By weakness (CWE)

CWE-89: related vulnerabilities

CVEs classified under CWE-89. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

440 published vulnerabilities · page 4 of 5

• CVE-2026-13226MEDIUM 6.5

  The Groundhogg WordPress plugin for CRM, newsletters, and marketing automation contains a SQL injection vulnerability in its contact table AJAX handler. An authenticated user—regardless of their role—can inject malicious SQL commands through the 'after' parameter to access sensitive database information. This vulnerability exists because the parameter isn't properly escaped, the SQL query lacks preparation defenses, and the security checks that should restrict access have been disabled. While exploitation requires an existing user account, the lack of role restrictions makes this a significant risk for organizations running the plugin.

• CVE-2026-13331MEDIUM 6.5

  The Groundhogg CRM and marketing automation plugin for WordPress contains a SQL injection vulnerability in its search functionality. An authenticated user with marketer-level permissions or higher can craft malicious search queries to extract sensitive data from the WordPress database. The vulnerability exists because the search parameter is not properly escaped before being used in SQL queries. While an attacker needs valid WordPress credentials, the risk is significant because marketers and similar roles often have access to customer data, making unauthorized database extraction a realistic threat.

• CVE-2026-13333MEDIUM 6.5

  A SQL injection vulnerability exists in the Groundhogg WordPress plugin (versions up to 4.5.5) that allows attackers with Sales Representative access or higher to extract sensitive data from the website's database. The vulnerability stems from improper handling of query parameters combined with a bypass mechanism—attackers can submit malformed filter requests that trigger an exception, causing the system to fall back to legacy code that doesn't properly sanitize user input. While authentication is required, the low privilege threshold and straightforward exploitation method make this a meaningful risk for organizations using this plugin.

• CVE-2026-13454MEDIUM 6.5

  A flaw in the MotoPress Appointment Booking WordPress plugin allows database extraction attacks. The vulnerability exists in how the plugin processes search parameters, failing to properly filter or prepare user input before passing it to database queries. Any WordPress user with the mpa_appointment_employee role can exploit this to read sensitive data from the database—customer contact information, appointment details, payment records, or other stored information. The flaw affects all versions up to 2.4.5.

• CVE-2026-14029MEDIUM 6.5

  Groundhogg, a WordPress plugin used for customer relationship management, newsletters, and marketing automation, contains a SQL injection flaw that allows authenticated users with certain privileges to extract sensitive data from the database. The vulnerability exists in versions up to 4.5.8 and is triggered through the 'select' parameter, which the plugin fails to properly sanitize before using in database queries. While exploitation requires an attacker to already have a Groundhogg user account with custom-level access or higher, the capability needed (view_contacts) is granted by default to most built-in Groundhogg roles above subscriber level, making it a realistic threat for organizations running this plugin.

• CVE-2026-15104MEDIUM 6.5

  The BetterDocs plugin for WordPress—used to build internal documentation, knowledge bases, and FAQ systems—contains a SQL injection vulnerability in versions up to 4.6.0. An authenticated user with custom-level access or higher can manipulate a language parameter to inject malicious SQL commands and extract sensitive data from the site's database. The attack requires a supported multilingual plugin (WPML, Polylang, qTranslate, Weglot, or TranslatePress) to be active, which gates the vulnerable code path.

• CVE-2026-15287MEDIUM 6.5

  The rtMedia plugin for WordPress, which integrates with BuddyPress and bbPress, contains a SQL injection vulnerability in how it processes the order_by parameter. Attackers who have at minimum a subscriber-level WordPress account can manipulate this parameter to inject malicious SQL commands into database queries. This allows them to read sensitive data stored in the WordPress database without modifying or deleting it. The vulnerability affects all versions up to and including 4.6.18.

• CVE-2026-2508MEDIUM 6.5

  The Gravity Forms Booking plugin for WordPress contains a SQL injection vulnerability affecting all versions up to 2.7.1. Attackers with Subscriber-level access or higher can inject malicious SQL commands through the 'staff_id' parameter to extract sensitive database information. The vulnerability requires authentication but poses a meaningful risk to sites that allow user registration or have internal staff accounts.

• CVE-2026-39229MEDIUM 6.5

  Bolt CMS versions up to 3.7.0 contain a SQL injection vulnerability in how it processes the 'order' parameter on content listing pages. An attacker who has legitimate user credentials—even with minimal permissions—can craft malicious input to extract sensitive data from the database. The vulnerability is triggered through the OrderDirective component during normal sorting operations. This is an information disclosure risk; attackers cannot modify or delete data, but they can read information they shouldn't access.

• CVE-2026-44744MEDIUM 6.5

  SAP S/4HANA (On-Premise) contains a SQL injection flaw in a remote-enabled function module that allows authenticated users to craft malicious database queries. An attacker with valid credentials could bypass normal access controls and retrieve sensitive data they shouldn't see. The vulnerability does not affect system availability or data integrity—only confidentiality is at risk.

• CVE-2026-5074MEDIUM 6.5

  ARMember Premium, a WordPress plugin, contains a SQL Injection vulnerability in its AJAX handler that processes user-supplied sort parameters without proper validation. An authenticated user with basic Subscriber privileges or higher can craft malicious input to extract sensitive data from the site's database. The vulnerability only impacts sites that have explicitly enabled the optional 'User Private Content' addon, which is disabled by default, limiting the blast radius.

• CVE-2026-51946MEDIUM 6.5

  GoAdmin, a web administration framework, contains a SQL injection flaw in its table information endpoints. Attackers can manipulate the __sort_type URL parameter to inject SQL commands, potentially reading sensitive database records or modifying data. The vulnerability affects all versions up to and including v1.2.26 and requires no authentication to exploit.

• CVE-2026-52673MEDIUM 6.5

  Cboard versions 0.4.2 and earlier contain a SQL injection flaw in the getDimensionsValues component that allows authenticated attackers to extract sensitive data from the application database. The vulnerability requires login credentials but does not require user interaction once authenticated, making it a practical concern for organizations deploying Cboard with untrusted or compromised user accounts.

• CVE-2026-56221MEDIUM 6.5

  Cap-go versions prior to 12.128.2 allow authenticated users with basic read-level API permissions to perform SQL injection attacks. By manipulating specific API parameters—including deviceIds, search, version_name, cursor, and actions—attackers can inject malicious SQL code to bypass access controls and view analytics data belonging to other users or applications. This is a logic-based flaw in how user input is incorporated into database queries rather than a result of missing authentication.

• CVE-2026-7048MEDIUM 6.5

  The Photo Gallery by 10Web WordPress plugin contains a SQL injection vulnerability in its gallery ordering feature. An attacker with contributor-level WordPress access or higher can craft a malicious gallery shortcode that executes arbitrary SQL queries against the site database when the shortcode renders. This allows unauthorized extraction of sensitive data like user credentials, email addresses, and other database contents. The vulnerability affects all versions up to 1.8.40.

• CVE-2026-8653MEDIUM 6.5

  MasterStudy LMS Pro Plus, a WordPress plugin used for learning management, contains a SQL injection flaw in how it processes the 'columns' parameter. Attackers with instructor-level or higher access can exploit this to run unauthorized database queries and steal sensitive data. The vulnerability affects all versions up to 4.8.20 and requires authentication but no user interaction.

• CVE-2026-9829MEDIUM 6.5

  Photo Gallery by 10Web, a popular WordPress plugin for creating mobile-friendly image galleries, contains a SQL injection vulnerability in versions up to 1.8.41. An attacker with contributor-level WordPress access (a lower-privileged account type) can inject malicious SQL commands through a shortcode parameter called 'compact_album_order_by'. The attacker stores this payload via an unprotected AJAX function, and it executes when the gallery is viewed on the front end, allowing the attacker to extract sensitive database information. This is a stored vulnerability—once the malicious shortcode is saved, it affects all site visitors.

• CVE-2026-11945MEDIUM 6.4

  PostgreSQL Anonymizer, an extension for PostgreSQL that helps mask sensitive data, contains a privilege escalation vulnerability. An authenticated attacker with standard user privileges can craft a malicious JSON document and trick a database superuser into importing it using specific functions (import_database_rules() or import_roles_rules()). When the superuser processes the JSON, hidden malicious code executes with superuser-level privileges, giving the attacker complete database access. This requires both user authentication and superuser action, limiting the immediate risk but creating a serious supply-chain or trusted-user threat.

• CVE-2026-10170MEDIUM 6.3

  A SQL injection vulnerability exists in code-projects Visitor Management System version 1.0. An authenticated attacker can manipulate the 'phone' parameter in the /vms/php/phone_0.php file to inject malicious SQL commands. This allows the attacker to read, modify, or delete database contents without special privileges. The vulnerability requires valid login credentials to exploit and has a published proof-of-concept.

• CVE-2026-10176MEDIUM 6.3

  Aider-AI's Aider version 0.86.3 contains a SQL injection vulnerability in its code generation workflow that can be exploited by authenticated users to manipulate database queries. While the vulnerability requires login credentials to trigger, an attacker with access can extract, modify, or delete sensitive data. Public exploit information is available, increasing the near-term risk of active exploitation.

• CVE-2026-10193MEDIUM 6.3

  OFCMS versions up to 1.1.3 contain a SQL injection vulnerability in the ComnController component. An authenticated attacker can manipulate the 'system.user.query' parameter to inject malicious SQL commands, potentially accessing, modifying, or deleting database records. The vulnerability has been publicly disclosed and exploit code is available, making active exploitation a realistic threat.

• CVE-2026-10202MEDIUM 6.3

  A SQL injection vulnerability exists in OFCMS version 1.1.3 affecting the JSON Query Interface within the SystemDictController component. An authenticated attacker can send specially crafted queries to manipulate SQL commands executed by the application, potentially reading, modifying, or deleting database records. The vulnerability requires valid user credentials but can be exploited over the network without user interaction. Exploit code is publicly available, increasing the risk of active exploitation.

• CVE-2026-10203MEDIUM 6.3

  A SQL injection vulnerability exists in OFCMS 1.1.3 within the Query function of the SystemParamController component. The flaw allows authenticated attackers to inject malicious SQL commands through the JSON Query Interface, potentially compromising database integrity and confidentiality. Public exploit code is available, increasing active exploitation risk.

• CVE-2026-10204MEDIUM 6.3

  A SQL injection vulnerability has been discovered in OFCMS version 1.1.3, specifically in the JSON Query Interface of the user management controller. An authenticated attacker can submit specially crafted queries to execute arbitrary SQL commands against the application's database. This could allow them to read, modify, or delete sensitive data. The vulnerability is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, but exploit code has been publicly released, increasing the practical risk of attacks.

• CVE-2026-10209MEDIUM 6.3

  A SQL injection vulnerability exists in the Online Hospital Management System version 1.0, specifically in the appointment booking functionality. An authenticated attacker can manipulate the 'editid' parameter in the appointmentdetail.php file to inject malicious SQL commands. This allows an attacker with valid credentials to read, modify, or delete sensitive appointment and patient data without additional authorization. Since the exploit has been publicly disclosed, the risk of active exploitation is elevated.

• CVE-2026-10235MEDIUM 6.3

  CodeAstro Ingredients Stock Management System version 1.0 contains a SQL injection vulnerability in its stock manager component. An authenticated attacker can manipulate the txt_search_category parameter in the /Ingredients-Stock/stock_manager.php file to execute arbitrary SQL queries. This allows unauthorized data access, modification, or deletion within the application's database. The vulnerability requires valid login credentials but can be exploited over the network without user interaction.

• CVE-2026-10242MEDIUM 6.3

  itsourcecode Content Management System version 1.0 contains a SQL injection vulnerability in the /instructions.php file. An attacker with user-level access can manipulate the topic_id parameter to execute unauthorized database queries, potentially reading, modifying, or deleting sensitive data. The vulnerability is remotely exploitable and public exploit code is available.

• CVE-2026-10256MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Content Management System version 1.0 affecting the comment-saving functionality. An authenticated attacker can manipulate the Name parameter in /save_comment.php to execute arbitrary SQL queries, potentially reading, modifying, or deleting database contents. The vulnerability requires valid user credentials but does not require user interaction to exploit. Public exploit code is available, elevating the practical risk despite the MEDIUM CVSS score.

• CVE-2026-10257MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Content Management System version 1.0, specifically in the admin update functionality. An authenticated user can inject malicious SQL commands through the topic_id parameter when uploading images, potentially reading, modifying, or deleting database contents. Public exploit code is available, increasing near-term risk.

• CVE-2026-10258MEDIUM 6.3

  itsourcecode Content Management System version 1.0 contains a SQL injection vulnerability in its administrative interface. An authenticated attacker can manipulate the topic_id parameter in the /admin/add_sub_topic.php file to inject malicious SQL commands, potentially allowing unauthorized access to, modification of, or deletion of database records. The vulnerability requires valid login credentials but can be exploited over the network without additional user interaction.

• CVE-2026-10265MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Content Management System version 1.0 that allows authenticated users to manipulate the topic_id parameter in the /admin/edit_topic.php file to execute arbitrary SQL queries. An attacker with valid admin credentials can exploit this to read, modify, or delete database records. Public exploits are available, elevating operational risk.

• CVE-2026-10286MEDIUM 6.3

  CodeAstro Payroll System version 1.0 contains a SQL injection vulnerability in its employee home page functionality. An authenticated attacker can inject malicious SQL commands through the emp_id parameter, allowing them to read, modify, or delete database records. This vulnerability requires valid login credentials and is reachable over the network. Public exploit information is available, increasing the immediate risk of exploitation.

• CVE-2026-10296MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0 that allows authenticated users to manipulate the Username parameter in the /ajax.php endpoint to execute arbitrary SQL queries. An attacker with valid login credentials can exploit this flaw to read, modify, or delete database contents. The vulnerability requires authentication but is otherwise straightforward to exploit and has been publicly disclosed.

• CVE-2026-10297MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0 within the course management functionality. An authenticated attacker can manipulate the ID parameter in the /manage_course.php endpoint to execute arbitrary SQL queries against the underlying database. The vulnerability requires valid login credentials but can be exploited over the network without additional interaction. Exploit code is publicly available, elevating the practical risk.

• CVE-2026-10302MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0 within the /manage_fee.php file. An authenticated attacker can manipulate the ID parameter to inject malicious SQL commands, potentially allowing unauthorized access to, modification of, or deletion of database records. The vulnerability requires valid user credentials to exploit but can be triggered remotely over the network.

• CVE-2026-10568MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0. An authenticated attacker can manipulate the ID parameter in the /manage_payment.php file to execute arbitrary SQL queries against the backend database. This vulnerability requires valid login credentials to exploit, but can lead to unauthorized data access, modification, or deletion. Public exploit code is available, increasing the practical risk of exploitation.

• CVE-2026-10808MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0 that allows authenticated users to manipulate the ID parameter in the /manage_student.php file, potentially enabling unauthorized data access, modification, or deletion. The vulnerability requires valid login credentials but can be exploited remotely over the network. Public exploit code is available, elevating the risk of active attack.

• CVE-2026-10809MEDIUM 6.3

  CVE-2026-10809 is a SQL injection vulnerability in itsourcecode Fees Management System version 1.0. An authenticated attacker can manipulate the ID parameter in the /manage_user.php file to inject malicious SQL commands, potentially reading, modifying, or deleting database records. The flaw requires valid login credentials but can be exploited over the network without user interaction. Public exploit code is available, elevating the practical risk despite the medium CVSS score.

• CVE-2026-10811MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Fees Management System version 1.0. The flaw resides in the /receipt.php file, specifically in how the application processes the ef_id parameter. An authenticated attacker can manipulate this parameter to inject malicious SQL commands, potentially allowing them to read, modify, or delete database records. Public disclosure of this vulnerability means exploitation techniques are already available, elevating the practical risk.

• CVE-2026-10874MEDIUM 6.3

  A SQL injection vulnerability exists in projectworlds Online Art Gallery Shop Project version 1.0 affecting the admin dashboard. An authenticated attacker can manipulate the 'social_insta' parameter in the /admin/adminHome.php file to inject malicious SQL commands. This allows unauthorized access to sensitive database information, modification of data, or potential system disruption. The vulnerability requires valid login credentials but has no other technical barriers to exploitation.

• CVE-2026-10875MEDIUM 6.3

  A SQL injection vulnerability exists in projectworlds Online Art Gallery Shop Project version 1.0 that allows authenticated users to inject malicious SQL commands through the social_twitter parameter in the admin panel. An attacker with login credentials can exploit this flaw to read, modify, or delete database records. Public exploit code has been released, increasing the risk of active exploitation.

• CVE-2026-11412MEDIUM 6.3

  Jinher OA C6 contains a SQL injection vulnerability in a web component that processes form identifiers. An attacker with login credentials can manipulate the queryID parameter in GetFormSyn.aspx to execute arbitrary database queries, potentially reading, modifying, or deleting sensitive data. The vulnerability is network-accessible and exploit code has been publicly released, increasing the risk of active exploitation.

• CVE-2026-11453MEDIUM 6.3

  Tiobon Employee Self-Service System versions up to 7.2 contain a SQL injection flaw in the blog search functionality accessible through the login endpoint. An authenticated attacker can manipulate search keywords to inject malicious SQL commands, potentially reading, modifying, or deleting database contents. The vulnerability requires valid login credentials and has been publicly disclosed, though it is not currently tracked in the CISA Known Exploited Vulnerabilities catalog. The vendor has not acknowledged or addressed this issue despite early notification.

• CVE-2026-11473MEDIUM 6.3

  A SQL injection vulnerability exists in jflyfox jfinal_cms versions up to 5.1.0 that allows authenticated users to manipulate the orderBy parameter in the AdvicefeedbackController, potentially exposing or modifying database contents. The vulnerability requires valid login credentials but can be exploited over the network without user interaction once authenticated.

• CVE-2026-11475MEDIUM 6.3

  A SQL injection vulnerability has been discovered in Kushan2k's student-management-system affecting the Certificate Verification Endpoint. An attacker with login credentials can manipulate the 'nic' parameter in the getStatus function to inject malicious SQL commands, potentially reading, modifying, or deleting database records. The vulnerability is rated MEDIUM severity and exploits have been publicly disclosed, creating immediate risk for deployed instances.

• CVE-2026-11480MEDIUM 6.3

  A SQL injection vulnerability exists in BeikeShop, an e-commerce platform by Chengdu Everbrite Network Technology, affecting versions up to 1.6.0.22. An authenticated attacker can manipulate the 'settings.value' parameter in the Admin Design Builder endpoint to inject malicious SQL commands. The vulnerability requires login credentials but carries a network-based attack vector, allowing an attacker with admin or user-level access to read, modify, or delete database contents.

• CVE-2026-11495MEDIUM 6.3

  CodeAstro Ingredients Stock Management System version 1.0 contains a SQL injection vulnerability in its stock addition functionality. An authenticated attacker can manipulate the ID parameter in the /Ingredients-Stock/add_stock.php file to execute arbitrary SQL queries. This allows unauthorized reading, modification, or deletion of database records. The vulnerability requires valid credentials to exploit but carries moderate severity due to its potential for data theft and integrity compromise.

• CVE-2026-11506MEDIUM 6.3

  CodeAstro Leave Management System version 1.0 contains a SQL injection vulnerability in its staff deletion search functionality. An authenticated attacker can manipulate the Name parameter in the /admin/search_staff_for_deletion.php file to inject malicious SQL commands. This could allow unauthorized access to sensitive database information, modification of records, or disruption of the system. The vulnerability requires an authenticated login but poses a meaningful risk in environments where user accounts are shared or weak credential hygiene exists.

• CVE-2026-11507MEDIUM 6.3

  A SQL injection vulnerability exists in CodeAstro Leave Management System version 1.0 that allows authenticated users to manipulate the leave_type parameter in the admin delete function, potentially extracting or modifying database information. The flaw requires valid login credentials but no additional user interaction, and public exploit code is available.

• CVE-2026-11508MEDIUM 6.3

  CodeAstro Leave Management System version 1.0 contains a SQL injection vulnerability in its staff assignment search functionality. An authenticated attacker can manipulate the Name parameter in the /admin/search_staff_to_assign_pc.php file to inject malicious SQL commands. This allows remote exploitation without user interaction and poses a direct risk to database confidentiality, integrity, and availability. Public disclosure of this vulnerability means active exploitation is possible.

• CVE-2026-11509MEDIUM 6.3

  CodeAstro Leave Management System version 1.0 contains a SQL injection vulnerability in its staff search functionality. An authenticated user can manipulate the Name parameter in the /admin/search_staff_for_updation.php file to inject arbitrary SQL commands, potentially reading or modifying sensitive employee and leave data. The vulnerability requires valid login credentials but poses a meaningful risk to organizations using this system, as it could enable unauthorized data access or manipulation by internal actors.

• CVE-2026-11510MEDIUM 6.3

  CodeAstro Leave Management System version 1.0 contains a SQL injection vulnerability in its administrative interface. An authenticated attacker can manipulate the type_of_leave parameter when submitting leave requests through /admin/add_leave.php to inject malicious SQL commands. This allows unauthorized reading, modification, or deletion of database records. The vulnerability requires valid administrative credentials to exploit, but public exploit code is now available, increasing the practical risk.

• CVE-2026-11513MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 within the adminaccount.php file. An authenticated attacker can manipulate the Date parameter to inject arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability requires valid login credentials but can be exploited over the network. Public exploits are available.

• CVE-2026-11514MEDIUM 6.3

  itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in the patient admission form. An authenticated attacker can manipulate the admission time parameter in the /addpatient.php file to inject malicious SQL commands, potentially reading, modifying, or deleting database records. The vulnerability requires valid user credentials but can be exploited remotely with no additional user interaction.

• CVE-2026-11529MEDIUM 6.3

  A SQL injection vulnerability exists in the mysql-mcp-server component (versions up to 0.2.2) that allows authenticated users to execute arbitrary SQL commands by manipulating URI parameters. An attacker with valid credentials can read, modify, or delete database records. The vulnerability has been publicly disclosed, increasing immediate risk. Upgrading to version 0.3.0 eliminates the issue.

• CVE-2026-11558MEDIUM 6.3

  CodeAstro Payroll System version 1.0 contains a SQL injection vulnerability in the /home_salary.php file. An authenticated attacker can manipulate the rate or salary_rate parameter to inject malicious SQL commands, potentially allowing them to read, modify, or delete sensitive payroll data. The vulnerability requires a valid user login but can be exploited over the network without user interaction once authenticated.

• CVE-2026-11559MEDIUM 6.3

  A SQL injection vulnerability exists in CodeAstro Payroll System version 1.0 that allows authenticated users to manipulate database queries through the ID parameter in the /view_account.php file. An attacker with valid credentials can inject malicious SQL commands to access, modify, or delete sensitive payroll data. The vulnerability is network-accessible and does not require additional user interaction, though authentication is required. Public exploits are now available, increasing the risk of active exploitation.

• CVE-2026-11583MEDIUM 6.3

  CodeAstro Student Attendance Management System version 1.0 contains a SQL injection vulnerability in the class creation administrative function. An authenticated attacker can manipulate the className input parameter to inject malicious SQL commands, potentially reading, modifying, or deleting database records. The vulnerability requires valid login credentials but can be exploited over the network without additional user interaction.

• CVE-2026-11584MEDIUM 6.3

  A SQL injection vulnerability exists in CodeAstro Student Attendance Management System version 1.0 that allows authenticated users to manipulate a parameter in the class editing interface and execute arbitrary database commands. An attacker with login credentials can inject malicious SQL through the ID argument to read, modify, or delete sensitive student and attendance data. The vulnerability is network-accessible and exploit code has been publicly disclosed, increasing the practical attack surface.

• CVE-2026-11585MEDIUM 6.3

  CodeAstro Student Attendance Management System version 1.0 contains a SQL injection vulnerability in its class management functionality. An authenticated attacker can manipulate the classId parameter in the createClassArms.php file to inject malicious SQL commands, potentially allowing unauthorized access to or modification of the database. The vulnerability requires user authentication but can be exploited remotely without user interaction.

• CVE-2026-12131MEDIUM 6.3

  CodeAstro Human Resource Management System version 1.0 contains a SQL injection vulnerability in its Payroll Invoice Module. An authenticated attacker can manipulate the ID parameter in the invoice function to inject malicious SQL commands, potentially reading, modifying, or deleting database records. The vulnerability requires valid user credentials to exploit but has low complexity and is accessible over the network. Public exploit code now exists, elevating the practical risk.

• CVE-2026-12188MEDIUM 6.3

  Grit42 Grit versions up to 0.11.0 contain a SQL injection vulnerability in the GritEntityController component. An authenticated attacker can manipulate input to execute arbitrary SQL commands, potentially reading, modifying, or deleting sensitive data. The vulnerability requires valid login credentials but can be exploited over the network without user interaction. Public exploits are available.

• CVE-2026-12206MEDIUM 6.3

  Grit42's Grit framework versions up to 0.11.0 contain a SQL injection flaw in the DataTableEntity component. An authenticated attacker can exploit this remotely by manipulating input to the affected function, potentially allowing unauthorized access to, modification of, or deletion of database records. Public exploits exist for this vulnerability, elevating urgency for organizations using affected versions.

• CVE-2026-12776MEDIUM 6.3

  Montodel House-Rental-Management contains a SQL injection vulnerability in its house listing functionality that allows authenticated attackers to manipulate database queries by injecting malicious SQL code through the ID parameter. An attacker with valid login credentials can exploit this remotely to read, modify, or delete sensitive rental property and customer data. Public exploit code is available, increasing the likelihood of active exploitation.

• CVE-2026-13496MEDIUM 6.3

  CVE-2026-13496 is a SQL injection vulnerability in itsourcecode Hospital Management System version 1.0. An authenticated user can manipulate the medicineid parameter in the /ajaxmedicine.php file to inject malicious SQL commands, potentially allowing them to read, modify, or delete database records. The vulnerability requires login credentials but can be exploited remotely over the network. Public exploit code is available, increasing the practical risk.

• CVE-2026-13497MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 that allows authenticated users to manipulate database queries through the editid parameter in the appointment.php file. An attacker with valid credentials can exploit this flaw to read, modify, or delete sensitive hospital data, including patient records and appointment information. The vulnerability has been publicly disclosed, meaning exploitation guidance may be available to threat actors.

• CVE-2026-13520MEDIUM 6.3

  itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in its appointment approval handler. An authenticated user can manipulate the 'editid' parameter in the /appointmentapproval.php file to inject SQL commands, potentially reading, modifying, or deleting database records. The vulnerability requires valid login credentials but poses genuine risk to hospitals relying on this system for critical appointment data. Public exploit code is available, raising the urgency of remediation.

• CVE-2026-13525MEDIUM 6.3

  CodeAstro Human Resource Management System version 1.0 contains a SQL injection vulnerability in its leave update functionality. An authenticated user can manipulate the employee ID parameter to inject malicious SQL commands, potentially exposing, modifying, or deleting sensitive HR data. The vulnerability has been publicly disclosed and exploitation code is available.

• CVE-2026-13530MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0. An authenticated attacker can manipulate the 'editid' parameter in the /appointmentdetail.php file to inject malicious SQL commands. This vulnerability allows remote exploitation and could enable an attacker to read, modify, or delete sensitive appointment and patient data. Public exploits are available, increasing the risk of active exploitation.

• CVE-2026-13531MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 within the /department.php file. An authenticated attacker can manipulate the editid parameter to execute arbitrary SQL commands, potentially allowing unauthorized access to, modification of, or deletion of database records. Public exploit code is available, elevating the practical risk.

• CVE-2026-13532MEDIUM 6.3

  itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in the departmentDoctor.php file that allows authenticated users to execute arbitrary SQL queries by manipulating the deptid parameter. An attacker with valid login credentials can remotely exploit this flaw to read, modify, or delete database records. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-13535MEDIUM 6.3

  CodeAstro Human Resource Management System version 1.0 contains a SQL injection vulnerability in its employee management interface. An authenticated user can manipulate the ID parameter in the file viewing function to inject malicious SQL commands, potentially accessing, modifying, or deleting sensitive HR data. The vulnerability requires valid login credentials but can be exploited remotely without special tools or user interaction.

• CVE-2026-13541MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0, specifically in the doctor password change functionality. An authenticated user can manipulate the newpassword parameter in /doctorchangepassword.php to inject malicious SQL commands. This allows an attacker to read, modify, or delete database contents without requiring elevated privileges. The vulnerability is remotely exploitable and public exploit code has already been released, increasing the risk of active exploitation.

• CVE-2026-13542MEDIUM 6.3

  itsourcecode Hospital Management System version 1.0 contains a SQL injection vulnerability in its doctor profile functionality. An authenticated attacker can manipulate the doctorname parameter in /doctorprofile.php to execute arbitrary SQL commands, potentially reading, modifying, or deleting sensitive healthcare data. The vulnerability requires valid login credentials but can be exploited without user interaction once authenticated. Public disclosure means defensive preparation should be treated as urgent.

• CVE-2026-13548MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 that allows authenticated users to manipulate database queries through the editid parameter in the /doctortimings.php file. An attacker with valid login credentials can exploit this flaw to read, modify, or delete sensitive hospital data. The vulnerability is not yet tracked by CISA's Known Exploited Vulnerabilities catalog, but public exploit code is available, increasing the practical risk of opportunistic attacks.

• CVE-2026-13572MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 that allows authenticated users to execute arbitrary SQL commands by manipulating the patientid parameter in the /insertbillingrecord.php file. An attacker with valid login credentials can exploit this remotely to read, modify, or delete database records. Public disclosure means defensive measures should be prioritized immediately.

• CVE-2026-13578MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 that allows authenticated users to manipulate the editid parameter in the patientdetail.php file, potentially compromising patient data confidentiality and integrity. The vulnerability requires valid login credentials but can be exploited remotely over the network. Public exploit code is already available, increasing the practical risk to deployed instances.

• CVE-2026-13579MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0. An authenticated attacker can manipulate the password change function to execute arbitrary SQL queries. This allows an attacker with valid login credentials to read, modify, or delete patient data stored in the hospital's database. The vulnerability is in the /patientchangepassword.php file and requires no user interaction beyond the attacker sending a crafted request.

• CVE-2026-14619MEDIUM 6.3

  A SQL injection vulnerability has been discovered in itsourcecode Hospital Management System version 1.0. An authenticated attacker can manipulate the 'editid' parameter in the /medicine.php file to inject malicious SQL commands. This allows an attacker who has valid login credentials to read, modify, or delete data in the underlying database. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-14638MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 affecting the patient.php file. An authenticated attacker can manipulate the 'editid' parameter to execute arbitrary SQL queries, potentially reading, modifying, or deleting patient data. The vulnerability requires valid login credentials but no additional user interaction, making it exploitable by insiders or through credential compromise. Public exploit code has been released.

• CVE-2026-14639MEDIUM 6.3

  CodeAstro Ecommerce Website version 1.0 contains a SQL injection vulnerability in its customer account management functionality. An authenticated attacker can manipulate the 'c_name' parameter in the my_account.php?edit_account endpoint to inject malicious SQL commands, potentially compromising data confidentiality, integrity, and availability. Because the vulnerability requires prior authentication and has been publicly disclosed, it presents a moderate but actionable risk that organizations using this software should address promptly.

• CVE-2026-14657MEDIUM 6.3

  A SQL injection vulnerability has been discovered in code-projects Assessment Management version 1.0. An authenticated attacker can inject malicious SQL code through the squestions[] parameter in the marking-scheme.php file, allowing them to read, modify, or delete database records. The vulnerability requires valid login credentials but does not require user interaction, making it a concern for organizations deploying this assessment platform.

• CVE-2026-14658MEDIUM 6.3

  A SQL injection vulnerability exists in code-projects Assessment Management version 1.0 that allows authenticated users to manipulate the smarksrange[] parameter in the marking-scheme.php file to execute arbitrary SQL commands. An attacker with valid login credentials can exploit this remotely to read, modify, or delete database records without additional privileges. The vulnerability is already public and proof-of-concept code is available, raising the practical risk despite the medium CVSS score.

• CVE-2026-14659MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 affecting the patient appointment functionality. An authenticated attacker can inject malicious SQL commands through the 'patiente' parameter in the /patientappointment.php file to read, modify, or delete database records. The vulnerability requires a valid user login but can be exploited remotely, and proof-of-concept details are publicly available.

• CVE-2026-14689MEDIUM 6.3

  CodeAstro Apartment Visitor Management System version 1.0 contains a SQL injection vulnerability in its apartment addition function. An authenticated attacker can manipulate the apartment number parameter to inject malicious SQL commands, potentially reading, modifying, or deleting database records. Proof-of-concept code is publicly available, increasing the likelihood of active exploitation.

• CVE-2026-14692MEDIUM 6.3

  A SQL injection vulnerability exists in SourceCodester Multi-Vendor Online Grocery Management System versions 1.0 and 5.7.26. An authenticated attacker can inject malicious SQL commands through the POST parameters of the shop type save function, potentially reading, modifying, or deleting database contents. The vulnerability requires valid login credentials but no special privileges, and can be exploited over the network. Public exploit code is available.

• CVE-2026-14694MEDIUM 6.3

  A SQL injection vulnerability exists in SourceCodester's Multi-Vendor Online Grocery Management System version 1.0. An authenticated attacker can manipulate the ID parameter in the order cancellation function to inject malicious SQL commands. This allows an attacker with valid login credentials to read, modify, or delete database contents. The vulnerability was disclosed publicly, making attack techniques potentially available to a wider audience.

• CVE-2026-14701MEDIUM 6.3

  A SQL injection vulnerability exists in the Internship Management System version 1.0, specifically in the password change function. An authenticated user can manipulate the 'Current' parameter to inject malicious SQL commands, potentially accessing or modifying sensitive data in the database. The vulnerability requires login credentials but is otherwise straightforward to exploit, and proof-of-concept code is already publicly available.

• CVE-2026-14703MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 that allows authenticated users to manipulate the editid parameter in the /patientorder.php file to execute arbitrary SQL queries. The vulnerability requires valid login credentials to exploit but does not require user interaction once authenticated. Public disclosure of this vulnerability means exploitation techniques are already available to potential attackers.

• CVE-2026-14706MEDIUM 6.3

  A SQL injection vulnerability exists in code-projects Online Examination 1.0 affecting the quiz creation feature. An authenticated attacker can manipulate multiple input fields (name, total, right, wrong, time, tag, desc) in the /update.php?q=addquiz endpoint to inject malicious SQL commands. This allows unauthorized data access, modification, or deletion within the application's database. The vulnerability requires valid login credentials but can be exploited remotely with no user interaction.

• CVE-2026-14717MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 affecting the patient login function. An authenticated attacker can manipulate the loginid parameter in /patientlogin.php to execute arbitrary SQL commands, potentially reading, modifying, or deleting sensitive patient data. The vulnerability requires valid credentials but is easy to exploit and poses a direct risk to healthcare information confidentiality and integrity.

• CVE-2026-14730MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0, specifically in the /patientprofile.php file. An authenticated attacker can manipulate the patientname parameter to execute arbitrary SQL commands against the underlying database. This allows an attacker who has legitimate system access to read, modify, or delete patient records and potentially other sensitive data. Public exploit code is available, increasing the practical risk.

• CVE-2026-14731MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 within the /patientreport.php file. An authenticated attacker can manipulate the 'editid' parameter to inject malicious SQL commands, potentially allowing them to read, modify, or delete patient data. Public exploit code is available, increasing the practical risk of exploitation. The vulnerability requires valid login credentials but operates over the network without additional user interaction.

• CVE-2026-14751MEDIUM 6.3

  A SQL injection vulnerability has been discovered in mjperpinosa stumasy, a rolling-release software project. An attacker with valid login credentials can inject malicious SQL commands through the search functionality by manipulating the field_name parameter. This allows unauthorized reading and modification of database records, or potentially disrupting database availability. Because the project uses continuous delivery and has not yet responded to disclosure, affected versions are not precisely documented.

• CVE-2026-14766MEDIUM 6.3

  CodeAstro Apartment Visitor Management System version 1.0 contains a SQL injection vulnerability in its search functionality. An authenticated attacker can exploit a flaw in the /apartment-visitor/search-result.php endpoint by manipulating the searchdata POST parameter to inject arbitrary SQL commands. This allows an attacker with valid login credentials to read, modify, or delete database records without authorization. Public exploit code exists for this vulnerability, increasing the practical risk.

• CVE-2026-14767MEDIUM 6.3

  CodeAstro Ecommerce Website version 1.0 contains a SQL injection vulnerability in its customer confirmation page. An authenticated attacker can manipulate the invoice_no parameter to inject malicious SQL commands, potentially compromising database integrity and confidentiality. The vulnerability requires valid user credentials but no special interaction, and exploit code has already been released publicly.

• CVE-2026-14773MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 that allows authenticated users to inject malicious SQL commands through the patientid parameter in the /payment.php file. An attacker with valid login credentials can exploit this flaw to read, modify, or delete sensitive healthcare data. Public exploit code is available, increasing the risk of active exploitation.

• CVE-2026-14774MEDIUM 6.3

  A SQL injection vulnerability exists in itsourcecode Hospital Management System version 1.0 affecting the payment discharge workflow. An authenticated attacker can manipulate the patientid parameter in /paymentdischarge.php to execute unauthorized database queries, potentially reading, modifying, or deleting patient and financial records. The vulnerability requires valid login credentials but presents direct risk to patient data confidentiality and billing system integrity.

• CVE-2026-14795MEDIUM 6.3

  A SQL injection vulnerability exists in CodeAstro Apartment Visitor Management System version 1.0. An authenticated attacker can manipulate the 'remark' parameter in the /apartment-visitor/action-visitor.php file to inject malicious SQL commands. This allows unauthorized access to, modification of, or deletion of database records. The vulnerability requires valid login credentials to exploit, and proof-of-concept code has been publicly disclosed.

• CVE-2026-14796MEDIUM 6.3

  CodeAstro's Apartment Visitor Management System version 1.0 contains a SQL injection vulnerability in its report generation feature. An authenticated attacker can manipulate the 'fromdate' parameter in the /apartment-visitor/report.php file to inject malicious SQL commands, potentially compromising the confidentiality, integrity, and availability of the application database. The exploit code is publicly available, increasing the practical risk to organizations using this software.