CWE-89: SQL Injection vulnerabilities

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE-2026-108776 is a SQL Injection vulnerability in Apache Kylin versions 4.0.0 through 5.0.4. The vulnerability involves improper neutralization of special elements in SQL commands. The impact is considered moderate when the Kylin service operates in query-only mode, which is the default and most common configuration. The issue is fixed in version 5.0.5.

CVE-2026-13695 is a high-severity SQL injection vulnerability in the Integratec application. It affects the sInfo parameter sent via POST to the /login/ap_Login.aspx/start endpoint. Exploiting this UNION-based SQLi flaw could allow attackers to steal database data such as credentials and user information, cause errors, and partial denial-of-service. The vulnerability may also enable follow-up attacks like data exfiltration or privilege escalation.

CVE-2026-96534 is a SQL injection vulnerability in the Modern Events Calendar Lite and Pro WordPress plugins before version 7.37.0. The flaw allows authenticated users with minimal privileges (Subscriber and above) to inject SQL code due to improper sanitization and escaping of a parameter used in SQL statements.

The Ukr-To-Lat WordPress plugin versions up to and including 1.3.5 contain a SQL injection vulnerability. This flaw arises because the plugin does not properly sanitize and escape a term name before including it in a SQL query. Users with Contributor-level access or higher can exploit this vulnerability to perform SQL injection attacks. The vulnerability has a CVSS score of 6.8, indicating medium severity. There is no information about available patches or fixes at this time.

CVE-2026-91074 is a SQL injection vulnerability in the BSK PDF Manager WordPress plugin versions up to 3.8.1. The plugin fails to properly sanitize and escape a parameter used in a SQL query, allowing authenticated users with contributor-level access or higher to perform SQL injection attacks. This could lead to unauthorized reading of sensitive data, including administrator password hashes.

The Welcart e-Commerce plugin for WordPress contains an SQL Injection vulnerability in the 'wp_usces_order_old' parameter affecting all versions up to and including 2.12.4. Authenticated users with editor-level access or higher can exploit this flaw to append additional SQL queries, potentially extracting sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation. The CVSS score is 4.9, indicating a medium severity risk.

CVE-2026-55796 is an SQL injection vulnerability in the Salary Payments via ECS report of Frappe HRMS. Versions prior to 15.60.3 and between 16.0.0 and before 16.7.1 allow authenticated HR users to inject SQL via crafted report filter values. This can lead to unauthorized access to sensitive database records. The issue is fixed in versions 15.60.3 and 16.7.1.

PeerBanHelper versions from 5.0.0 up to but not including 9.3.15 contain an SQL injection vulnerability in the /api/statistic/analysis/field endpoint. Authenticated users can supply crafted field parameters that are unsafely interpolated into SQL queries without sanitization, allowing reading of all data in the PeerBanHelper database. This vulnerability is fixed in version 9.3.15.

MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 are affected by an SQL injection vulnerability. The issue arises because SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump commands do not consistently quote identifiers and values when serializing SQL, allowing a low-privileged attacker to inject SQL commands via crafted object identifiers or values. This vulnerability is fixed in the stated versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Apache Kylin versions 5.0.0 through 5.0.4 contain a critical SQL Injection vulnerability due to improper neutralization of special elements in SQL commands and missing authentication for a critical backend cache API. This flaw allows unauthenticated attackers to execute injected SQL commands, potentially compromising confidentiality, integrity, and availability. The issue primarily affects Kylin services exposed directly to public networks, which is uncommon in typical in-house deployments. Upgrading to version 5.0.5 resolves the vulnerability.

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress contains a SQL Injection vulnerability in the 'src_by' parameter affecting all versions up to and including 3.5.1. This vulnerability allows unauthenticated attackers or authenticated users with any POS role to inject malicious SQL commands via the /vitepos/v1/vendor/list REST route, potentially exposing sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation. The CVSS 3.1 score is 7.5 (high severity), indicating a network exploitable flaw with no privileges or user interaction required and high confidentiality impact. No patch information is provided, and no known exploits are reported in the wild.

The WP Booking System – Booking Calendar WordPress plugin contains an SQL Injection vulnerability in the 'data[orderby]' parameter in all versions up to and including 2.1.0.1. This flaw allows authenticated administrators to inject additional SQL queries due to insufficient input escaping and query preparation. Exploitation requires the calendar to have more than 200 bookings, as the vulnerable code path is triggered only under this condition. The vulnerability can lead to unauthorized disclosure of sensitive database information. The CVSS score is 4.9, indicating a medium severity risk.

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with editor-level access and above can perform SQL injection and read arbitrary information from the database. On multisite a sub-site editor can read the network-global users table, including the super administrator's password hash.

The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on.

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress contains a blind SQL Injection vulnerability in all versions up to and including 3.6.1. The flaw exists in the 'src_by[].val.start / src_by[].val.end' parameters with the 'bt' (BETWEEN) operator, allowing authenticated users with vendor-level access or higher to inject additional SQL commands. This vulnerability is due to insufficient escaping and incomplete patching of a previous SQL injection issue. It can lead to unauthorized extraction of sensitive database information.

Mail Mint plugin for WordPress versions up to and including 1.31.4 contains an SQL Injection vulnerability in the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint. The flaw arises from improper escaping of user-supplied filter values before they are interpolated into SQL queries, allowing authenticated users with the 'mint_read_contacts' capability to inject additional SQL commands. This can lead to unauthorized extraction of sensitive database information. The vulnerability has a CVSS score of 6.5, indicating medium severity. No official patch or fix information is provided.

Backuply – Backup, Restore, Migrate and Clone WordPress plugin versions up to 1.5.8 contains a SQL Injection vulnerability via the Biographical Info field. This second-order injection occurs during backup restoration, allowing authenticated users with subscriber-level access or higher to escalate privileges by modifying database entries such as the default_role option. The vulnerability enables full site takeover without direct data leakage during exploitation.