# SQL injection

Untrusted input ends up inside a database query, so an attacker can read, change or delete data the application never meant to expose.

How to fix: Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time.


- [CVE-2026-72898](https://insights.sbomify.com/CVE-2026-72898/): Metabase SQL Injection (critical 10.0, exploited in the wild)
- [CVE-2020-12271](https://insights.sbomify.com/CVE-2020-12271/): Sophos SFOS SQL Injection (critical 10.0, exploited in the wild)
- [CVE-2026-76461](https://insights.sbomify.com/CVE-2026-76461/): Cisco Secure Email Gateway SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2026-63030](https://insights.sbomify.com/CVE-2026-63030/): WordPress Core Interpretation Conflict (critical 9.8, exploited in the wild)
- [CVE-2026-9082](https://insights.sbomify.com/CVE-2026-9082/): Drupal Core SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2024-43468](https://insights.sbomify.com/CVE-2024-43468/): Microsoft Configuration Manager SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2024-6670](https://insights.sbomify.com/CVE-2024-6670/): Progress WhatsUp Gold SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2023-34362](https://insights.sbomify.com/CVE-2023-34362/): Progress MOVEit Transfer SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2021-44026](https://insights.sbomify.com/CVE-2021-44026/): Roundcube Webmail SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2021-42258](https://insights.sbomify.com/CVE-2021-42258/): BQE BillQuick Web Suite SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2021-20028](https://insights.sbomify.com/CVE-2021-20028/): SonicWall Secure Remote Access (SRA) SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2021-27101](https://insights.sbomify.com/CVE-2021-27101/): Accellion FTA SQL Injection (critical 9.8, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/types/sql-injection/