# SQL injection security incidents · pwn.watch

> Security incidents tagged SQL injection (vendor, product, platform or attack type).

Page: https://pwn.watch/t/sql-injection · generated 2026-10-22T16:23:59.585Z

## Status (as of 2026-10-22)
- Incidents: 17 (0 live, 0 live and not fully patched, 16 patched)
- Days without a SQL injection security incident: 38
- Newest incident started: 2026-09-14

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/sql-injection.json
- RSS (every update): https://pwn.watch/t/sql-injection/feed.xml
- This file: https://pwn.watch/t/sql-injection/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [Cisco Secure Email Gateway: Cisco Secure Email Gateway SQL Injection Vulnerability](https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461) ([json](https://pwn.watch/i/cisco-secure-email-gateway-cve-2026-76461.json)): high, closed, patched, started 2026-09-14, CVE-2026-76461
- [Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability](https://pwn.watch/i/sangoma-switchvox-cve-2026-9586) ([json](https://pwn.watch/i/sangoma-switchvox-cve-2026-9586.json)): high, closed, patched, started 2026-09-02, CVE-2026-9586
- [Metabase Metabase: Metabase SQL Injection Vulnerability](https://pwn.watch/i/metabase-metabase-cve-2026-72898) ([json](https://pwn.watch/i/metabase-metabase-cve-2026-72898.json)): high, closed, patched, started 2026-08-11, CVE-2026-72898
- [WordPress Core: WordPress Core SQL Injection Vulnerability](https://pwn.watch/i/wordpress-core-cve-2026-60137) ([json](https://pwn.watch/i/wordpress-core-cve-2026-60137.json)): high, closed, patched, started 2026-07-21, CVE-2026-60137, CVE-2026-63030
- [Drupal Core: Drupal Core SQL Injection Vulnerability](https://pwn.watch/i/drupal-core-cve-2026-9082) ([json](https://pwn.watch/i/drupal-core-cve-2026-9082.json)): high, closed, patched, started 2026-05-22, CVE-2026-9082
- [BerriAI LiteLLM: BerriAI LiteLLM SQL Injection Vulnerability](https://pwn.watch/i/berriai-litellm-cve-2026-42208) ([json](https://pwn.watch/i/berriai-litellm-cve-2026-42208.json)): high, closed, patched, started 2026-05-08, CVE-2026-42208
- [Fortinet FortiClient EMS: Fortinet FortiClient EMS SQL Injection Vulnerability](https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643) ([json](https://pwn.watch/i/fortinet-forticlient-ems-cve-2026-21643.json)): high, closed, patched, started 2026-04-13, CVE-2026-21643
- [Fortinet FortiWeb: FortiWeb SQL Injection Vulnerability](https://pwn.watch/i/fortinet-fortiweb-cve-2025-25257) ([json](https://pwn.watch/i/fortinet-fortiweb-cve-2025-25257.json)): critical, closed, patched, started 2025-07-18, CVE-2025-25257
- [Advantive VeraCore: 2 exploited vulnerabilities (CVE-2024-57968, CVE-2025-25181)](https://pwn.watch/i/advantive-veracore-cve-2024-57968) ([json](https://pwn.watch/i/advantive-veracore-cve-2024-57968.json)): critical, closed, patched, started 2025-03-10, CVE-2024-57968, CVE-2025-25181
- [Sophos CyberoamOS: CyberoamOS (CROS) SQL Injection Vulnerability](https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574) ([json](https://pwn.watch/i/sophos-cyberoamos-cve-2020-29574.json)): critical, closed, unpatched, started 2025-02-06, CVE-2020-29574
- [Ivanti Cloud Services Appliance zero-days chained by a suspected nation-state actor](https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380) ([json](https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380.json)): critical, closed, patched, started 2024-09-10, CVE-2024-8190, CVE-2024-8963, CVE-2024-9379…
- [Progress WhatsUp Gold SQL Injection](https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670) ([json](https://pwn.watch/i/progress-whatsup-gold-cve-2024-6670.json)): critical, closed, patched, started 2024-08-29, CVE-2024-6670
- [Palo Alto Networks Expedition: 3 actively exploited vulnerabilities](https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465) ([json](https://pwn.watch/i/palo-alto-networks-expedition-cve-2024-5910-9463-9465.json)): critical, closed, patched, started 2024-07-10, CVE-2024-5910, CVE-2024-9463, CVE-2024-9465
- [Ivanti Endpoint Manager (EPM) SQL Injection](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824) ([json](https://pwn.watch/i/ivanti-endpoint-manager-epm-cve-2024-29824.json)): critical, closed, patched, started 2024-05-31, CVE-2024-29824
- [Fortinet FortiClient EMS SQL Injection](https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788) ([json](https://pwn.watch/i/fortinet-forticlient-ems-cve-2023-48788.json)): critical, closed, patched, started 2024-03-12, CVE-2023-48788
- [F5 BIG-IP Configuration Utility: 2 exploited vulnerabilities (CVE-2023-46747, CVE-2023-46748)](https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748) ([json](https://pwn.watch/i/f5-big-ip-configuration-utility-cve-2023-46747-46748.json)): critical, closed, patched, started 2023-10-31, CVE-2023-46747, CVE-2023-46748
- [MOVEit Transfer zero-day: Cl0p mass data theft](https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023) ([json](https://pwn.watch/i/moveit-transfer-cl0p-mass-exploitation-2023.json)): critical, closed, patched, started 2023-05-27, CVE-2023-34362, CVE-2023-35036, CVE-2023-35708