CVE-2026-63232

CVE-2026-63232 relates to a vulnerability in Koollab LMS described as a SQL injection and unsafe deserialization issue. The authenticated attacker can target the assessment reinforcement endpoint, influence data passed to unserialize(), write a webshell to a publicly accessible location, and pote...

EUVD-2026-50109

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-11391

Tanium addressed a SQL injection vulnerability in Patch...

EUVD-2026-50019

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all...

CVE-2026-11391

CVE-2026-11391 involves a SQL injection vulnerability in Tanium’s Patch module. The connected documents confirm Tanium addressed the vulnerability, with a CVSS v3.1 base score of 6.3 (Network attack vector, Low privileges required, No user interaction; confidentiality, integrity, and availability...

CVE-2026-7769

CVE-2026-7769 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.0.0–6.2.0.5_2, 6.2.1.0–6.2.1.1_2, 6.2.2.0–6.2.2.0_1). Root cause: SQL injection in the backend database interface. Impact: remote attacker could view, add, modify, or delete data in the back-end DB. CVSS...

CVE-2026-51303

A flaw was found in SQLite. A remote attacker can exploit a use-after-free vulnerability in the core parsing component by sending specially crafted SQL queries. This can lead to an application crash, sensitive information disclosure, and potentially allow the attacker to execute arbitrary code on...

CVE-2026-16462

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands...

EUVD-2026-49733

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands...

CVE-2025-50455

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

CVE-2026-59549

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2026-65877

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...

EUVD-2026-49240

Administrator SQL Injection in WP Google Review Slider = 18.4 versions...

CVE-2026-59537

The CVE concerns the WordPress plugin Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce (

EUVD-2026-49203

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

EUVD-2026-49200

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector...

BIT-WORDPRESS-MULTISITE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

PT-2026-64985

A use-after-free UAF vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprList object via sqlite3ExprListDelete and then subsequently accesses the dangling pointer of the released object. A remote adversary can supply speciall...

Exploit for SQL Injection in Wordpress

CVE-2026-63030 & CVE-2026-60137 — wp2shell WordPress Cor...

CVE-2026-15663

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...