CVE-2026-5490

DriveLock SQL Injection Privilege Escalation Vulnerability

DriveLock SQL Injection Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of DriveLock. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 4568 by default. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. . Was ZDI-CAN-28726.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Drivelock

Products

Drivelock

CVE-2026-2395

SQLi in Xpoda Türkiye Informatics Technology's No Code Platform

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before 4.1.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Xpoda Turkiye Information Technology

Products

No Code Platform

CVE-2026-60137

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

CVSS 3.1 · 5.9 Medium EPSS 5.3% KEV · Listed

Vendors

Wordpress

Products

Wordpress

CVE-2026-63229

Pre-authentication blind SQL injection vulnerability

A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Three Learning

Products

Koollab Lms

CVE-2026-65890

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Balbooa Balbooa.com

Products

Gridbox Gridbox Extension For Joomla

CVE-2026-63230

Pre-authentication error-based SQL injection vulnerability

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Three Learning

Products

Koollab Lms

CVE-2026-63231

Post-authentication SQL injection vulnerability

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-face runs update endpoint to read the entire application database and obtain valid JWT tokens for account takeover.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Three Learning

Products

Koollab Lms

CVE-2026-63232

SQL injection and unsafe deserialisation vulnerability

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcement endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Three Learning

Products

Koollab Lms

CVE-2026-63233

SQL injection and unsafe deserialisation vulnerability

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall answer endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Three Learning

Products

Koollab Lms

CVE-2026-63234

SQL injection and unsafe deserialisation vulnerability

A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessment endpoint, control data passed to unserialize(), write a webshell to a publicly accessible location, and execute arbitrary code on the server.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Three Learning

Products

Koollab Lms

CVE-2026-14754

code-projects Hotel and Tourism Reservation add_room.php sql injection

A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. Affected is an unknown function of the file /admin/add_room.php. Executing a manipulation of the argument delete_image/edit/description/number/price/rooms/type can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Hotel And Tourism Reservation Hotel And Tourism Reservation System

CVE-2026-14755

code-projects Hotel and Tourism Reservation Reservations Management reservations.php sql injection

A vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/reservations.php of the component Reservations Management Page. The manipulation of the argument delete leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Hotel And Tourism Reservation Hotel And Tourism Reservation System

CVE-2026-14756

code-projects Hotel and Tourism Reservation Tour Management add_tour.php sql injection

A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of the file /admin/add_tour.php of the component Tour Management Page. The manipulation of the argument delete_image results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Hotel And Tourism Reservation Hotel And Tourism Reservation System

CVE-2026-12741

WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection

The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, and including, 1.80.280 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Epsiloncool Wordpress

Products

Wp Fast Total Search – The Power Of Indexed Search Wordpress

CVE-2026-6881

Authenticated SQL Injection Enables Unauthorized Access to Sensitive Information in Ellucian Advance Web and Legacy Advance

A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated attacker to extract sensitive information from databases via a crafted SQL query in the class credit field. This issue affects Advance Web: all versions; Legacy Advance: all versions. Ellucian CRM Advance is not impacted.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Ellucian

Products

Advance Web Legacy Advance

CVE-2026-15344

WP Photo Album Plus <= 9.2.04.002 - Authenticated (Administrator+) SQL Injection via 'table' Parameter

The WP Photo Album Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'table' parameter in all versions up to, and including, 9.2.04.002 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The export-table endpoint lacks a nonce check, meaning this vulnerability can also be triggered via CSRF by tricking an authenticated administrator into visiting a malicious page.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Opajaap Wordpress

Products

Wp Photo Album Plus Wordpress

CVE-2026-58521

SQLi in Cargo extension via year range filter

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Cargo Mediawiki Mediawiki-cargo Extension

CVE-2026-14363

Cargo Extension: SQLi in Special:Drilldown

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mediawiki Wikimedia

Products

Cargo Mediawiki Mediawiki-cargo Extension

CVE-2026-33385

Blind SQL Injection in Quick.CMS

A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user into multiple fields in administration panel allows for Blind SQL Injection attacks. The vendor states that this administration panel already allows for significant modification capabilities. The SQL injection vulnerability primarily enables bypassing front-end validation controls and potential database destruction. Given the trust model in which this application is designed to be administered, remediation of this issue was not deemed necessary by the vendor. This vulnerability has been found in version 6.8, but other versions might also be vulnerable.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Opensolution

Products

Quick.cms

CVE-2026-12895

SQL Injection in Frappe's ERPNext

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frappe

Products

Erpnext