SQL Injection

Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.

1. Craft CMS <=v3.7.31 - SQL InjectionCVE-2024-37843Craftcms · CVSS 7.5 · 53% likely

   CWE-89

2. Craft CMS < 4.18.9, < 5.11.2 - Unauthenticated SQL InjectionCVE-2026-123488craftcms · CVSS 9.8 · 1.9% likely

   CWE-89

3. Craft has a SQL Injection in Element Indexes via criteria[orderBy]CVE-2026-25495craftcms · CVSS 8.7 · 0.6% likely

   CWE-89

4. Authenticated SQL Injection via nested eager-loading criteriaCVE-2026-79991craftcms · CVSS 7.1 · 0.5% likely

   CWE-89

5. Craft Commerce: SQL Injection can lead to Remote Code Execution via TotalRevenue WidgetCVE-2026-32271craftcms · CVSS 7.7 · 0.5% likely

   CWE-89

6. Craft Commerce has a SQL Injection in Commerce Inventory Table SortingCVE-2026-29174craftcms · CVSS 8.7 · 0.5% likely

   CWE-89

7. SQL injection leading to privilege escalationCVE-2026-115934craftcms · CVSS 9.8 · 0.5% likely

   CWE-89

8. Craft Commerce has a SQL Injection in Commerce Purchasables Table SortingCVE-2026-29172craftcms · CVSS 8.7 · 0.5% likely

   CWE-89

9. CraftCMS's `ElementSearchController` Affected by Blind SQL InjectionCVE-2026-31858craftcms · CVSS 8.7 · 0.4% likely

   CWE-89

10. Craft CMS 4.0.0 before 4.18.9 Unauthenticated SQL Injection via GraphQL Eager-Load SelectCVE-2026-123491craftcms · CVSS 8.2 · 0.3% likely

    CWE-89

11. Craft Commerce: Blind SQL Injection via hasVariant/hasProductCVE-2026-32272craftcms · CVSS 8.7 · 0.3% likely

    CWE-89

12. Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev CriteriaCVE-2026-123489craftcms · CVSS 7.1 · 0.2% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.