Apache · weakness class
SQL Injection
80 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 2
- likely to be exploited
- 4
Every one of the 80 is a mark on the map. Named now: 27 to 52, most at risk first.
- Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is the…
- Apache Fineract: SQL injection vulnerability
- Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database querie…
- Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries bei…
- Apache Superset: SQL injection vulnerability in adhoc clauses
- Apache Superset: SQL Injection on where_in JINJA macro
- Apache InLong: SQL injection in apache inLong 1.5.0
- Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction
- GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}
- apache fineract: SQL injection vulnerability in certain procedure calls
- Apache Submarine Server Core: SQL injection
- Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection
- Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection
- Apache Superset: Improper Neutralisation of custom SQL on embedded context
- Apache Airflow MySQL Provider: SQL injection in MySQL provider core function
- Apache Superset: Improper authorization bypass on row level security via SQL Injection
- Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability
- Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
- Apache Syncope: SQL injection vulnerability in Audit Events search
- Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
- Apache Fineract: Office list: SQL Injection via Subquery in orderBy
- Apache Superset: Improper Neutralization of Special Elements used in a SQL Command
- Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering
- Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService
- Apache InLong: SQL Injection via String Concatenation Vulnerability Report
- Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.