tag

Sql-Injection

wp2shell — WordPress Core Pre-Auth SQLi → Row Forgery → Admin Creation → RCE (CVE-2026-63030 + CVE-2026-60137) KEV EPSS 97%

CVE-2026-63030 (REST /batch/v1 route confusion, CVSS 7.5), CVE-2026-60137 (author__not_in SQL injection, CVSS 9.1); GHSA-ff9f-jf42-662q, GHSA-fpp7-x2x2-2mjf web Patched

CVE-2026-63030webCRITICAL 9.1Patched2026-07-19LiteLLM Proxy Pre-Authentication SQL Injection via Error-Handling Callback (CVE-2026-42208) KEV EPSS 89%

CVE-2026-42208 (GHSA-r75f-5x8p-qvmc) web Patched

CVE-2026-42208webCRITICAL 9.8Patched2026-07-11PPOM for WooCommerce <= 33.0.15 - Unauthenticated Time-Based Blind SQL Injection (CVE-2025-11391)

CVE-2025-11391 web Patched

CVE-2025-11391webCRITICAL 9.8Patched2026-07-06Django QuerySet/Q Object SQL Injection via `_connector` Kwarg (CVE-2025-64459) EPSS 19%

CVE-2025-64459 web Patched

CVE-2025-64459webCRITICAL 9.1Patched2026-07-06"Grocery" PHP Application `search_products_itname.php` `sitem_name` Boolean-Based SQL Injection (CVE-2025-65354)

CVE-2025-65354 web Unpatched

CVE-2025-65354webCRITICAL 9.8Unpatched2026-07-06ZoneMinder — Second-Order SQL Injection via Event Rename (CVE-2026-27470)

CVE-2026-27470 web Patched

CVE-2026-27470webHIGH 8.8Patched2026-07-05WP Photo Album Plus Unauthenticated SQL Injection — CVE-2026-6379

CVE-2026-6379 web Patched

CVE-2026-6379webCRITICAL 8.6Patched2026-07-05WordPress "Form Maker" Plugin Unauthenticated SQL Injection — CVE-2026-3359

CVE-2026-3359 web Unverified

CVE-2026-3359webCRITICALUnverified2026-07-05WeGIA Authenticated Error-Based SQL Injection Exploitation Helper (CVE-2026-23723)

CVE-2026-23723 / GHSA-xfmp-2hf9-gfjp web Patched

CVE-2026-23723 / GHSA-xfmp-2hf9-gfjpwebHIGHPatched2026-07-05SonicWall SMA 8200v Cross-Parameter Blind SQL Injection to Root (CVE-2026-4112)

CVE-2026-4112 (SonicWall Advisory SNWLID-2026-0003) network Unverified

CVE-2026-4112networkHIGH 7.2Unverified2026-07-05Ormar ORM SQL Injection via min()/max() Aggregate Methods (CVE-2026-26198)

CVE-2026-26198 (GHSA-xxh2-68g9-8jqr) web Patched

CVE-2026-26198webCRITICAL 9.8Patched2026-07-05OpenSTAManager Scadenzario Bulk Operations Error-Based SQL Injection — CVE-2026-24418

CVE-2026-24418 web Patched

CVE-2026-24418webHIGH 8.8Patched2026-07-05OpenSTAManager Prima Nota Error-Based SQL Injection — CVE-2026-24419

CVE-2026-24419 web Patched

CVE-2026-24419webHIGHPatched2026-07-05OpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417

CVE-2026-24417 web Patched

CVE-2026-24417webHIGHPatched2026-07-05OpenSTAManager Article Pricing Time-Based Blind SQL Injection — CVE-2026-24416

CVE-2026-24416 web Patched

CVE-2026-24416webHIGHPatched2026-07-05MikroORM Custom Type Raw SQL Injection (CVE-2026-34220)

CVE-2026-34220 web Patched

CVE-2026-34220webHIGHPatched2026-07-05JoomCCK Unauthenticated SQL Injection via `tags.save` (CVE-2026-49048)

CVE-2026-49048 (Advisory ID JOOMCCK-2026-001) web Unpatched

CVE-2026-49048webCRITICAL 8.7Unpatched2026-07-05JetSearch WordPress Plugin Unauthenticated SQL Injection (CVE-2026-49079)

CVE-2026-49079 web Unverified

CVE-2026-49079webHIGH 7.5Unverified2026-07-05ITFlow Time-Based Blind SQL Injection via agent/ajax.php expires Parameter (CVE-2026-54597)

CVE-2026-54597 web Unverified

CVE-2026-54597webHIGHUnverified2026-07-05ITFlow SQL Injection via recurring_invoice_frequency (CVE-2026-54596)

CVE-2026-54596 web Unverified

CVE-2026-54596webHIGHUnverified2026-07-05Ghost CMS Content API — Unauthenticated Blind SQL Injection (CVE-2026-26980) EPSS 70%

CVE-2026-26980 web Patched

CVE-2026-26980webCRITICALPatched2026-07-05EGroupware Nextmatch Filter Authenticated SQL Injection (CVE-2026-22243)

CVE-2026-22243 web Patched

CVE-2026-22243webCRITICALPatched2026-07-05Django GIS RasterField SQL Injection (CVE-2026-1207) EPSS 13%

CVE-2026-1207 web Patched

CVE-2026-1207webHIGHPatched2026-07-05Dagster Database I/O Manager SQL Injection via Dynamic Partition Keys (CVE-2026-41490)

CVE-2026-41490 (GHSA-mjw2-v2hm-wj34) web Patched

CVE-2026-41490webHIGHPatched2026-07-05CodeAstro Simple Attendance Management System 1.0 — SQL Injection Auth Bypass (CVE-2026-37749)

CVE-2026-37749 web Unverified

CVE-2026-37749webCRITICAL 9.8Unverified2026-07-05Centreon Multi-Vector RCE — Path Traversal, Command Injection & Blind SQLi (CVE-2026-2749)

CVE-2026-2749 (bundled with related CVE-2026-2750, CVE-2026-2751) web Patched

CVE-2026-2749webCRITICALPatched2026-07-05ARMember WordPress Plugin Insecure Password Reset via Plaintext Key + SQLi Chain (CVE-2026-5076)

CVE-2026-5076 (chained with CVE-2026-5073, CVE-2026-5074) web Patched

CVE-2026-5076webCRITICAL 9.8Patched2026-07-05Apache Superset Authenticated SQL Injection via sqlExpression/where Bypass — CVE-2026-23980

CVE-2026-23980 web Patched

CVE-2026-23980webMEDIUM 6.5Patched2026-07-05