Newsmatic WordPress theme by blazethemes contains a blind SQL Injection vulnerability in the 'slug' parameter affecting all versions up to 1.5.0. This flaw allows unauthenticated attackers to inject additional SQL queries due to insufficient escaping and lack of proper query preparation, potentially exposing sensitive database information.
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'team_id' parameter in all versions up to, and including, 5.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reached when the season has no associated joomsport_tournament term, which is the default state for newly created seasons.
CVE-2026-114358 is a critical SQL Injection vulnerability in the Radius Xenia M2M Platform. It arises from insufficient validation of user input in the password recovery functionality of the web management interface. An unauthenticated remote attacker can exploit this flaw by injecting crafted SQL queries. Successful exploitation may lead to unauthorized access to sensitive data, database structure enumeration, or modification of database records.
vTables WordPress plugin versions before 0.3 contain an SQL injection vulnerability due to improper sanitization and escaping of a parameter used in SQL statements. This flaw allows unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database. The vulnerability is fixed in version 0.3.
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish WordPress plugin contains a SQL Injection vulnerability in the 'exclude_posts' parameter affecting all versions up to 4.1.12. This flaw allows unauthenticated attackers to inject arbitrary SQL queries due to insufficient input escaping and lack of proper query preparation. Additionally, the HMAC authentication mechanism protecting the endpoint can be bypassed on new installations before the administrator visits the settings page, as the secret key is not yet generated, enabling attackers to compute valid tokens and exploit the vulnerability.
The SendPress Newsletters plugin for WordPress contains a time-based SQL Injection vulnerability in the 'subscriberid' parameter affecting all versions up to and including 1.26.1.20. This vulnerability arises from insufficient escaping of user input and inadequate preparation of SQL queries, allowing unauthenticated attackers to inject additional SQL commands. The nonce intended to protect the handler uses a hardcoded action value that is publicly accessible, effectively bypassing this protection and enabling exploitation without authentication.
CVE-2026-61569 is a high-severity SQL injection vulnerability in WWBN AVideo-Encoder versions prior to 8.1.0. It affects the unauthenticated streamer login endpoint, allowing attackers to inject SQL via the 'user' parameter. This can lead to unauthorized reading of sensitive encoder database data, including upstream streamer credentials and configuration. The vulnerability is fixed in version 8.1.0.
OpenCATS versions prior to 0.10.0 contain an improper input validation vulnerability in the DataGrid date filtering functionality. Authenticated users can manipulate the 'period', 'startDate', and 'endDate' parameters to alter SQL queries without proper escaping, potentially accessing sensitive data such as user accounts, candidate records, and job information. This vulnerability is fixed in version 0.10.0.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a critical SQL Injection vulnerability (CWE-89). This flaw allows a low privileged attacker with remote access to potentially execute unauthorized SQL commands, leading to unauthorized access to managed systems. The vulnerability is addressed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a SQL Injection vulnerability (CWE-89). This flaw allows a low privileged remote attacker to potentially disclose information by exploiting improper neutralization of special elements in SQL commands. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
CVE-2026-14571 is a critical Blind SQL Injection vulnerability in Futurum Software's User Authentication Module. It arises from insufficient validation and sanitization of user inputs in database queries and an incorrect Web Application Firewall (WAF) configuration. This flaw allows unauthenticated attackers to bypass protection mechanisms by sending manipulated HTTP requests. Successful exploitation can lead to arbitrary database queries, exposing the database structure and sensitive customer data, including personally identifiable information (PII). A fix was released in May 2026.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially expose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.