CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-9483SkyWalking SQLI | Apache · Apache SkyWalking | Public check | – | 34% | 2020-06-30 |
| CVE-2024-39887Apache Superset < 4.0.2 - SQL Injection | Apache Software Foundation · Apache Superset | Public check | 4.3 | 4.7% | 2024-07-16 |
| CVE-2022-23305SQL injection in JDBC Appender in Apache Log4j V1 | Apache Software Foundation · Apache Log4j 1.x | Likely | 9.8 | 67% | 2022-01-18 |
| CVE-2024-45387Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments | Apache Software Foundation · Apache Traffic Control | Likely | 9.9 | 66% | 2024-12-23 |
| CVE-2016-0710Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2)… | Apache · Jetspeed | Likely | – | 52% | 2016-04-11 |
| CVE-2020-13921**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases. | Apache · Apache SkyWalking | Likely | – | 33% | 2020-08-05 |
| CVE-2023-37924Apache Submarine: SQL injection from unauthorized login | Apache Software Foundation · Apache Submarine | Possible | – | 7.2% | 2023-11-22 |
| CVE-2018-1282This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in Prepare… | Apache Software Foundation · Apache Hive | Possible | – | 5.5% | 2018-04-05 |
| CVE-2018-11801SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on a m_center data related table. | Apache · Apache Fineract | Possible | – | 5.2% | 2019-06-11 |
| CVE-2018-11800SQL injection vulnerability in Apache Fineract before 1.3.0 allows attackers to execute arbitrary SQL commands via a query on the GroupSummaryCounts related table. | Apache · Apache Fineract | Possible | – | 5.2% | 2019-06-11 |
| CVE-2026-35152Apache Fineract: SQL injection in runreports endpoint | Apache Software Foundation · Apache Fineract | Possible | 8.8 | 3.3% | 2026-07-15 |
| CVE-2018-1290In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injecti… | Apache Software Foundation · Apache Fineract | Possible | – | 3.2% | 2018-04-20 |
| CVE-2020-1937Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. | Apache · Apache Kylin | Possible | – | 3.1% | 2020-02-24 |
| CVE-2022-27479SQL injection vulnerability in chart data API | Apache Software Foundation · Apache Superset | Possible | – | 2.9% | 2022-04-13 |
| CVE-2018-1289In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Quer… | Apache Software Foundation · Apache Fineract | Possible | – | 2.5% | 2018-04-20 |
| CVE-2017-5663In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read permissions is able to inject malicious… | Apache Software Foundation · Apache Fineract | Possible | – | 2.1% | 2017-12-14 |
| CVE-2018-1292Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn'… | Apache Software Foundation · Apache Fineract | Possible | – | 2.0% | 2018-04-20 |
| CVE-2018-1291Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' wh… | Apache Software Foundation · Apache Fineract | Possible | – | 2.0% | 2018-04-20 |
| CVE-2020-13926Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be o… | Apache · Apache Kylin | Possible | – | 1.9% | 2020-07-14 |
| CVE-2016-2174SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime p… | Apache · Ranger | Possible | – | 1.9% | 2016-06-13 |
| CVE-2021-41971Possible SQL Injection when template processing is enabled | Apache Software Foundation · Apache Superset | Possible | – | 1.8% | 2021-10-18 |
| CVE-2023-35088Apache InLong: SQL injection in audit endpoint | Apache Software Foundation · Apache InLong | Possible | 9.8 | 1.6% | 2023-07-25 |
| CVE-2023-31038Apache Log4cxx: SQL injection when using ODBC appender | Apache Software Foundation · Apache Log4cxx | Possible | 8.8 | 1.6% | 2023-05-08 |
| CVE-2024-32838Apache Fineract: SQL injection vulnerabilities in offices API endpoint | Apache Software Foundation · Apache Fineract | Possible | 9.4 | 1.5% | 2025-02-12 |
| CVE-2024-23539Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to man… | Apache Software Foundation · Apache Fineract | Possible | 8.3 | 1.5% | 2024-03-29 |
| CVE-2018-11774Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL statements. This allows f… | Apache · VCL | Possible | – | 1.4% | 2019-07-29 |
| CVE-2018-11772Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. The cookie data is the… | Apache · VCL | Possible | – | 1.4% | 2019-07-29 |
| CVE-2023-25196Apache Fineract: SQL injection vulnerability | Apache Software Foundation · Apache Fineract | Possible | – | 1.3% | 2023-03-28 |
| CVE-2024-23538Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database querie… | Apache Software Foundation · Apache Fineract | Possible | 9.9 | 1.3% | 2024-03-29 |
| CVE-2017-7681Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries bei… | Apache Software Foundation · Apache OpenMeetings | Possible | – | 1.3% | 2017-07-14 |
| CVE-2022-41703Apache Superset: SQL injection vulnerability in adhoc clauses | Apache Software Foundation · Apache Superset | Possible | 5.4 | 1.2% | 2023-01-16 |
| CVE-2023-49736Apache Superset: SQL Injection on where_in JINJA macro | Apache Software Foundation · Apache Superset | Possible | 6.5 | 1.2% | 2023-12-19 |
| CVE-2023-30465Apache InLong: SQL injection in apache inLong 1.5.0 | Apache Software Foundation · Apache InLong | Possible | 5.3 | 1.2% | 2023-04-11 |
| CVE-2022-45135Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction | Apache Software Foundation · Apache Cocoon | Possible | 9.8 | 1.1% | 2023-11-30 |
| CVE-2024-42361GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull} | Apache · HertzBeat | Possible | 7.5 | 1.1% | 2024-08-20 |
| CVE-2023-25197apache fineract: SQL injection vulnerability in certain procedure calls | Apache Software Foundation · apache fineract | Possible | – | 1.1% | 2023-03-28 |
| CVE-2024-36263Apache Submarine Server Core: SQL injection | Apache Software Foundation · Apache Submarine Server Core | Unlikely | 8.1 | 1.0% | 2024-06-12 |
| CVE-2025-30473Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection | Apache Software Foundation · Apache Airflow Common SQL Provider | Unlikely | 8.8 | 1.0% | 2025-04-07 |
| CVE-2022-45786Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection | Apache Software Foundation · Apache AGE | Unlikely | 8.1 | 1.0% | 2023-02-04 |
| CVE-2024-24772Apache Superset: Improper Neutralisation of custom SQL on embedded context | Apache Software Foundation · Apache Superset | Unlikely | 4.3 | 1.0% | 2024-02-28 |
| CVE-2025-27018Apache Airflow MySQL Provider: SQL injection in MySQL provider core function | Apache Software Foundation · Apache Airflow MySQL Provider | Unlikely | 6.3 | 0.9% | 2025-03-19 |
| CVE-2025-48912Apache Superset: Improper authorization bypass on row level security via SQL Injection | Apache Software Foundation · Apache Superset | Unlikely | 7.1 | 0.9% | 2025-05-30 |
| CVE-2023-30867Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability | Apache Software Foundation · Apache StreamPark (incubating) | Unlikely | – | 0.9% | 2023-12-15 |
| CVE-2024-53947Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions | Apache Software Foundation · Apache Superset | Unlikely | 2.3 | 0.8% | 2024-12-09 |
| CVE-2026-57308Apache Syncope: SQL injection vulnerability in Audit Events search | Apache Software Foundation · Apache Syncope | Unlikely | 9.8 | 0.8% | 2026-07-20 |
| CVE-2025-55674Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions | Apache Software Foundation · Apache Superset | Unlikely | 5.3 | 0.8% | 2025-08-14 |
| CVE-2026-57821Apache Fineract: Office list: SQL Injection via Subquery in orderBy | Apache Software Foundation · Apache Fineract | Unlikely | 8.1 | 0.7% | 2026-07-15 |
| CVE-2026-23980Apache Superset: Improper Neutralization of Special Elements used in a SQL Command | Apache Software Foundation · Apache Superset | Unlikely | 5.3 | 0.7% | 2026-02-24 |
| CVE-2026-23969Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering | Apache Software Foundation · Apache Superset | Unlikely | 5.3 | 0.7% | 2026-02-24 |
| CVE-2026-63039Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService | Apache Software Foundation · Apache InLong | Unlikely | 9.8 | 0.7% | 2026-08-20 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.