CVE-2026-19053

ProSolution WP Client < 2.0.6 - Unauthenticated Blind SQLi via 'jobID' Parameter

The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Prosolution Wordpress

Products

Prosolution Wp Client Wordpress

CVE-2026-72731

Discourse: Strip SQL comments and use non-recursive parameter interpolation in Data Explorer

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explorer/data_explorer.rb and plugins/discourse-data-explorer/lib/discourse_data_explorer/workflows/sql_action/v1.rb. Recursive parameter interpolation allowed one parameter value to introduce another parameter, and parameter declarations in SQL comments could be used to inject a statement. Queries run in a read-only transaction, so data could not be modified, but any table could be read. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Discourse

Products

Discourse

CVE-2026-72899

Metabase SQL injection via public card or dashboard

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Metabase

Products

Metabase

CVE-2026-19347

itsourcecode Hospital Management System viewdoctor.php sql injection

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such manipulation of the argument delid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Hospital Management System

CVE-2026-19343

code-projects Task Management System AdminLogin.php sql injection

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Task Management System

CVE-2026-19354

lock-upme OPMS IN Clause message.go sql injection

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Lock-upme

Products

Opms

CVE-2026-19364

itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Hospital Management System

CVE-2026-71287

Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection

Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Cacti

Products

Cacti

CVE-2026-19355

MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mingsoft

Products

Mcms

CVE-2026-19344

code-projects Task Management System comment_count_user.php sql injection

A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/comment_count_user.php. The manipulation of the argument task_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Task Management System

CVE-2026-19211

SourceCodester Photo Share Website ajax.php signup sql injection

A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Photo Share Website

CVE-2026-19231

SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Simple Doctors Appointment System

CVE-2026-3843

SQL Injection in Nefteprodukttekhnika BUK TS-G Allows Remote Code Execution

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Bukts Linux Nefteprodukttekhnika Llc

Products

Buk Ts-g Gas Station Automation System Linux Kernel Buk Ts-g Gas Station Automation System

CVE-2026-71292

Subrion CMS Admin Grid SQL Injection via Unwhitelisted ORDER BY sort Parameter

Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Intelliants

Products

Subrion

CVE-2026-71288

Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Koha-community

Products

Koha

CVE-2026-71282

ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Chirpstack

Products

Chirpstack

CVE-2026-71276

Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter

Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Absmach

Products

Magistrala

CVE-2026-71248

Inventory-Management-System-PHP - Unauthenticated SQL Injection in Login and Product Deletion

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Harsh21patel

Products

Inventory-management-system-php

CVE-2026-71237

Miantang IoT-PHP - Unauthenticated SQL Injection in /userlogin

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Miantang

Products

Iot-php

CVE-2026-71231

IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Thebradleysanders

Products

Iotsmarthome