Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,745

Export CSV
CVE-2026-117513

oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection

A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer_search.php of the component Admin Search Pages. Executing a manipulation of the argument customer_name/voucher_no/emp_name can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Php-travel-agency-system
CVE-2026-105779

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Campaign Classic
CVE-2026-105604

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Dj-extensions.com
Products
Dj-classifieds Extension For Joomla
CVE-2026-62849

ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Mqttsnet
Products
Thinglinks
CVE-2026-119301

Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

CVSS 4.0 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-sdk-pandas
CVE-2026-116821

YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames

YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Yeswiki
Products
Yeswiki
CVE-2026-116812

OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Openpanel
Products
Openpanel
CVE-2026-116808

OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Openpanel
Products
Openpanel
CVE-2017-20266

Joomla SP Movie Database 1.3 SQL Injection via searchword

Joomla SP Movie Database 1.3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the searchword parameter. Attackers can send GET requests to the searchresults view with crafted SQL payloads in the searchword parameter to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Joomshaper
Products
Sp Movie Database Standard Pro Movie Database
CVE-2021-1636

Microsoft SQL Elevation of Privilege Vulnerability

Microsoft SQL Elevation of Privilege Vulnerability

CVSS 3.1 · 8.8 High EPSS 6.5% KEV · Not listed
Vendors
Microsoft
Products
Sql Server
CVE-2026-2613

SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wso2
Products
Api Control Plane Api Manager Wso2 Api Control Plane and 4 more
CVE-2026-116101

itsourcecode Online Cake Ordering System deletetransac.php sql injection

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /deletetransac.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Itsourcecode
Products
Online Cake Ordering System
CVE-2026-120441

OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path restrictions and enumerate all media files with filesystem paths and metadata.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Owntone
Products
Owntone-server Owntone Server
CVE-2026-101325

Newsletters <= 4.18.1 - Authenticated (Subscriber+) SQL Injection via 'id' Parameter

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 4.18.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by simply subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Contrid Wordpress-extensions
Products
Newsletters Newsletters
CVE-2026-62048

WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Liquid Web / Stellarwp Wordpress-extensions
Products
Bookit Bookit
CVE-2026-116828

YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Yeswiki
Products
Yeswiki
CVE-2026-116807

OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Openpanel
Products
Openpanel
CVE-2026-110083

Adobe Experience Manager | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Adobe
Products
Adobe Experience Manager Experience Manager
CVE-2026-61620

HoneySQL unchecked entity names can lead to SQL injection results

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Seancorfield
Products
Honeysql
CVE-2026-89216

vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Vtables