221987 matches found
CVE-2026-72562 Pimcore pimcore admin-ui-classic-bundle - SQL Injection
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker wit...
CVE-2026-72558 CiviCRM CiviCRM - SQL Injection
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72558 CiviCRM CiviCRM - SQL Injection
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72558
CVE-2026-72558 affects CiviCRM up to 6.18.alpha1. An SQL injection exists in the contact search RLIKE clause, where user-supplied input is concatenated into the SQL query, enabling authentication-level staff to read the entire database and exfiltrate data such as donor and member records. The con...
CVE-2026-72558
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
EUVD-2026-56028
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...
CVE-2026-72550 Friendica Friendica - SQL Injection
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...
EUVD-2026-56020
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...
CVE-2026-72550
CVE-2026-72550 : In Friendica (through the 2026.08-dev branch) an unauthenticated attacker can cause arbitrary SQL execution via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query through a bare PDO::query() call, enabling stacked statement injection...
CVE-2026-72550
An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Taylsec in WordPress Plugin WP Directory Kit versions = 1.5.4...
RHSA-2026:52978 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...
RHSA-2026:52930 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...
RHSA-2026:52929 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...
RHSA-2026:52928 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...
WordPress Listdom plugin <= 5.6.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Mrs Skelli in WordPress Plugin Listdom versions = 5.6.0...
CVE-2026-34191
A flaw was found in Apache Portable Runtime Utility. This vulnerability, known as SQL Injection, occurs in the aprdbdoracle provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the...
WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Phat RiO in WordPress Plugin Reviewer versions = 3.14.2...
WordPress Tablesome plugin <= 1.2.12 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Tablesome versions = 1.2.12...
