Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,732

Export CSV
CVE-2026-126285

NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter

NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run arbitrary read queries via the legacy where parameter on PostgreSQL. Attackers, including Viewer-role users, can inject single quotes into filter values concatenated by CustomKnex.ts to read other tables, schemas, view-filtered rows, and hidden columns.

CVSS 4.0 · 8.3 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126291

NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query

NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email with a quoted local part containing a single quote to execute arbitrary SQL, exposing user records, API tokens and data-source credentials.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Nocodb
Products
Nocodb
CVE-2026-126371

Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys

Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126374

Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys

Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product_<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126381

n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key

n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted workflow input such as webhooks to read data accessible to the configured Oracle credential.

CVSS 4.0 · 4.9 Medium EPSS n/a KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-126425

OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.

CVSS 4.0 · 4.6 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126430

OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names

OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126431

OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper

OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records.

CVSS 4.0 · 7.6 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-122227

Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute

The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field() function is applied to the attribute value but does not escape single quotes, providing no mitigation against breaking out of the SQL IN('...') literal.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-116509

Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-116614

WPMR Google Feed Manager for WooCommerce <= 2.24.1 - Authenticated (Editor+) SQL Injection via 'sourceId' Parameter

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to generic SQL Injection via the 'sourceId' parameter in all versions up to, and including, 2.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The plugin grants the edit_feeds capability to the Editor role on activation, meaning any Editor-level user satisfies the authorization checks and can exploit this vulnerability.

CVSS 3.1 · 4.9 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-122063

Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta

The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the admin-controlled 'currentusersubscribed' option to be enabled and at least one page rendering the Newsletters subscribe shortcode or widget to exist; a Subscriber-level attacker can self-serve the attack by updating their own profile email to a crafted payload and loading such a page.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126460

OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing

OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126463

OpenEMR before 8.5.0 SQL Injection via billing parser, reports, Zend modules

OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and patient PHI, and overwrite patient_data fields.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126465

OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126478

OpenEMR before 8.5.0 SQL Injection via form_icd_codes in Syndromic Surveillance

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information.

CVSS 4.0 · 7.2 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126480

OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names

OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126482

OpenEMR before 8.5.0 SQL Injection via CLP01 element of X12 835 ERA upload

OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126483

OpenEMR before 8.5.0 SQL Injection via form_facility in ippf_statistics.php

OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause and use boolean or time-based payloads to read sensitive database contents.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126488

OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes.

CVSS 4.0 · 8.3 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr