CVE-2026-51077

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...

WordPress SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin <= 3.9.7 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin SMS Alert Order Notifications versions = 3.9.7...

PT-2026-64912

Joomla Extension - joomshaper.com - Authenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of various parameters in the media manager search and date filters lead to an SQL injection vector...

EUVD-2026-49356

A use-after-free UAF vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprList object via sqlite3ExprListDelete and then subsequently accesses the dangling pointer of the released object. A remote adversary can supply speciall...

PT-2026-64932

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce = 2.10.22 versions...

PT-2026-64937

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...

CVE-2025-50455

Alex Tselegidis EasyAppointments versions 1.5.1 and below are vulnerable to a SQL injection via the order_by parameter in the /customers/search endpoint. The flaw occurs because unsanitized user input is passed to the CodeIgniter Query Builder order_by() method. Specifically, parenthesized subque...

PT-2026-65057

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author not in parameter of WP Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

Security Advisory 0145

Security Advisory 0145 . CSAF PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release 1.1 | August 10, 2026 | Added CSAF JSON file for download Description: SQL injection in a flow metrics API method enabling server-side request forgery CVE: CVE-2026...

CVE-2025-50455

SQL injection vulnerability exists in the orderby parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments = 1.5.1. The vulnerability arises from unsanitized user input passed to the orderby method of the CodeIgniter Query Builder, enabling attackers to perform time-based...

CVE-2026-51077

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...

PT-2026-64910

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder 6.7.1 - Improper validation of order parameters in the Dynamic Content endpoint leads to an SQL injection vector...

CVE-2026-51304

sqlite 3.41 has a use-after-free UAF vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete, then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid...

CVE-2026-51077

Dede CMS version 5.7.118 contains a SQL injection vulnerability within the sys_sql_query.php component. A remote attacker can exploit this flaw by sending crafted data to the sqlquery parameter to obtain sensitive information from the database. At this time, there is no information regarding a ne...

Xerox AltaLink Improper Neutralization of Special Elements used in an SQL Command (CVE-2021-28668)

Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL injection vulnerabilities. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot...

Exploit for SQL Injection in Wordpress

CVE-2026-60137-With-Skip-...

PT-2026-64983

Name of the Vulnerable Software and Affected Versions SQLite version 3.41 Description An issue exists in the expression parsing and memory management logic. After the sqlite3ExprDelete function is called to release an expression object, the program retains a dangling pointer and accesses member...

Exploit for SQL Injection in Trispark Novusedu

CVE-2021-3262 SQL Injection in TripSpark VEO Transportation...

Exploit for SQL Injection in Fortra Delivernow

CVE-2021-26837 SQL Injection in HelpSystems / Fortra Delive...

SQL Injection

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to SQL Injection in the json field enrichment process. An attacker can access unauthorized data, execute arbitrary JavaScript on the database server, perform cross-collection queries, or modify and...