CWE-89: SQL Injection vulnerabilities

CVE-2026-110733 is a SQL Injection vulnerability in the sql-storage module of Apache SIS versions 1.0 through 1.6. The issue arises when sorting a stream of features, where the ORDER BY clause is constructed without properly quoting identifiers, allowing crafted input to inject SQL code. This vulnerability does not affect other modules such as sis-referencing. The issue is fixed in Apache SIS version 1.7.

CVE-2026-115192 is an SQL Injection vulnerability in the Mautic core dashboard widget data API endpoint (/api/data/{type}). It allows an authenticated user with API access to inject SQL via chart filter parameters that are not properly validated. Exploitation can lead to reading arbitrary data from the database, including sensitive contact, marketing, and user account data with password hashes. The vulnerability does not allow data modification but can be used to slow down database queries, impacting availability. Exploitation requires the Mautic API to be enabled.

CVE-2026-115191 is a SQL injection vulnerability in the Mautic core product affecting certain versions prior to fixed releases. It occurs in a contact lookup AJAX endpoint of the Mautic administration interface where a request parameter controlling the contact field to search by is not properly validated. Any authenticated user, regardless of role or permissions, can exploit this flaw to execute arbitrary SQL queries against the Mautic database. This allows reading sensitive data such as user accounts, email addresses, password hashes, contact data, and campaign content.

Cacti versions from 1.2.27 up to but not including 1.2.31 contain an authenticated stored second-order SQL injection vulnerability in the automation tree rule item handler. A user with Automation realm privileges can inject arbitrary SQL fragments that are later executed when an administrator applies automation rules, potentially leading to data exfiltration via the UI. This vulnerability has been fixed in version 1.2.31.

CVE-2026-55465 is a medium severity SQL injection vulnerability in the intranda goobi-viewer-core web application. Versions from 22.04 up to but not including 26.05 are affected. The vulnerability arises from an unauthenticated REST endpoint that improperly concatenates user input into a Solr query without escaping or schema enforcement. This allows attackers to inject Solr local-param syntax and boolean operators to bypass access controls and retrieve restricted georeferenced records. The issue is fixed in version 26.05.

CVE-2026-55444 is an input validation vulnerability in the legacy RSS servlet of intranda goobi-viewer-core versions prior to 26.05. The servlet improperly concatenates user-supplied q and filterQuery parameters into Solr queries without validation, allowing unauthenticated attackers to inject Solr boolean operators. This can bypass access controls and expose access-restricted records in the RSS feed. The issue is fixed in version 26.05.

baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain an SQL injection vulnerability in the Admin and Api/Admin prefixes. Authenticated users with admin panel access can inject SQL fragments via query parameters passed directly to the ORM, potentially allowing arbitrary SQL execution including reading password hashes. The issue was patched in versions 5.3.2 and 5.4.2.

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CVE-2026-87936 is an SQL Injection vulnerability in the Drupal amazee.ai Private AI Provider. It affects versions from 0.0.0 up to but not including 1.3.7, and from 1.4.0 up to but not including 1.4.3. The vulnerability allows improper neutralization of special elements in SQL commands, potentially leading to unauthorized data access. The issue is fixed in versions 1.3.7 and 1.4.3. The CVSS score is 6.5, indicating a medium severity risk.

CVE-2026-87938 is a SQL Injection vulnerability in the Drupal CSP log component affecting versions from 0.0.0 up to but not including 1.0.2. This flaw allows improper neutralization of special elements in SQL commands, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. A fix is available in version 1.0.2.

The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.

The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.

The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement, which allows authenticated users with Subscriber-level access and above to append additional SQL queries into already existing queries and extract sensitive data from the database.

CVE-2026-108087 is a high-severity SQL injection vulnerability in Apache Cocoon affecting all versions. The flaw arises from improper neutralization of special elements in SQL commands, allowing arbitrary SQL injection via the SQL processor or sql:/esql: logicsheets. Apache Cocoon is a retired project with no planned fixes, so users are advised to migrate to alternatives or restrict access to trusted users only.

A SQL Injection vulnerability (CWE-89) exists in the TYPO3 extension "sgalinski Cookie Consent" in the backend module for reviewing consent history. The module improperly uses sorting, grouping, and index options from requests directly in database queries without validation, allowing a backend user with access to history or statistics functions to read arbitrary database data, including password hashes. The issue affects versions >=8.0.0 <8.1.12 and >=0 <7.4.6 and has been fixed in versions 8.1.12 and 7.4.6.

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

YS-infoware's BA-Workflow contains a SQL Injection vulnerability (CWE-89) that allows authenticated remote attackers to inject arbitrary SQL commands. This can lead to unauthorized reading, modification, or deletion of database contents. The vulnerability affects versions prior to 3.6.2.7 and has a high severity score of 8.7. A fix is available in version 3.6.2.7.

YS-infoware's BA-Workflow software contains a SQL Injection vulnerability (CWE-89) affecting versions prior to 3.6. Authenticated remote attackers can exploit this flaw to execute arbitrary SQL commands, potentially allowing them to read, modify, or delete database contents. The vulnerability has a high severity with a CVSS 4.0 score of 8.7. A fix is available in version 3.6.

YS-infoware's BA-Workflow software contains a SQL Injection vulnerability (CWE-89) that allows authenticated remote attackers to execute arbitrary SQL commands. This can lead to unauthorized reading, modification, and deletion of database contents. The vulnerability affects versions prior to 3.6 and has a high severity rating with a CVSS score of 8.7. A fix is available in version 3.6.