CVE-2026-112064

SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension Sgalinski Cookie Consent

CVE-2026-114251

itsourcecode Sales-and-Inventory-System cust_del.php sql injection

A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/cust_del.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Sales-and-inventory-system

CVE-2026-114039

projectworlds Advanced Library Management System report_search.php mysqli_query sql injection

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Projectworlds

Products

Advanced Library Management System

CVE-2026-113740

itsourcecode Online Cake Ordering System deletecustomer.php sql injection

A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Online Cake Ordering System

CVE-2026-113608

Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var

Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER_VAR%% placeholder can inject subqueries or UNION SELECT to read arbitrary database tables, including user password hashes.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Jleyva

Products

Moodle-block Configurablereports

CVE-2026-92998

Click n Chat 1.0.4 - 1.1.2 - Unauthenticated SQLi via 'sort_by'/'sort_order' Parameters

The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS 1.3% KEV · Not listed

Vendors

—

Products

—

CVE-2026-92997

Click n Chat < 1.1.3 - Unauthenticated SQLi via 'datacolumn' Parameter

The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-110651

Swift Performance Lite < 2.3.7.4 - Author+ SQLi via Image Optimizer

The Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which could allow users with the author role and above to perform SQL injection attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-55239

Tianji: SQL Injection via unsanitized timezone parameter in analytics queries

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery() function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql() by interpolating the timezone request value without parameter binding. The timezone value can reach affected analytics queries through request data or the timezone HTTP header, and workspaceProcedure permits any authenticated workspace member, including a read-only viewer, to reach those queries. An attacker can execute arbitrary SQL against the shared PostgreSQL database, which can disclose or modify credentials, API keys, and tenant data or make the service unavailable. This issue is fixed in version 1.31.29.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Msgbyte

Products

Tianji

CVE-2026-112252

Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wuxi Wubang Security Software

Products

Five-in-one Safety Production Management Information System Wubang Five-in-one Safety Production Management Information System

CVE-2026-113407

YS-infoware｜BA-Workflow - SQL Injection

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Ys-infoware

Products

Ba-workflow

CVE-2026-112238

SQL Injection in extension "File manager" (ameos_filemanager)

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Typo3

Products

Extension File Manager

CVE-2026-94131

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Acymailing Acymailing.com

Products

Acymailing Acymailing.com Acymailing Extension For Joomla

CVE-2026-97162

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Lomart Lomart.fr

Products

Up Up Plugin For Joomla

CVE-2026-84893

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to SQL injection in the PESI service. An authenticated attacker could exploit this vulnerability to access sensitive information in the internal database.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-86047

MariaDB: Insufficient quoting in mariadb-dump and SHOW commands

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Mariadb

Products

Mariadb Server

CVE-2026-113381

Osclass Item Model Item.php findUserItems sql injection

A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Osclass

Products

Osclass

CVE-2026-109894

WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-95808

Form Maker by 10Web <= 1.15.48 - Unauthenticated SQL Injection via 'inputs' Parameter

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce required to reach the vulnerable handler is emitted to every public page that renders a form, making it trivially obtainable by an unauthenticated attacker from page source.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

10web Wordpress-extensions

Products

Form Maker By 10web Form Maker By 10web

CVE-2026-89299

WP Verify API <= 1.0.0 - Unauthenticated SQLi via 'verify' Parameter

The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Verify Api