SQL injection
4 articles with this tag
CVE-2026-72898 — Unauthenticated SQL Injection in Metabase Grants Admin (What to Do)
Unauthenticated SQL injection in the Metabase password-reset endpoint (CWE-89, CVSS 10.0, KEV). Upgrade to the patch for your release line. But the real lesson is that a BI tool is a keyring for every database behind it, so this site's position is that the response is only complete once sessions are revoked and the credentials of every connected database have been rotated.
CVE-2026-63030 / CVE-2026-60137 — Unauthenticated SQLi to RCE in WordPress core (explainer & fixes)
A REST API batch-endpoint route-confusion flaw in WordPress core (CVE-2026-63030, CWE-436) chains with the WP_Query author__not_in SQL injection (CVE-2026-60137, CWE-89) to reach unauthenticated SQLi → RCE (CVSS 9.8, in CISA KEV). Both are fixed in the same release. The real fix is updating core to 6.8.6 / 6.9.5 / 7.0.2, plus a compromise check. WordPress is core software with an enormous install base, so updating is the top priority.
MOVEit mass breach (2023) — how a SQL injection zero-day reached 2,700+ orgs, and how to defend
The entry was a SQL injection zero-day (CVE-2023-34362) in the internet-facing MOVEit Transfer. A web shell (LEMURLOOT) was planted and data was bulk-stolen from the backing database, hitting 2,700+ orgs and ~93.3M people. Most victims were pulled in indirectly because a vendor used MOVEit. In your environment: KEV fast-patching, minimize exposure, web↔DB least privilege and segmentation, vendor inventory and data minimization.
What is SQL injection (SQLi) — when input rewrites your database's commands
SQLi is when input is read as 'part of the command' rather than data, changing a query's meaning — straight to read/alter/delete. The real defense is to stop string-concatenating SQL and pass values via placeholders (prepared statements).