By weakness (CWE)

CWE-89: related vulnerabilities

CVEs classified under CWE-89. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

440 published vulnerabilities · page 1 of 5

• CVE-2026-12044HIGH 8.8

  A SQL injection flaw in pgAdmin 4 allows an authenticated user to break out of database description fields by injecting a single quote, then execute arbitrary SQL commands. The vulnerability exists across 16 template locations where user-supplied descriptions are rendered directly into SQL without proper escaping—in dialogs for Domains, Foreign Tables, Languages, Event Triggers, and Views. An attacker with superuser or similar elevated database roles could escalate further to run OS commands on the PostgreSQL host. However, the flaw does not grant new database access; it only bypasses application-layer controls a DBA may have configured to restrict direct SQL execution.

• CVE-2026-15067HIGH 8.8

  Snowflake Terraform Provider versions before 2.18.0 contain two critical injection flaws. An attacker who can modify workspace variables in a Terraform pipeline could execute arbitrary SQL commands under the provider's Snowflake session privileges, potentially stealing sensitive data or creating persistent access credentials. A second vulnerability allows attackers to inject DDL commands into user creation statements, enabling account creation with attacker-controlled passwords that bypass your configured security policies. Both require initial access to your Terraform workflow or pipeline configuration.

• CVE-2026-36670HIGH 8.8

  A time-based blind SQL injection vulnerability exists in OpenSIPS Control Panel versions before 9.3.3. An attacker who already has valid credentials can craft a specially malformed request to the alias management feature that causes the application to execute arbitrary SQL commands. The vulnerability is exploited through the 'table' parameter and doesn't require user interaction—the attacker can silently extract or modify database contents.

• CVE-2026-44238HIGH 8.8

  FreePBX versions before 16.0.50 and 17.0.11 contain a SQL injection vulnerability in the CDR (Call Detail Records) Reports module. An authenticated user with CDR section access can manipulate the 'order' and 'sort' parameters to inject arbitrary SQL commands, potentially reading, modifying, or deleting sensitive database content. Unlike many vulnerabilities requiring administrative accounts, this one only needs standard CDR access, broadening the pool of potential attackers within an organization.

• CVE-2026-44272HIGH 8.8

  Dell Wyse Management Suite versions before 2605 contain a SQL injection flaw that allows attackers with low-level network access to bypass authentication controls and gain unauthorized access to the system. An authenticated user on the network can craft malicious input to manipulate database queries, potentially extracting sensitive data or modifying system configurations.

• CVE-2026-45418HIGH 8.8

  ClipBucket v5 contains a SQL injection vulnerability in its subtitle management feature. Any authenticated user with video upload privileges can exploit a flaw in the subtitle editing endpoint to inject malicious SQL commands. By manipulating the 'number' parameter in requests to `/actions/subtitle_edit.php`, attackers can execute blind SQL injection attacks to extract sensitive data from the underlying database. The vulnerability was fixed in version 5.5.3 - #132.

• CVE-2026-49498HIGH 8.8

  Ghidra versions 11.0 through 12.0 contain a SQL injection flaw in the password-change functionality of its PostgreSQL database integration. An authenticated user can manipulate their username to inject malicious SQL commands, ultimately gaining superuser access to the entire PostgreSQL database. This is a post-authentication attack that requires valid credentials but can lead to complete database compromise.

• CVE-2026-50636HIGH 8.8

  LimeSurvey's RemoteControl API contains a SQL injection vulnerability in two methods used to manage survey participant invitations. An authenticated attacker with permission to update survey tokens can craft a malicious input array that breaks out of the intended SQL query and execute arbitrary database commands. Because LimeSurvey's database configuration allows stacked queries, an attacker can not only read sensitive data—such as administrator password hashes, survey responses, and user session records—but also modify or delete any data in the database, including taking over administrator accounts. This attack requires the RemoteControl interface to be explicitly enabled (not the default configuration) and authenticated API access.

• CVE-2026-52758HIGH 8.8

  Ghidra, the NSA's reverse-engineering toolkit, contains a SQL injection flaw in its BSim (Binary Similarity) feature before version 12.1. An attacker with network access and valid credentials can craft malicious queries through BSim's network protocol to inject SQL commands directly into the underlying PostgreSQL database. This allows reading sensitive data, modifying existing records, or destroying data outright. The vulnerability requires authentication, but the impact if exploited is severe.

• CVE-2026-54404HIGH 8.8

  A vulnerability in Ubiquiti UniFi OS allows attackers who already have network access and low-level user credentials to run specially crafted SQL commands that bypass normal security controls and gain administrative privileges. This affects a broad range of UniFi networking and video recording devices. An attacker would need existing credentials to exploit this—they cannot attack from outside the network or without logging in first.

• CVE-2026-56841HIGH 8.8

  An authenticated SQL injection vulnerability in UniFi Protect allows a user or attacker with valid network access and low-level privileges to execute arbitrary SQL commands against the application's database. By manipulating SQL queries through the application interface, an attacker can bypass security controls and gain elevated permissions on the host device running UniFi Protect. This is a post-authentication attack; the attacker must already have some form of access to the system or network.

• CVE-2026-59257HIGH 8.8

  n8n versions before 1.123.61, 2.27.4, and 2.28.1 are vulnerable to SQL injection through the legacy MySQL v1 node when it processes user-controlled input in SQL queries. If an n8n workflow connects an externally-accessible trigger (like a Webhook) to a MySQL v1 operation, an attacker can inject malicious SQL commands that execute with the privileges of the configured database account. The newer MySQL v2 node is not affected because it properly isolates SQL code from user input.

• CVE-2026-7570HIGH 8.8

  A SQL injection vulnerability in Quest NetVault Backup's NVBUDashboard component allows authenticated users to execute arbitrary code on the server. While the vulnerability nominally requires valid credentials, the authentication mechanism can be bypassed, making this effectively an unauthenticated remote code execution risk. An attacker exploiting this flaw gains the privileges of the NETWORK SERVICE account, enabling full system compromise.

• CVE-2026-8443HIGH 8.8

  The WP Review Slider Pro WordPress plugin contains a SQL injection flaw that allows authenticated users with basic subscriber-level permissions to extract sensitive data from a website's database. The vulnerability stems from improper handling of user input in the plugin's charting functionality—specifically, the code removes WordPress's built-in protections before processing user-supplied data and then directly inserts that data into database queries without additional safeguards. Because the plugin returns the actual SQL queries in its responses, attackers can easily verify whether their injection attempts succeeded, making exploitation straightforward.

• CVE-2026-8444HIGH 8.8

  The WP Review Slider Pro plugin for WordPress contains a SQL injection vulnerability in its AJAX review-finding functionality. Attackers with basic subscriber-level access can inject malicious SQL commands through the 'curselrevs' parameter, allowing them to extract sensitive data from the WordPress database. The vulnerability exists because the plugin fails to properly sanitize user input before constructing database queries.

• CVE-2026-9781HIGH 8.8

  Quest NetVault Backup contains a SQL injection flaw in its NVBURASDevice JSON-RPC message handler that allows authenticated users—or attackers who bypass authentication—to execute arbitrary code with NETWORK SERVICE privileges. While the vulnerability nominally requires valid credentials, the authentication mechanism itself can be circumvented, making this a practical remote code execution risk for organizations running affected NetVault Backup deployments.

• CVE-2026-9782HIGH 8.8

  Quest NetVault Backup contains a SQL injection vulnerability in its NVBUDeviceDrive JSON-RPC message handler that allows authenticated users to execute arbitrary code on the backup server with NETWORK SERVICE privileges. While the vulnerability requires valid credentials, the authentication mechanism itself can be bypassed, effectively making this exploitable by remote attackers without prior access. This is a critical flaw for organizations relying on NetVault Backup for data protection.

• CVE-2026-9783HIGH 8.8

  A SQL injection flaw in Quest NetVault Backup's NVBURemovableMedia message handler allows authenticated users to inject malicious SQL commands and execute arbitrary code on the backup server. Although the application normally requires login credentials, those authentication checks can be circumvented, making this exploitable by remote, unauthenticated attackers. Code execution runs under the NETWORK SERVICE account, providing significant control over the affected system.

• CVE-2026-9784HIGH 8.8

  Quest NetVault Backup contains a SQL injection vulnerability in its NVBULibraryPort JSON-RPC message handler that allows authenticated attackers to execute arbitrary code on the system. Although the vulnerability nominally requires valid credentials, the authentication mechanism can be circumvented, making this a critical remote code execution risk for organizations running affected NetVault Backup installations. The attacker-controlled code runs with NETWORK SERVICE privileges, potentially granting broad system access.

• CVE-2026-9785HIGH 8.8

  Quest NetVault Backup contains a SQL injection vulnerability in its NVBULibrarySlot JSON-RPC message handler that allows authenticated users to execute arbitrary code on the backup server. While the vulnerability technically requires valid credentials, the authentication mechanism itself can be circumvented, making this effectively unauthenticated remote code execution. An attacker exploiting this flaw gains the privileges of the NETWORK SERVICE account, which typically has broad access to system resources and backup data.

• CVE-2026-9786HIGH 8.8

  Quest NetVault Backup contains a SQL injection vulnerability in its NVBUDashboard component that allows authenticated attackers to execute arbitrary code with NETWORK SERVICE privileges. Although the vulnerability technically requires valid credentials, the authentication mechanism can be bypassed, making this a practical remote code execution risk. The flaw stems from insufficient validation of user-supplied strings in JSON-RPC message processing before they're used in SQL query construction.

• CVE-2026-3326HIGH 8.6

  A critical flaw in the Xstore WordPress theme before version 9.7.3 allows attackers to execute SQL injection attacks without any authentication. The vulnerability exists in an AJAX handler that fails to properly sanitize user input before incorporating it into database queries. Because the vulnerable endpoint is accessible to anonymous users, this represents a severe risk to any WordPress site using the affected theme version.

• CVE-2025-69135HIGH 8.5

  A SQL injection vulnerability exists in the WordPress Events Calendar plugin version 2.7.2 and earlier. An authenticated user with subscriber-level permissions can inject malicious SQL commands through the Events Schedule feature, potentially exposing sensitive database information. This vulnerability requires an attacker to have valid WordPress credentials but does not require user interaction, making it a significant risk for multi-user WordPress installations.

• CVE-2026-22335HIGH 8.5

  A SQL injection vulnerability has been discovered in WooCommerce Frontend Manager – Ultimate plugin versions before 6.7.7. The vulnerability allows authenticated users (those with subscriber-level access or higher) to inject malicious SQL commands through the plugin interface. This could enable attackers to read sensitive data from the website's database, though the vulnerability does not appear to enable direct modification of data. An attacker would need valid login credentials to exploit this issue.

• CVE-2026-39581HIGH 8.5

  A SQL injection vulnerability exists in WP Sessions Time Monitoring Full Automatic plugin version 1.1.4 and earlier. An authenticated attacker with subscriber-level permissions can inject malicious SQL commands through the plugin's input validation, potentially exposing sensitive database information. The vulnerability requires an existing user account but no additional interaction, making it a meaningful risk in multi-user WordPress environments.

• CVE-2026-48882HIGH 8.5

  A SQL injection vulnerability has been discovered in WP Time Slots Booking Form plugin versions 1.2.50 and earlier. An authenticated user with subscriber-level permissions can execute arbitrary SQL queries against the WordPress database. This allows attackers to read sensitive data such as user credentials, plugin configurations, and other database records without requiring administrative access.

• CVE-2026-48964HIGH 8.5

  ELEX WordPress HelpDesk & Customer Ticketing System versions 3.3.6 and earlier contain a SQL injection vulnerability that allows authenticated users with subscriber-level permissions to execute arbitrary SQL queries against the database. An attacker with a subscriber account could extract sensitive data, including customer information and internal ticketing records, without needing administrator access. This is a significant risk for organizations using this plugin to manage customer support tickets and sensitive communications.

• CVE-2026-49073HIGH 8.5

  A blind SQL injection vulnerability exists in wpWax Directorist Booking that allows authenticated users to execute arbitrary SQL queries against the underlying database without seeing direct results. An attacker with login credentials can exploit this flaw to extract sensitive information, bypass authentication mechanisms, or degrade system availability. The vulnerability affects versions up to and including 3.0.3.

• CVE-2026-49489HIGH 8.5

  OpenCATS, a recruitment and applicant tracking software, contains a SQL injection flaw in its data grid sorting feature. An authenticated user can manipulate the sortDirection parameter to inject malicious SQL commands, allowing them to extract sensitive information from the application's database. The vulnerability requires valid login credentials but poses significant risk because attacker queries execute without user interaction and can retrieve confidential candidate, recruiter, and business data.

• CVE-2026-54813HIGH 8.5

  A SQL injection vulnerability exists in Brainstorm Force SureDash through version 1.8.0 that allows authenticated users to execute blind SQL injection attacks. An attacker with valid login credentials can inject malicious SQL commands into application input fields, potentially extracting sensitive data from the underlying database without seeing direct query results. The vulnerability requires user authentication, which limits but does not eliminate risk in environments where account compromise or insider threats are concerns.

• CVE-2026-54818HIGH 8.5

  Slimstat Analytics, a WordPress plugin for visitor tracking and analytics, contains a blind SQL injection vulnerability that allows authenticated users to execute arbitrary database queries. An attacker with login access can extract sensitive data from the WordPress database without triggering obvious error messages, since blind SQL injection works through time-based or boolean-based inference rather than direct output. Versions up to and including 5.4.11 are affected.

• CVE-2026-56012HIGH 8.5

  CVE-2026-56012 is a SQL injection vulnerability in David Lingren Media Library Assistant that allows authenticated attackers to extract sensitive data through blind SQL injection techniques. An attacker with valid login credentials can craft malicious database queries that bypass application validation, enabling unauthorized access to confidential information without leaving obvious traces of tampering. Versions 3.35 and earlier are affected.

• CVE-2026-56690HIGH 8.5

  Dell PowerFlex Manager versions before 5.1.0.1 contain a SQL injection flaw that allows attackers with low-level user credentials and network access to query the database directly. An attacker could extract sensitive data, modify information, or gain unauthorized access to storage infrastructure management functions without requiring special privileges or user interaction.

• CVE-2026-57663HIGH 8.5

  A SQL injection vulnerability exists in the Zip Recipes WordPress plugin (Recipe Maker For Your Food Blog) in versions 8.2.7 and earlier. The flaw allows authenticated contributors—users with the ability to create and edit recipe content—to inject malicious SQL commands through the plugin's interface. An attacker with contributor-level access could query, modify, or delete sensitive database records, though direct denial of service is also possible. This is a server-side vulnerability requiring valid WordPress credentials, which limits exposure to internal threats or compromised contributor accounts.

• CVE-2026-57955HIGH 8.5

  SigNoz, an open-source observability platform, contains a SQL injection flaw in its alert history API endpoints. Authenticated users can inject malicious code through the rule ID parameter to run arbitrary database queries against ClickHouse, the underlying data store. Attackers can extract all stored traces, logs, and metrics, or leverage database functions to reach external systems. The vulnerability affects versions through 0.130.1 and requires valid login credentials to exploit.

• CVE-2026-10105HIGH 8.3

  Agno version 2.6.5 contains a SQL injection flaw in its ClickHouse vector database integration. An authenticated attacker can inject malicious SQL commands through the delete_by_metadata() function by crafting specially formatted metadata keys and values. This allows an attacker to delete database records, steal sensitive data, or manipulate stored information. The vulnerability requires valid credentials to exploit, but once authenticated, an attacker has significant control over the database.

• CVE-2026-13744HIGH 8.3

  Snowflake CLI versions before 3.19 contain a vulnerability that allows attackers to inject and execute unauthorized SQL commands. An attacker can craft malicious repository content, project configuration files, manifest data, or specification inputs that, when processed by a vulnerable CLI command, will execute SQL statements in the context of the user's Snowflake database session. The actual damage depends on what database permissions that user has. Exploitation requires the victim to actively process the attacker's content, so this is not a passive network attack.

• CVE-2026-34914HIGH 8.3

  Revive Adserver versions 6.0.6 and earlier contain a SQL injection vulnerability in the zone-include.php script. A low-privileged user can manipulate the clientid parameter to inject SQL commands, potentially accessing, modifying, or deleting sensitive data from the underlying database. The vulnerability requires authentication, which limits exposure but still poses significant risk in shared hosting or multi-tenant environments where user accounts are readily available.

• CVE-2016-20062HIGH 8.2

  A SQL injection flaw in the Simply Poll WordPress plugin version 1.4.1 allows attackers without login credentials to steal data directly from a site's database. By crafting malicious requests to the plugin's AJAX handler, an attacker can execute arbitrary database queries and extract sensitive information such as user credentials, posts, or custom data. The vulnerability requires no user interaction and can be exploited by anyone with network access to the affected WordPress site.

• CVE-2016-20065HIGH 8.2

  The Product Catalog 8 plugin version 1.2 for WordPress contains a critical SQL injection flaw that allows attackers to bypass authentication entirely and directly query the WordPress database. An unauthenticated attacker can craft a specially designed POST request to the admin-ajax.php endpoint, manipulating the selectedCategory parameter to inject arbitrary SQL commands. This enables unauthorized data extraction from sensitive WordPress database tables, potentially exposing user credentials, posts, comments, and configuration data without requiring login credentials or user interaction.

• CVE-2016-20068HIGH 8.2

  WordPress Booking Calendar Contact Form version 1.0.23 has a serious security flaw that allows attackers to steal database information without needing to log in. By sending specially crafted requests to the website's admin-ajax.php endpoint, an attacker can inject SQL commands through the 'id' parameter and extract sensitive data like user credentials, customer information, or other database contents. The vulnerability requires no authentication and can be exploited remotely over the network.

• CVE-2016-20069HIGH 8.2

  WordPress Booking Calendar Contact Form version 1.0.23 contains a flaw that allows unauthenticated attackers to inject malicious SQL commands through the calendar shortcode parameter. Because the plugin fails to properly validate and sanitize user input before passing it to database queries, attackers can execute arbitrary SQL statements to read sensitive data from the WordPress database without needing credentials or user interaction.

• CVE-2016-20071HIGH 8.2

  The 404 Redirection Manager plugin version 1.0 for WordPress has a serious flaw that allows attackers to steal data directly from your WordPress database without needing to log in. An attacker can send a specially crafted web request containing SQL commands, which the plugin fails to validate, leading to unauthorized database access. This is a remote vulnerability that requires no authentication and can be exploited from anywhere on the internet.

• CVE-2016-20072HIGH 8.2

  A critical security flaw exists in the BBS e-Franchise 1.1.1 WordPress plugin that allows attackers to steal sensitive data directly from your WordPress database without needing to log in. The vulnerability is in how the plugin handles the `uid` parameter—attackers can inject malicious SQL commands that trick the database into revealing user accounts, passwords, and other sensitive information. This is a classic SQL injection attack delivered through web requests to pages using the plugin's shortcode functionality.

• CVE-2016-20073HIGH 8.2

  A WordPress plugin called Answer My Question version 1.3 contains a flaw that lets attackers without user accounts inject malicious database commands. By sending specially crafted requests to a specific plugin file, attackers can read sensitive information from the WordPress database, including site configuration and taxonomy data. The vulnerability requires no user interaction and can be exploited remotely over the network.

• CVE-2017-20243HIGH 8.2

  The WordPress Car Park Booking Plugin version from October 17 contains a SQL injection flaw that allows attackers to directly manipulate the plugin's database queries without authentication. By crafting malicious requests with specially crafted parameters, attackers can extract sensitive information from the WordPress database, such as user credentials, booking details, and other confidential records. The vulnerability is exploited through time-based SQL injection techniques, where attackers observe database response delays to infer data values.

• CVE-2017-20244HIGH 8.2

  The Wow Forms WordPress plugin version 2.1 has a critical flaw that lets attackers steal sensitive information directly from a website's database without needing to log in. By sending specially crafted requests to the plugin's form-handling endpoint, an attacker can inject malicious SQL commands through the form ID parameter, bypassing the plugin's security controls and reading any database content they want—including user credentials, email addresses, and other confidential data.

• CVE-2017-20245HIGH 8.2

  The Wow Viral Signups WordPress plugin version 2.1 contains a SQL injection flaw that allows attackers to steal data directly from your website's database without needing to log in. An attacker can craft a malicious request to the WordPress admin-ajax.php endpoint, inject SQL commands into the 'idsignup' parameter, and read sensitive information such as user credentials, email addresses, and other stored data. The vulnerability is trivial to trigger and requires no special privileges.

• CVE-2017-20246HIGH 8.2

  The KittyCatfish 2.2 WordPress plugin contains a critical SQL injection flaw that allows anyone on the internet to steal data directly from the affected website's database without needing to log in. An attacker can manipulate a web request parameter to inject malicious SQL commands, then extract sensitive information—usernames, passwords, email addresses, or other stored data—by observing subtle timing differences or boolean responses from the server. No authentication or user interaction is required.

• CVE-2017-20247HIGH 8.2

  WordPress sites running the PICA Photo Gallery plugin version 1.0 are vulnerable to SQL injection attacks. An attacker can manipulate the 'aid' parameter in GET requests to execute unauthorized database queries without needing to log in. This allows extraction of sensitive data such as WordPress user credentials and other database contents, posing a direct threat to site integrity and user privacy.

• CVE-2017-20249HIGH 8.2

  Apptha Slider Gallery version 1.0 contains a critical SQL injection flaw that lets attackers without any authentication bypass the application and extract sensitive data directly from the database. By crafting malicious requests with poisoned parameters, attackers can pull user credentials and password hashes. The vulnerability requires no user interaction and is trivially easy to exploit over the network.

• CVE-2017-20252HIGH 8.2

  Joomla's NextGen Editor extension version 2.1.0 contains an SQL injection flaw that lets attackers bypass authentication and directly query the site's database. An unauthenticated attacker can craft a malicious web request targeting the plname parameter to extract sensitive data—including user credentials, configuration details, or other confidential information stored in the database. The attack requires no special user privileges or interaction, making it straightforward to exploit over the network.

• CVE-2017-20253HIGH 8.2

  A critical flaw exists in Joomla! Component My Projects version 2.0 that allows attackers to inject malicious SQL commands without requiring authentication. By manipulating the VerAyari parameter in requests to the component, attackers can execute arbitrary database queries, potentially exposing usernames, passwords, and other sensitive system information stored in the database.

• CVE-2017-20254HIGH 8.2

  Joomla! Component User Bench version 1.0 has a critical flaw that allows attackers to read sensitive database information without logging in. By crafting a specially formed web request, an attacker can inject malicious SQL commands into the userid parameter, potentially exposing usernames, passwords, and system configuration data stored in the application's database. No authentication or user interaction is required to attempt this attack.

• CVE-2017-20255HIGH 8.2

  Joomla! Component JB Visa version 1.0 contains a critical SQL injection flaw that lets unauthenticated attackers query the application's database directly. By crafting malicious GET requests to specific Joomla parameters, an attacker can extract sensitive data—usernames, passwords, email addresses, and other database contents—without needing to log in. The vulnerability requires only network access and a properly formed HTTP request, making it relatively straightforward to exploit.

• CVE-2017-20256HIGH 8.2

  Joomla Survey Force Deluxe version 3.2.4 contains a SQL injection flaw accessible without authentication. Attackers can craft malicious web requests to the vulnerable component and inject SQL commands through a parameter called 'invite,' allowing them to query and extract data directly from the underlying database. This is a straightforward injection attack requiring no user interaction or credentials.

• CVE-2017-20257HIGH 8.2

  Joomla! Component Quiz Deluxe version 3.7.4 contains an SQL injection flaw that allows attackers to send malicious database commands without authentication. By crafting specially formatted requests to the component's quiz flagging feature, an attacker can read sensitive data from the database, such as user credentials, quiz answers, or other protected information. This vulnerability requires no user interaction or credentials to exploit.

• CVE-2017-20258HIGH 8.2

  A SQL injection flaw in Joomla! Component RPC Responsive Portfolio version 1.6.1 allows attackers without credentials to retrieve sensitive database information. By crafting a specially-formulated web request, an attacker can inject malicious SQL commands through the component's portfolio item ID parameter, potentially exposing user data, credentials, or other confidential records stored in the application's database.

• CVE-2017-20259HIGH 8.2

  Joomla's OSDownloads extension version 1.7.4 contains an SQL injection flaw that allows attackers to run arbitrary database commands without authentication. By crafting malicious requests to the item view, attackers can read sensitive data like database credentials and configuration settings directly from the backend.

• CVE-2017-20260HIGH 8.2

  A SQL injection flaw in Joomla! Component Price Alert version 3.0.2 allows attackers to inject malicious database commands through the product_id parameter without needing to authenticate. By targeting the subscribeajax view with specially crafted requests, attackers can extract sensitive information from the database, including user credentials and system configuration details. The vulnerability is straightforward to exploit and carries significant risk to any site running the affected component version.

• CVE-2017-20261HIGH 8.2

  Joomla! installations running the Bargain Product VM3 component version 1.0 are vulnerable to unauthenticated SQL injection attacks. An attacker can craft malicious SQL commands within web requests and send them to specific component views to extract sensitive data directly from the underlying database. No authentication or user interaction is required—the vulnerability is remotely exploitable over the network.

• CVE-2017-20262HIGH 8.2

  A SQL injection flaw in Joomla's Ajax Quiz component version 1.8 allows attackers to inject malicious database commands through web requests without needing to log in. By crafting specially formatted URLs, an attacker can extract sensitive information directly from the underlying database, such as table names, user credentials, and other confidential data. The vulnerability is straightforward to exploit over the network and requires no user interaction.

• CVE-2017-20263HIGH 8.2

  A vulnerability in the Joomla! FocalPoint Pro/Free component (version 1.2.3) allows attackers to inject SQL commands into website databases without authentication. By crafting a malicious web request with a specially prepared ID parameter, an attacker can extract sensitive data such as user credentials, customer information, or other confidential records stored in the database. This is a remote attack that requires no special access or user interaction—any unauthenticated person on the internet can exploit it.

• CVE-2017-20266HIGH 8.2

  Joomla SP Movie Database version 1.3 contains a flaw that allows attackers on the internet to steal sensitive data from the database without needing a login. An attacker can craft a malicious search query that tricks the database into executing unintended commands, exposing information like user credentials, private content, or system details. The vulnerability is accessed through the search feature, making it easy for attackers to discover and exploit.

• CVE-2017-20267HIGH 8.2

  The Joomla! Calendar Planner component version 1.0.1 suffers from an SQL injection flaw that allows attackers to execute arbitrary SQL queries without authentication. By crafting malicious GET requests to the events view with specially crafted SQL code in the category_id parameter, an attacker can bypass database access controls and extract sensitive information directly from the underlying database. This vulnerability is particularly concerning because it requires no user interaction, no prior access, and can be exploited by anyone with network connectivity to the affected system.

• CVE-2017-20268HIGH 8.2

  Joomla! Component Zap Calendar Lite version 4.3.4 contains an SQL injection flaw that allows attackers to bypass authentication entirely and extract sensitive database information. By crafting malicious SQL commands and sending them through a specific plugin parameter, an unauthenticated attacker can enumerate database names, table structures, and potentially retrieve confidential data. The vulnerability requires no special access, no user interaction, and can be exploited remotely over the network.

• CVE-2017-20269HIGH 8.2

  Joomla! users running the KissGallery component version 1.0.0 face a serious security risk. The component fails to properly validate user input in its URL handling, allowing attackers to inject malicious SQL commands without any authentication. An attacker can craft a specially designed URL targeting the kissgallery endpoint and extract sensitive data directly from the database. This is a remote, unauthenticated attack that requires no user interaction—a significant concern for any Joomla deployment hosting this component.

• CVE-2017-20270HIGH 8.2

  A SQL injection vulnerability exists in Joomla!'s Twitch TV component (version 1.1) that allows attackers to bypass authentication entirely and directly manipulate database queries. By crafting malicious requests through the username and id parameters, an unauthenticated attacker can extract sensitive information from the underlying database—including user credentials, API keys, and system configuration data. The vulnerability requires no user interaction and can be exploited remotely by anyone with network access to the affected Joomla instance.

• CVE-2017-20271HIGH 8.2

  A vulnerability in Joomla StreetGuessr Game version 1.1.8 allows attackers to inject SQL commands through a web request without needing login credentials. By manipulating the catid parameter in a specially crafted URL, attackers can extract sensitive information from the underlying database, including version details and database names. This is a classic SQL injection flaw that requires no user interaction and can be exploited remotely over the network.

• CVE-2017-20272HIGH 8.2

  Joomla Ultimate Property Listing version 1.0.2 contains an SQL injection flaw that allows attackers to bypass authentication entirely and query the application's database directly. By crafting malicious requests to the component's listing view, an attacker can extract sensitive data such as table names, column structures, and potentially user information or financial records stored in the database. No special access, account, or user interaction is required to exploit this vulnerability.

• CVE-2017-20273HIGH 8.2

  Joomla Event Registration Pro Calendar version 4.1.3 has a SQL injection flaw that allows attackers to inject malicious database commands through the id parameter in web requests. An attacker can craft a specially formatted GET request to expose sensitive data stored in the database without needing to log in or interact with legitimate users. The vulnerability requires only network access and no special conditions to exploit.

• CVE-2017-20274HIGH 8.2

  Joomla LMS King Professional version 3.2.4.0 contains an SQL injection flaw that lets unauthenticated attackers manipulate the underlying database without authentication. An attacker can craft a malicious web request targeting the learning path feature, injecting SQL commands through a specific parameter to read sensitive data from the database. This doesn't require the attacker to be logged in or interact with a user—it's a direct attack on the application's database layer.

• CVE-2017-20275HIGH 8.2

  Joomla! websites running the PHP-Bridge component version 1.2.3 are vulnerable to SQL injection attacks. An attacker can craft a malicious web request to extract sensitive database information without needing any credentials. By manipulating the id parameter in a GET request, an attacker gains read access to database tables, column names, and potentially usernames, passwords, or other sensitive data stored in the database.

• CVE-2017-20276HIGH 8.2

  A SQL injection vulnerability exists in Joomla!'s SIMGenealogy component (version 2.1.5) that allows attackers to bypass authentication and extract sensitive database information. By crafting malicious GET requests to the component's latest-view endpoint, unauthenticated attackers can inject SQL commands through the type parameter, potentially exposing user data, credentials, or other confidential information stored in the database. This is a network-accessible, remotely exploitable flaw requiring no user interaction.

• CVE-2017-20277HIGH 8.2

  The Joomla JoomRecipe component version 1.0.4 contains a SQL injection flaw in its search functionality. An unauthenticated attacker can craft malicious search requests to extract sensitive data from the underlying database without triggering obvious errors—a technique called blind SQL injection. The vulnerability requires no user interaction and is exploitable over the network, making it a meaningful risk for sites running this component.

• CVE-2017-20278HIGH 8.2

  JoomRecipe, a Joomla component, contains a flaw that allows attackers to inject malicious SQL commands through the category parameter when requesting recipe lists. An unauthenticated attacker can craft a specially formed web request to extract sensitive information from the underlying database without needing valid login credentials. The vulnerability affects version 1.0.3 and is exploitable over the network with no complex prerequisites.

• CVE-2017-20279HIGH 8.2

  Joomla Payage version 2.05 contains a SQL injection flaw in its payment processing functionality. An attacker can craft malicious web requests containing specially crafted SQL code in the payment ID parameter, allowing unauthorized database access without needing to log in. Using this vulnerability, an attacker could extract sensitive information from the underlying database using blind SQL injection techniques—either observing timing differences in responses or true/false patterns—to gradually exfiltrate data.

• CVE-2017-20280HIGH 8.2

  The Joomla Myportfolio component version 3.0.2 contains a flaw that allows attackers to inject malicious SQL commands into database queries without needing to log in. By crafting specially formatted web requests to a specific endpoint, an attacker can retrieve sensitive information stored in the database. This is a remote attack that requires no authentication and no user interaction.

• CVE-2017-20281HIGH 8.2

  A SQL injection vulnerability exists in Joomla's Extra Search component (version 2.2.8) that allows attackers to query and extract sensitive data from affected databases without authentication. By crafting malicious GET requests to the component's search functionality, an attacker can bypass normal data access controls and retrieve information that should remain confidential—such as user credentials, email addresses, or other sensitive records stored in the database.

• CVE-2017-20282HIGH 8.2

  The Joomla! jCart component for OpenCart 2.0 is vulnerable to SQL injection—a flaw that allows attackers to send specially crafted requests that trick the application into executing unintended database commands. An unauthenticated attacker can exploit this by manipulating the product_id parameter in GET requests, potentially extracting sensitive information from the underlying database without any authentication or user interaction required. The vulnerability is network-accessible and carries a high severity rating due to the ease of exploitation and the confidentiality risk it poses.

• CVE-2018-25382HIGH 8.2

  Zechat 1.5 contains an SQL injection flaw in its profile.php endpoint that allows attackers to inject malicious SQL commands through the username parameter without authentication. By crafting specially formatted requests, an attacker can extract database structure information and sensitive data directly from the application's backend database.

• CVE-2018-25385HIGH 8.2

  E-Registrasi Pencak Silat version 18.10 contains an SQL injection flaw that allows attackers without credentials to retrieve sensitive data from the application's database. By crafting malicious requests to the monitor_nilai.php endpoint, an attacker can inject SQL commands through the id_partai parameter to extract admin credentials, user records, and other protected information. No authentication is required to attempt this attack.

• CVE-2018-25386HIGH 8.2

  HaPe PKH 1.1 contains multiple SQL injection flaws in its admin media management interface that allow attackers to inject malicious SQL commands and extract sensitive database information. Unauthenticated attackers can target the village module, while authenticated users can exploit several administrative modules. The vulnerability stems from improper handling of the 'id' parameter, enabling attackers to manipulate database queries and retrieve system-level data such as database credentials, names, and DBMS version details.

• CVE-2018-25389HIGH 8.2

  HaPe PKH 1.1 is vulnerable to SQL injection through the 'nama_kelompok' parameter in the lap-anggota-kelompok-pdf.php endpoint. An attacker can send a specially crafted request without authentication to execute arbitrary SQL commands, enabling extraction of sensitive database information using time-based blind techniques. This is a direct-to-database attack that bypasses application logic entirely.

• CVE-2018-25390HIGH 8.2

  HaPe PKH 1.1 is vulnerable to SQL injection through its lap-peserta-perdesa-pdf.php endpoint. An attacker can send a specially crafted request containing SQL code in the 'desa' POST parameter to manipulate database queries without authentication. Using time-based blind SQL injection techniques, an adversary can extract sensitive information from the underlying database by observing query response delays.

• CVE-2018-25394HIGH 8.2

  Kados R10 GreenBee contains an SQL injection flaw that allows attackers without authentication to read sensitive database information by crafting malicious web requests. The vulnerability exists in a administrative function that fails to properly validate user input, enabling an attacker to embed SQL commands directly into the system's database queries. This could expose usernames, database names, and system version details.

• CVE-2018-25395HIGH 8.2

  Kados R10 GreenBee contains a critical SQL injection flaw in its board feature management interface. An attacker without authentication can craft a specially formatted web request targeting the feature update function to inject arbitrary SQL commands directly into the database. This allows the attacker to read sensitive data like database credentials, user information, and system details—potentially exposing the entire database to compromise.

• CVE-2018-25398HIGH 8.2

  CVE-2018-25398 is an unauthenticated SQL injection vulnerability in Open ISES Project version 3.30A. An attacker can craft malicious database queries and submit them through the frm_passwd parameter in POST requests to main.php, bypassing authentication entirely. This allows extraction of sensitive database contents—usernames, database names, system versions—without needing valid credentials. The vulnerability is remotely exploitable with no special conditions required.

• CVE-2018-25399HIGH 8.2

  Open ISES Project version 3.30A contains an SQL injection flaw in its nearby.php endpoint that lets unauthenticated attackers inject malicious SQL commands through two URL parameters: tick_lat and tick_lng. An attacker can craft a simple GET request to extract sensitive information from the underlying database, such as usernames, database identifiers, and version numbers. No authentication is required, and exploitation is straightforward—making this a high-severity issue for any organization running this software.

• CVE-2018-25400HIGH 8.2

  Open ISES Project version 3.30A contains an unauthenticated SQL injection vulnerability in its form submission endpoint. An attacker can craft malicious SQL code and send it through a web request to extract sensitive information from the application's database without needing valid credentials. The vulnerability requires no user interaction and can be exploited over the network, making it a significant remote threat.

• CVE-2018-25401HIGH 8.2

  Open ISES Project version 3.30A is vulnerable to SQL injection through an unauthenticated web interface. An attacker can craft malicious database queries and send them via HTTP GET requests to the sever_graph.php endpoint, bypassing authentication entirely. This allows extraction of sensitive database schema and contents without legitimate access.

• CVE-2018-25402HIGH 8.2

  Open ISES Project version 3.30A contains an SQL injection vulnerability accessible to unauthenticated attackers over the network. By crafting malicious SQL statements in the p1 parameter of GET requests to inc_types_graph.php, an attacker can query the underlying database directly, potentially exposing schema details, user records, and other sensitive stored data. The vulnerability requires no authentication or user interaction, making it relatively straightforward to exploit.

• CVE-2018-25403HIGH 8.2

  A SQL injection vulnerability exists in Open ISES Project version 3.30A that allows attackers without authentication to inject malicious database commands through a web parameter. By crafting specially designed requests to the city_graph.php file, attackers can extract sensitive information from the underlying database, including schema details and other stored data. The vulnerability requires no user interaction and can be exploited over the network.

• CVE-2018-25404HIGH 8.2

  Open ISES Project version 3.30A is vulnerable to SQL injection through its add_facnote.php endpoint. An attacker can craft malicious SQL code in the ticket_id parameter and send it via a GET request without needing to authenticate first. This allows the attacker to read sensitive data directly from the database, including version information and other confidential records. The vulnerability requires no special conditions—any internet-connected instance of the software is at risk.

• CVE-2018-25405HIGH 8.2

  eNdonesia Portal version 8.7 is vulnerable to multiple SQL injection flaws that allow unauthenticated attackers to extract sensitive data directly from the database. An attacker can manipulate specific web parameters—artid, cid, did, contid, and aboutid in the mod.php file—to inject malicious SQL commands. This bypasses normal authentication and gives direct access to usernames, database credentials, and system version information without requiring any valid user account.

• CVE-2018-25406HIGH 8.2

  eNdonesia Portal version 8.7 contains multiple SQL injection flaws that allow attackers without authentication to run arbitrary database commands. By inserting malicious SQL code into specific URL parameters—artid, cid, did, contid, and aboutid—across five different modules (publisher, diskusi, galeri, content, and about), attackers can extract sensitive information like database credentials and system version details. This is a network-based attack requiring no user interaction or prior access.

• CVE-2018-25407HIGH 8.2

  eNdonesia Portal version 8.7 contains multiple SQL injection flaws in its mod.php file that allow attackers to inject malicious SQL commands without authentication. By crafting specially formed requests targeting parameters like artid, cid, did, contid, and aboutid across various portal modules (publisher, diskusi, galeri, content, about), an attacker can extract sensitive database information such as usernames, database names, and version details. No user interaction or authentication is required to exploit this vulnerability.

• CVE-2018-25411HIGH 8.2

  MGB OpenSource Guestbook version 0.7.0.2 contains a flaw that allows attackers to inject malicious database commands into the application without needing to log in. By sending specially crafted web requests to the email.php file with harmful code embedded in the 'id' parameter, an attacker can read sensitive information directly from the database—including the names of tables and columns that store user data. This vulnerability requires no authentication, making it trivial for an external attacker to exploit.

• CVE-2018-25413HIGH 8.2

  AiOPMSD Final version 1.0.0 contains an SQL injection flaw that allows attackers to execute unauthorized database queries without authentication. By crafting malicious SQL statements and sending them through the application's search function (search.php), an attacker can extract sensitive information such as database credentials, usernames, and system details. This is a network-based attack requiring no user interaction or special privileges.

• CVE-2018-25414HIGH 8.2

  AiOPMSD Final version 1.0.0 contains a straightforward but serious SQL injection flaw in its actor.php endpoint. An attacker can craft malicious SQL code and send it through the actor parameter via a simple GET request—no authentication required—to execute arbitrary database queries. This allows them to extract sensitive information like database credentials, usernames, and version details directly from the backend database.