CVE-2025-13294

Unauthenticated SQL Injection

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tbea

Products

Tbea Tlogger

CVE-2026-66659

WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Essekia Wordpress

Products

Tablesome Table Wordpress

CVE-2026-72898

Metabase SQL injection via password reset endpoint

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

CVSS 4.0 · 10 Critical EPSS 98.2% KEV · Listed

Vendors

Metabase

Products

Metabase

CVE-2026-65876

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6.8.0 - Improper validation of catid parameters in the loadMoreArticles endpoint leads to an SQL injection vector.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Joomshaper.net

Products

Sp Page Builder Extension For Joomla

CVE-2025-41771

SQL injection

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phoenix Contact

Products

Axc F 1152 Firmware Axc F 1252 Firmware Axc F 2000 Ea Firmware and 14 more

CVE-2026-73211

PeerTube: Unauthenticated remote SQL injection in ActorFollowModel.updateScore()

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Chocobozzz

Products

Peertube

CVE-2026-51077

SQL Injection via sqlquery Parameter in Dede CMS 5.7.118 Allows Sensitive Data Access

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dedecms

Products

Dedecms

CVE-2026-14238

Vitepos < 3.6.0 - Admin+ SQL Injection via product-details-report

The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Vitepos Wordpress

Products

Vitepos Wordpress

CVE-2026-16589

WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdirectorykit

Products

Wordpress Wp Directory Kit

CVE-2026-72610

Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field. The value is concatenated raw into a subquery in Koha::AdditionalContents->search_for_display when an issue slip is printed for the affected patron. The 25-character column length limits exploitation to timing attacks; data extraction is not practical. The stored payload executes on each subsequent issue-slip print, scaling linearly with the SLEEP value and the number of slip-news rows.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-72609

Koha Community Koha - SQL Injection via ORDER BY Direction in acqui/parcels.pl

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which allow-lists the column name but concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) in production and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-72550

Friendica Friendica - SQL Injection

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query() call, enabling stacked statement injection. An unauthenticated attacker can read, modify, or delete the entire database.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Friendica

Products

Friendica

CVE-2026-72558

CiviCRM CiviCRM - SQL Injection

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Civicrm

Products

Civicrm

CVE-2026-72599

e107 e107 - SQL Injection

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

E107

Products

E107

CVE-2026-72607

Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The agefield value is stored verbatim to the system preference and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus (line 1228) when the scheduled cron job executes. The injection is SELECT-only under standard MariaDB/MySQL DBI single-statement execution; a time-based SLEEP payload is also achievable via the cron trigger. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-72608

Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name value is stored verbatim in the layout XML and later concatenated raw into a SQL query in patroncards/create-pdf.pl when a patron card batch is printed. An attacker can read the entire Koha database including patron PII and staff bcrypt password hashes via error-based or time-based blind injection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-66770

SQL Injection vulnerability in SAP Social Intelligence

Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to the database structure, resulting in a low impact to the confidentiality, integrity, and availability of the system.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Social Intelligence

CVE-2026-72565

Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Tencent

Products

Apijson

CVE-2026-63106

ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents, including user credentials and administrator password hashes, with potential additional file system access due to the database connection running as root.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Razinsoft

Products

Ready Ecommerce

CVE-2026-18473

WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpdirectorykit

Products

Wordpress Wp Directory Kit