CVE-2026-17336

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-121769

WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows SQL Injection.This issue affects WP w3all phpBB: from n/a through 3.1.9.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-49142

OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-69136

SuiteCRM: Authenticated SQL Injection In handleAttachments function

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the remove_attachment POST parameter array through HTML-oriented securexss() processing and directly interpolates its elements into an SQL UPDATE statement. An authenticated attacker can inject SQL to disclose database information or abuse the UPDATE context to soft-delete all records in the notes table in one request. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-69140

SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates get_latest_for_id directly into an SQL UPDATE statement. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Documents module access can disclose database data and mass-update linked_documents records, while stacked statements and arbitrary DROP or INSERT operations are not supported by this vector. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-69141

SuiteCRM: SQL injection via search param in modules/Cases/controller.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Cases module access can perform blind SQL injection and extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-69142

SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-69145

SuiteCRM: AOR Reports aor_fields.field SQL Injection

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-71548

SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database. Disclosed data can include users.user_hash, OAuth2 tokens, CRM records, report definitions, and configuration data; the connector does not permit stacked queries, so direct write-through-injection is not supported. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-97377

SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by values into SQL query construction without sufficient neutralization. A low-privileged portal API user can perform blind SQL injection to disclose database metadata and sensitive records, affect query behavior, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-61651

SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id value into a SQL query without parameterization. A low-privileged user can use blind SQL injection to enumerate the database schema and extract credentials, customer records, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-61653

SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the entity-encoded backup, allowing a literal quote to reach the query. An authenticated user with Campaigns access can perform time-based blind SQL injection against arbitrary database tables. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-63214

SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at /service/v4_1/rest.php and uses get_entry_list, get_entries_count, and query to carry attacker-controlled data or authorization state into the security-sensitive operation. An account with list permission on a module can bypass the user_hash filter, retrieve password hashes and other database data, and use recovered administrative credentials to compromise the application. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-63215

SuiteCRM: Time-Based Blind SQL Injection via REST API

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 get_entry_list method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security mechanisms. The advisory does not identify those controls more precisely, so their identities remain unspecified. Successful exploitation can extract sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-69135

SuiteCRM: Authenticated SQL Injection In Project Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. An authenticated attacker can alter query structure and disclose sensitive database information. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-69134

SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAW_REQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. The affected flow begins at $GLOBALS['RAW_REQUEST'] and uses set_relationship, SugarRelationship::addRow(), SugarRelationship::updateRow(), and contact_role to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can inject SQL through relationship fields to read or alter database data and may reach file-write consequences when the database account has elevated privileges. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-100359

SuiteCRM: Authenticated SQL Injection In action_get_end_date function

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-100365

SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AOR_Reports and uses aor_fields, ORDER BY, and field label to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user with AOR Reports access can perform time-based extraction of password hashes and arbitrary table data and can hold database connections with expensive expressions. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-61648

SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum() and concatenates the result into a SQL WHERE clause. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the database. A low-privileged user with AOR Reports access can read arbitrary tables through time-based or UNION-based SQL injection and can consume database connections with delay expressions. This issue is fixed in versions 7.15.2 and 8.10.2.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Suitecrm

Products

Suitecrm

CVE-2026-81815

Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB

SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g. _ic=Y) with a crafted value, causing SqlJdbcUtil.addValueSingle to inline the EntityFunction-wrapped value directly into the SQL text using ANSI-only single-quote doubling instead of binding it as a parameter, which is insufficient on MySQL/MariaDB because those dialects also honor backslash escapes, letting a backslash-terminated payload break out of the string literal and turn the WHERE clause into a tautology. The default Derby datasource and PostgreSQL are not affected because they do not interpret backslash as an escape character in this context. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation

Products

Ofbiz Apache Ofbiz