CVE-2019-25303

TheJshen contentManagementSystem 1.04 - 'id' SQL Injection

TheJshen ContentManagementSystem 1.04 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'id' GET parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to extract or manipulate database information by crafting malicious query payloads.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Cusg Thejshen

Products

Content Management System Contentmanagementsystem

CVE-2019-25260

OXID eShop 6.3.4 - 'sorting' SQL Injection

OXID eShop versions 6.x prior to 6.3.4 contains a SQL injection vulnerability in the 'sorting' parameter that allows attackers to insert malicious database content. Attackers can exploit the vulnerability by manipulating the sorting parameter to inject PHP code into the database and execute arbitrary code through crafted URLs.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Oxid-esales Oxidforge

Products

Eshop Oxid Eshop

CVE-2018-25407

eNdonesia Portal 8.7 SQL Injection via mod.php

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across publisher, diskusi, galeri, content, and about modules to extract database information including usernames, database names, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Endonesia

Products

Endonesia

CVE-2018-25406

eNdonesia Portal 8.7 SQL Injection via mod.php

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across publisher, diskusi, galeri, content, and about modules to extract database credentials, usernames, and version information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Endonesia

Products

Endonesia

CVE-2018-25405

eNdonesia Portal 8.7 SQL Injection via mod.php

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters to extract sensitive database information including usernames, database names, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Endonesia

Products

Endonesia

CVE-2018-25207

Online Quiz Maker 1.0 SQL Injection via catid Parameter

Online Quiz Maker 1.0 contains SQL injection vulnerabilities in the catid and usern parameters that allow authenticated attackers to execute arbitrary SQL commands. Attackers can submit malicious POST requests to quiz-system.php or add-category.php with crafted SQL payloads in POST parameters to extract sensitive database information or bypass authentication.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ays-pro Hscripts

Products

Quiz Maker Online Quiz Maker

CVE-2018-25203

Online Store System CMS 1.0 SQL Injection via clientaccess

Online Store System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to index.php with the action=clientaccess parameter using boolean-based blind or time-based blind SQL injection payloads in the email field to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Online Store System Project Wecodex

Products

Online Store System Online Store System Cms

CVE-2016-20069

WordPress Booking Calendar Contact Form 1.0.23 SQL Injection

WordPress Booking Calendar Contact Form 1.0.23 contains an unauthenticated blind SQL injection vulnerability in the shortcode function that fails to sanitize the calendar parameter before using it in database queries. Attackers can inject SQL commands through the calendar shortcode parameter to execute arbitrary SQL queries and extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Codepeople Dwbooster Wordpress

Products

Booking Calendar Contact Form Booking Calendar Contact Form Wordpress

CVE-2016-20068

WordPress Booking Calendar Contact Form 1.0.23 SQL Injection

WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Codepeople Dwbooster Wordpress

Products

Booking Calendar Contact Form Booking Calendar Contact Form Wordpress

CVE-2016-20065

Product Catalog 8 1.2 Plugin WordPress SQL Injection

Product Catalog 8 1.2 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the selectedCategory parameter. Attackers can submit POST requests to the admin-ajax.php endpoint with the UpdateCategoryList action to extract sensitive database information from WordPress tables.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Evwill Implecode Wordpress

Products

Product Catalog 8 Product Catalog Simple Wordpress

CVE-2026-61461

Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Dify Langgenius

Products

Dify Dify

CVE-2026-41462

ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login

ProjeQtor versions 7.0 through 12.4.3 contain an unauthenticated SQL injection vulnerability in the login functionality where the login variable is directly concatenated into a SQL query without parameterization or sanitization. Attackers can inject arbitrary SQL expressions through the username field at the authentication endpoint to create privileged accounts, read sensitive data, and execute operating system commands if the database user has elevated permissions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Projeqtor

Products

Projeqtor

CVE-2026-41457

OwnTone Server < 29.1 SQL Injection via query and filter Parameters

OwnTone Server versions 28.4 through 29.0 contain a SQL injection vulnerability in DAAP query and filter handling that allows attackers to inject arbitrary SQL expressions by supplying malicious values through the query= and filter= parameters for integer-mapped DAAP fields. Attackers can exploit insufficient sanitization of these parameters to bypass filters and gain unauthorized access to media library data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Owntone

Products

Owntone-server Owntone Server

CVE-2026-40524

FrontAccounting < 2.4.20 SQL Injection via get_gl_transactions()

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() function where the filter_type parameter is concatenated directly into a SQL IN() clause without parameterization. Attackers with SA_GLANALYTIC permission can inject arbitrary SQL by supplying a closing parenthesis followed by malicious conditions to extract sensitive journal entry data through boolean-based blind SQL injection with reliable response size differentials.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Frontaccounting

Products

Frontaccounting

CVE-2026-40523

FrontAccounting < 2.4.20 SQL Injection via reporting/rep710.php

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Audit Trail report handler that allows authenticated attackers with SA_GLANALYTIC permission to execute arbitrary SQL queries by injecting malicious code into the PARAM_2 and PARAM_3 POST parameters. Attackers can exploit time-based blind SQL injection through SLEEP() functions that are amplified across JOIN result sets to cause denial of service by exhausting database connections, or extract arbitrary database content through UNION-based injection techniques.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Frontaccounting

Products

Frontaccounting

CVE-2026-40522

FrontAccounting < 2.4.20 SQL Injection via rep601.php

FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report handler that allows authenticated attackers to extract arbitrary database data by injecting UNION SELECT payloads into the PARAM_0 POST parameter. Attackers can supply malicious SQL syntax through the unparameterized WHERE clause to retrieve sensitive information including usernames, password hashes, and email addresses from the users table, rendered into PDF report output.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Frontaccounting

Products

Frontaccounting

CVE-2026-28516

openDCIM <= 23.04 SQL Injection in Config::UpdateParameter

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Opendcim

Products

Opendcim

CVE-2026-62390

Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Kylin

CVE-2026-23696

Windmill < 1.603.3 File Ownership Handling SQLi RCE

Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.

CVSS 4.0 · 9.4 Critical EPSS 13.6% KEV · Not listed

Vendors

Nextcloud Windmill Windmill-labs

Products

Flow Windmill Windmil

CVE-2026-60090

PraisonAI before 4.6.78 SQL/CQL Injection via vector dimension

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value (declared as int but not enforced at runtime) is interpolated directly into the vector column of the generated CREATE TABLE DDL. A caller able to influence collection-creation dimensions can pass a string such as '3); DROP TABLE tenant_secrets; --' to inject SQL/CQL tokens into the statement executed by the database driver.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Mervinpraison Praison

Products

Praisonai Praisonai