CVE-2026-12260: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

CVE-2026-107385: Improper Neutralization of Special Elements used in an SQL Command

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-5048: Improper Neutralization of Special Elements used in an SQL Command

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

CVE-2026-107375: Improper Neutralization of Special Elements used in an SQL Command

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2026-105076: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...

CVE-2026-81932: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2025-71428: Improper Neutralization of Special Elements used in an SQL Command

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2026-80381: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

CVE-2026-16830: Improper Neutralization of Special Elements used in an SQL Command

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...

VulnCheck KEV: CVE-2026-4815

A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls0messageids' parameter in '/supportboard/include/ajax.php' endpoint...

PT-2026-107869

Name of the Vulnerable Software and Affected Versions NetBoard CRM demo platform affected versions not specified Description An issue exists in the '/module/auth/recovery.php' endpoint where the user-name POST parameter is susceptible to SQL injection. This allows for blind attacks using Boolean,...

PT-2026-107825

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

PT-2026-108109

Name of the Vulnerable Software and Affected Versions JHipster versions 7.0.0 through 9.3.x Description Reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database are susceptible to SQL injection. The issue occurs because the sort request parameter in paginated...

PT-2026-108147

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions 3.2.0 through 3.2.4 MariaDB Connector/Node.js versions 3.3.x prior to 3.3.4 MariaDB Connector/Node.js versions 3.4.x prior to 3.4.7 MariaDB Connector/Node.js versions 3.5.x prior to 3.5.4 Description When the...

PT-2026-108148

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.5 MariaDB Connector/Node.js versions prior to 3.3.4 MariaDB Connector/Node.js versions prior to 3.4.7 MariaDB Connector/Node.js versions prior to 3.5.4 Description Text-protocol escaping fails to...

PT-2026-108225

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description An SQL injection flaw allows a remote authenticated attacker to modify data and cause a denial of service. SQL...

PT-2026-108267

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection versions 12.0 through 12.2 Description An issue exists that allows a remote attacker to execute unauthorized SQL statements on security database appliances. This is caused by SQL injection, a technique where...

PT-2026-108276

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.1 IBM Guardium Data Protection version 12.2.2 Description Improper neutralization of special elements used in an SQL command allows a remote attacker to execute arbitrary SQL commands. This issue is caus...

Apache OzHera 2.2.6 Authenticated SQL Injection

Summary Apache OzHeraIncubating is an Application Performance Monitoring APM platform designed for the cloud-native era. It revolves around applications and integrates capabilities such as metric monitoring, distributed tracing, logging, and alerting. The platform's mission is to enhance the onli...

Aruba ClearPass Policy Manager 6.11.x < 6.11.16 / 6.14.x < 6.14.1 Multiple Vulnerabilities (HPESBNW05158)

The version of Aruba ClearPass Policy Manager installed on the remote host is 6.11.x prior to 6.11.16, or 6.14.x prior to 6.14.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBNW05158 advisory. - Deserialization of untrusted data vulnerabilities exist in the web...