目標達成 すべての支援者に感謝 — 100%達成しました！

目標: 1000 CNY · 調達済み: 1359 CNY

100%
コーヒーを一杯おごる

type:sqli 标签下的 CVE 漏洞 23164

type:sqli 类型相关 23164 条 CVE 漏洞，含 AI 中文分析、CVSS、参考链接与 POC。

type:sqli 标签标识 SQL 注入漏洞，指攻击者通过构造恶意输入干扰后端数据库查询逻辑，从而窃取、篡改或销毁数据。该漏洞至关重要，因常导致敏感信息泄露及系统权限沦陷。典型场景包括未过滤的用户输入直接拼接至 SQL 语句，常见于登录表单、搜索框或 URL 参数中，是 Web 应用安全的核心威胁之一。

CVE ID タイトル CVSS 深刻度 公開日
CVE-2026-121792 GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity Forms Name/List Field' Parameter — GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI CWE-89 6.5 Medium 2026-11-07
CVE-2026-120530 WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography — WebToffee WP Backup and Migration CWE-89 5.7 Medium 2026-11-07
CVE-2026-121536 WP Data Access <= 5.5.90 - Authenticated (Subscriber+) SQL Injection via 'engine' Parameter — WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps CWE-89 5.3 Medium 2026-11-07
CVE-2026-121858 Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search — Event Tickets with Ticket Scanner - - 2026-11-07
CVE-2026-17411 Multiple Vulnerabilities in IBM API Connect — API Connect CWE-89 7.6 High 2026-11-07
CVE-2026-17407 Multiple Vulnerabilities in IBM API Connect — API Connect CWE-89 8.5 High 2026-11-07
CVE-2026-17400 Multiple Vulnerabilities in IBM API Connect — API Connect CWE-89 7.7 High 2026-11-07
CVE-2026-17396 Multiple Vulnerabilities in IBM API Connect — API Connect CWE-89 9.6 Critical 2026-11-07
CVE-2026-17363 Multiple Vulnerabilities in IBM API Connect — API Connect CWE-89 7.7 High 2026-11-07
CVE-2026-17336 Multiple Vulnerabilities in IBM API Connect — API Connect CWE-89 9.9 Critical 2026-11-07
CVE-2026-17134 Multiple Vulnerabilities in IBM API Connect — API Connect CWE-89 9.9 Critical 2026-11-07
CVE-2026-17132 Multiple Vulnerabilities in IBM API Connect — API Connect CWE-89 9.9 Critical 2026-11-07
CVE-2026-120043 Affiliate Program Suite <= 1.2.14 - Unauthenticated SQL Injection via 'email' Parameter — Affiliate Program Suite — SliceWP Affiliates CWE-89 7.5 High 2026-11-07
CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution — chartbrew CWE-89 9.8 Critical 2026-11-06
CVE-2026-123859 SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) — Snowflake Connector for Python CWE-89 8.1 High 2026-11-06
CVE-2026-121881 Posit Workbench code-server session-state RPC (get_last_seen) SQL injection — Posit Workbench CWE-89 5.7 Medium 2026-11-06
CVE-2026-123491 Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load Select — cms CWE-89 8.2 High 2026-11-06
CVE-2026-123489 Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria — cms CWE-89 7.1 High 2026-11-06
CVE-2026-123488 Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint — cms CWE-89 9.8 Critical 2026-11-06
CVE-2026-112341 Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params — wazuh CWE-89 6.5 Medium 2026-11-06
CVE-2026-109977 YaySMTP <= 2.7.8 - Authenticated (Administrator+) SQL Injection via 'params[searchKey]' Parameter — YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports CWE-89 4.9 Medium 2026-11-06
CVE-2026-123087 SQL injection in Atmira’s SIREC — SIREC CWE-89 8.7 High 2026-11-06
CVE-2026-113615 GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi — GS JWT Authentication for WP REST API - - 2026-11-06
CVE-2026-110532 Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter — Mail Mage - - 2026-11-06
CVE-2025-71458 FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo — fts-monitoring CWE-89 7.5 High 2026-11-06
CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection — PowerSYSTEM Center 2024 CWE-89 9.0 Critical 2026-11-06
CVE-2026-88985 Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server — pipelines CWE-89 6.5 Medium 2026-11-05
CVE-2026-111492 SQL injection in the push notification handler of the MatchPoint Android app — Matchpoint CWE-89 8.6 High 2026-11-05
CVE-2026-33944 Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter — dolibarr CWE-89 8.8 High 2026-11-05
CVE-2026-100359 SuiteCRM: Authenticated SQL Injection In action_get_end_date function — SuiteCRM CWE-89 6.5 Medium 2026-11-05

type:sqli 是常见的弱点类别，本平台收录该类弱点关联的 23164 条 CVE 漏洞。