Export limit exceeded: 21737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21,737

Export CSV
CVE-2026-126381

n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key

n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Store (OracleDB) node, which does not validate Metadata Filter keys used in vector search queries. Attackers can supply crafted filter keys through untrusted workflow input such as webhooks to read data accessible to the configured Oracle credential.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-126425

OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126430

OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names

OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126431

OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper

OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-122227

Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute

The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The sanitize_text_field() function is applied to the attribute value but does not escape single quotes, providing no mitigation against breaking out of the SQL IN('...') literal.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-116509

Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter

The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injected payload survives storage and a published-status check in display_shortcode() because a non-numeric ID causes the isPublished lookup to return an empty string, after which the payload is imploded directly into a WHERE question_id IN() clause via plain string interpolation with no wpdb->prepare() or esc_sql() call.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-116614

WPMR Google Feed Manager for WooCommerce <= 2.24.1 - Authenticated (Editor+) SQL Injection via 'sourceId' Parameter

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to generic SQL Injection via the 'sourceId' parameter in all versions up to, and including, 2.24.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The plugin grants the edit_feeds capability to the Editor role on activation, meaning any Editor-level user satisfies the authorization checks and can exploit this vulnerability.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-122063

Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta

The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the admin-controlled 'currentusersubscribed' option to be enabled and at least one page rendering the Newsletters subscribe shortcode or widget to exist; a Subscriber-level attacker can self-serve the attack by updating their own profile email to a crafted payload and loading such a page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126460

OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing

OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126463

OpenEMR before 8.5.0 SQL Injection via billing parser, reports, Zend modules

OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and patient PHI, and overwrite patient_data fields.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126465

OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126478

OpenEMR before 8.5.0 SQL Injection via form_icd_codes in Syndromic Surveillance

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126480

OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names

OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126482

OpenEMR before 8.5.0 SQL Injection via CLP01 element of X12 835 ERA upload

OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126483

OpenEMR before 8.5.0 SQL Injection via form_facility in ippf_statistics.php

OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause and use boolean or time-based payloads to read sensitive database contents.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126488

OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126489

OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature

OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious field_id via edit_layout.php, then trigger issue_ippf_con_save through add_edit_issue.php to execute arbitrary SQL.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126491

OpenEMR before 8.5.0 SQL Injection via getByPatientDemographics in patient.inc.php

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options field_id values are concatenated into the patient search WHERE clause. Attackers with Layout Editor access can plant a malicious field_id, allowing any authenticated low-privilege user to exfiltrate data from patient_data and users_secure tables.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126492

OpenEMR before 8.5.0 Second-Order SQL Injection via dynamic_finder.php

OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126617

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in hMailServer

SQL injection in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.2.18, when the server uses MySQL/MariaDB or PostgreSQL, allows a remote attacker to alter SQL statements the server runs. On those two engines parameters are not bound: SQLStatement::GenerateFromCommand wrote each value into the statement's text as a quoted literal with a separate string replacement over the whole text per parameter, so a value holding the name of a parameter substituted after it had that name replaced, inside the value, by the later value with its own quotes, which ended the literal early and placed the later value in the statement as SQL. The row the server writes for each recipient of a queued message carries the recipient's address twice, so in the default configuration an authenticated user who may send mail reaches it by sending to an address of their choosing. A remote unauthenticated sender reaches the same statement through a message the server sends to the envelope sender, such as a delivery failure notice or an automatic reply, and, when greylisting or message indexing is enabled (both are off by default), through the greylisting record's envelope addresses or through the message metadata the server stores for IMAP SORT, which carries four header fields of a received message. An altered statement runs with the privileges of the server's database account; on PostgreSQL, whose client call runs every statement in the text it is given, further statements can follow it, while on MySQL/MariaDB, where one statement is run per call, the change is confined to the statement it is in. SQL Server and SQL Server Compact, where parameters are bound, are not affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Progressive Robot
Products
Hmailserver