CWE-89: SQL Injection vulnerabilities

FluentCart, a WordPress eCommerce plugin, contains an SQL Injection vulnerability in versions up to and including 1.7.0. The flaw arises from improper escaping of user-supplied parameters in SQL queries, allowing authenticated users with custom-level access or higher to append malicious SQL commands. On FluentCart Pro, users with the Manager shop role can exploit this without administrator privileges. The vulnerability has a medium severity with a CVSS score of 4.9 and can lead to unauthorized disclosure of sensitive database information.

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.

Tianji, an open source analytics and monitoring platform, contains an SQL injection vulnerability in the getDateQuery() function prior to version 1.31.29. The vulnerability arises because the timezone value is interpolated directly into raw SQL without parameter binding, allowing authenticated workspace members, including read-only viewers, to execute arbitrary SQL commands. This can lead to unauthorized disclosure or modification of sensitive data such as credentials, API keys, and tenant information, or cause service disruption. The issue is resolved in version 1.31.29.

CVE-2026-26245 is a SQL injection vulnerability in QNAP Systems Inc. Video Station. It allows a remote attacker with a user account to execute unauthorized code or commands. The issue is fixed in Video Station version 5.8.8 and later. Versions from 5.8.x up to but not including 5.8.8 are affected. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity.

CVE-2026-26244 is a SQL injection vulnerability in QNAP Systems Inc.'s Video Station product. It allows a remote attacker with a user account to execute unauthorized code or commands. The vulnerability is fixed in Video Station version 5.8.8 and later.

Slican IPx telephone exchanges' WebCTI service is vulnerable to SQL Injection via the /webcti/admin_json.php endpoint. This vulnerability allows an authenticated attacker to execute SQL Injection attacks due to improper neutralization of input. The issue affects versions prior to 6.62.0100 and has been fixed in version 6.62.0100.

The Link Library plugin for WordPress suffers from a time-based SQL Injection vulnerability in the 'link_url' parameter. This affects all versions up to and including 7.9.2. The flaw allows unauthenticated attackers to inject additional SQL commands due to insufficient escaping and lack of proper query preparation, potentially exposing sensitive database information.

CVE-2026-55684 is a critical SQL injection vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have an unauthenticated endpoint that improperly handles user input in SQL INSERT statements, allowing remote attackers to execute arbitrary SQL commands. This can lead to unauthorized reading, modification, or deletion of sensitive data including billing, member, employee, permission, and credential information. The vulnerability is fixed in version 3.8.6.

CVE-2026-55681 is a high-severity SQL injection vulnerability in the WeGIA web manager for charitable institutions. Prior to version 3.8.6, authenticated users with access to the Material & Patrimônio module can exploit improper sanitization of the id_produto parameter in a specific PHP script. This allows arbitrary SQL commands to be executed, potentially exposing or modifying sensitive institutional and inventory data. The vulnerability is fixed in version 3.8.6.

CVE-2026-55679 is an OS command injection vulnerability in the LabRedesCefetRJ WeGIA web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to reach the pre-installation endpoint and inject commands via the 'usuario' parameter in the Linux reinstall flow. This leads to execution of arbitrary commands as the web-server user, persistence of attacker-controlled PHP configuration, and potential disruption or alteration of application data. The issue is fixed in version 3.8.6.

CVE-2026-55680 is a critical SQL injection vulnerability in WeGIA, a web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to inject arbitrary SQL code via the 'codigo' parameter in a POST request to cadastro_cobranca.php. This vulnerability permits reading or modifying database content, including sensitive user credential hashes and billing records. The issue is fixed in version 3.8.6.

CVE-2026-55683 is a critical SQL injection vulnerability in the LabRedesCefetRJ WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have an unauthenticated endpoint that improperly incorporates user input into SQL queries without using prepared statements. This allows remote attackers to execute arbitrary SQL commands, potentially reading, modifying, or deleting database content including billing records and credentials. The vulnerability is fixed in version 3.8.6.

CVE-2026-55572 is a critical SQL injection vulnerability in the e107 content management system versions prior to 2.3.7. It affects the alt_auth plugin's otherdb and e107db authentication backends, which improperly sanitize user input in SQL queries. This flaw allows unauthenticated attackers to inject SQL commands when alt_auth is configured with an external database, potentially exposing or modifying sensitive data. The vulnerability is fixed in e107 version 2.3.7.

CVE-2026-42093 is a high-severity SQL injection vulnerability in the Redash data visualization package. It affects versions after 8.0.0 up to but not including 26.9.0. The flaw arises from improper handling of certain query parameters in the Query Results query runner, allowing authenticated users with view-only access to inject SQL commands and execute them with elevated privileges. This issue is fixed in version 26.9.0.

CVE-2026-101997 is a high-severity SQL Injection vulnerability in the ipfd component of Juniper Networks Junos OS on SRX Series devices. It allows an unauthenticated network attacker to execute code with root privileges via a configured Security Intelligence feed connection. The vulnerability affects multiple versions of Junos OS prior to specific patch releases. The CVSS score is 8.1, indicating a significant risk of confidentiality, integrity, and availability impact.

CVE-2026-103946 is an SQL injection vulnerability in Tenable, Inc.'s Nessus product that affects versions prior to 10.12.5. It allows an authenticated user to read or modify data stored by Nessus. The vulnerability has a high severity with a CVSS score of 8.3.

CVE-2026-89076 is a high-severity SQL injection vulnerability in the Custom Reports module of Progress MOVEit Transfer. It affects versions before 2025.1.6 and from 2026.0.0 up to but not including 2026.0.4. The vulnerability allows improper neutralization of special elements in SQL commands, potentially leading to full confidentiality, integrity, and availability compromise. No known exploits are reported in the wild. The CVSS score is 7.2, indicating a significant risk if exploited.

Dell PowerScale InsightIQ versions 5.2.0 through 6.3.0 contain an SQL Injection vulnerability (CWE-89) that allows a low privileged local attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but can affect system availability.

CVE-2026-108065 is a critical SQL Injection vulnerability in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce. It allows an unauthenticated remote attacker to manipulate the sUserID parameter to execute arbitrary SQL commands on the backend Microsoft SQL Server. This can lead to full compromise of the database, including reading, writing, and executing commands.

Koha Community's Koha software is affected by a SQL injection vulnerability in the Most-circulated items report. The vulnerability arises from unsafe concatenation of user-controlled parameters into SQL queries without proper validation or sanitization. Authenticated staff users with reports module permission can exploit this to execute arbitrary SQL commands and access sensitive database information. The issue is fixed in Koha versions 24.11.19, 25.05.14, 25.11.08, and 26.05.03.