CVE-2022-2807

SQL Injection in Prens Student Information System

SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection. This issue affects Prens Student Information System: before 2.1.11.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Algan

Products

Prens Student Information System

CVE-2022-3760

SQLi in Mia-Med

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mia Technology Mia-Med. This issue affects Mia-Med: before 1.0.0.58.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miateknoloji

Products

Mia-med

CVE-2022-3792

SQL Injection in GullsEye Terminal Operating System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GullsEye GullsEye terminal operating system allows SQL Injection. This issue affects GullsEye terminal operating system: from unspecified before 5.0.13.

CVSS 3.1 · 9.8 Critical EPSS 14.2% KEV · Not listed

Vendors

Gullseye

Products

Gullseye Terminal Operating System

CVE-2022-4422

SQLi in Bulutdesk Callcenter

Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Bulutses

Products

Bulutdesk Callcenter

CVE-2026-8724

Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection

A security flaw has been discovered in Dataease 2.10.20. Impacted is the function SqlparserUtils.transFilter of the file SqlparserUtils.java of the component Data Dashboard. The manipulation results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Dataease

Products

Dataease

CVE-2026-8912

Contest Gallery <= 28.1.6 - Unauthenticated SQL Injection

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to, and including, 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'post_cg_gallery_form_upload' AJAX action (specifically the 'cb' branch of the included users-upload-check.php, where $f_input_id is concatenated unquoted into 'SELECT Field_Content FROM ... WHERE id = $f_input_id'). The endpoint is gated only by a public frontend nonce ('cg1l_action' / 'cg_nonce') that is exposed in the page source of any public gallery page. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Contest-gallery Wordpress

Products

Contest Gallery – Upload & Vote Photos, Media, Sell With Paypal & Stripe Wordpress

CVE-2026-8851

SOGo < 5.12.8 SQL Injection via addUserInAcls endpoint

SOGo versions 5.12.7 and prior contains a SQL injection vulnerability in the Access Control List management functionality that allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint. Attackers can inject malicious SQL code to write extracted data into the sogo_acl table and retrieve it through the /acls API, establishing an out-of-band data exfiltration channel.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Alinto

Products

Sogo Web Mail

CVE-2018-25330

Joomla! EkRishta 2.10 Persistent XSS and SQL Injection

Joomla! extension EkRishta 2.10 contains persistent cross-site scripting and SQL injection vulnerabilities that allow attackers to inject malicious code through profile fields and POST parameters. Attackers can inject script payloads in profile information fields like Address that execute when users visit the profile, or submit SQL injection payloads via the phone_no parameter to the user_setting endpoint to manipulate database queries.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Joomlaextensions

Products

Joomla! Extension Ekrishta

CVE-2020-37243

WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS

Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and 'Edit HTML' fields that execute malicious scripts when viewing pricing tables.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Supsystic Wordpress Wpdarko

Products

Price Table Wordpress Responsive Pricing Table

CVE-2021-47954

LayerBB 1.1.4 SQL Injection via search_query Parameter

LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the search_query parameter. Attackers can send POST requests to /search.php with malicious search_query values using CASE WHEN statements to extract sensitive database information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Layerbb

Products

Layerbb

CVE-2018-25338

Zechat 1.5 SQL Injection via hashtag parameter

Zechat 1.5 contains a SQL injection vulnerability in the hashtag parameter that allows unauthenticated attackers to extract database information using union-based techniques. Attackers can exploit the hashtag parameter with union-based payloads to retrieve table and column names.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Bylancer Zechat Project

Products

Zechat Zechat

CVE-2018-25333

Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection

Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloads in the login field to extract sensitive database information and bypass authentication mechanisms.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Nordex-online

Products

N149 Wind Turbine Web Server

CVE-2018-25339

Zechat 1.5 SQL Injection via v parameter (time-based blind)

Zechat 1.5 contains a SQL injection vulnerability in the v parameter that allows unauthenticated attackers to extract database information using time-based blind techniques. Attackers can exploit the v parameter with sleep-based blind injection to confirm vulnerability and extract data.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Bylancer Zechat Project

Products

Zechat Zechat

CVE-2026-8772

linlinjava litemall Admin Endpoint sql injection

A weakness has been identified in linlinjava litemall up to 1.8.0. Affected is an unknown function of the component Admin Endpoint. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Linlinjava

Products

Litemall

CVE-2026-8785

projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection

A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDetail of the file update_info.php of the component GET Parameter Handler. Executing a manipulation of the argument appointment_no can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Projectworlds

Products

Hospital-management-system-in-php Hospital Management System In Php

CVE-2026-6637

PostgreSQL refint allows stack buffer overflow and SQL injection

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2026-6476

PostgreSQL pg_createsubscriber allows SQL injection via subscription name

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Postgresql

Products

Postgresql

CVE-2022-45090

SQL Injection in Smartpower Web

Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gruparge

Products

Smartpower Web

CVE-2022-45089

SQL Injection in Smartpower Web

Improper Input Validation vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Gruparge

Products

Smartpower Web

CVE-2022-4557

SQL Injection in Smartpower Web

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allows SQL Injection. This issue affects Smartpower Web: before 23.01.01.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Gruparge

Products

Smartpower