phpMyAdmin < 5.0.3 - SQL Injection

phpMyAdmin before 4.9.6 and 5.x before 5.0.3 contains a SQL injection caused by improper processing of SQL statements in the search feature, letting attackers inject malicious SQL, exploit requires crafted search input. id: CVE-2020-26935 info: name: phpMyAdmin 5.0.3 - SQL Injection author: 0xAko...

FreePBX - Remote Code Execution

FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication. id: CVE-2025-57819 info: name: FreePBX - Remote Code...

NetMRI Unauthenticated SQL Injection via skipjackUsername

An issue was discovered in Infoblox NETMRI before 7.6.1. Unauthenticated SQL Injection can occur. id: CVE-2025-32814 info: name: NetMRI Unauthenticated SQL Injection via skipjackUsername author: iamnoooob,pdresearch severity: critical description: | An issue was discovered in Infoblox NETMRI befo...

WordPress Loginizer < 1.6.4 – Unauthenticated SQL Injection via `log` Parameter

The Loginizer plugin before 1.6.4 for WordPress allows SQL injection with resultant XSS, related to loginizerloginfailed and lzvalidip. id: CVE-2020-27615 info: name: WordPress Loginizer 1.6.4 – Unauthenticated SQL Injection via log Parameter author: intelligent-ears severity: critical descriptio...

PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in...

Grandstream UCM6200 - SQL Injection

Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17. id: CVE-2020-5722 info: name: Grandstream UCM6200 - SQL Injection...

Jeecg-boot 3.5.0 qurestSql - SQL Injection

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. id: CVE-2023-1454 info: name: Jeecg-boot 3.5...

LearnPress <= 4.2.5.7 - SQL Injection

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-56292-AcyMailing-SQLi

CVE-2026-56292 — Injection SQL non authentifiée dans AcyMailing pour Joomla Auteur : nullwhisper Réservé à la recherche en sécurité autorisée et à la validation de vulnérabilités uniquement. AcyMailing pour Joomla expose la tâche publique côté front-end frontentityselect::loadEntityFront. Dans le...

CLEANSTART-2026-DW89349 pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE

Security vulnerability affects the apache-hive package. pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE...

CVE-2025-9776

CVE-2025-9776: حقن SQL بعد المصادقة في إضافة CatFolders لـ WordPress الكلمات المفتاحية: CVE-2025-9776, ثغرة CatFolders في WordPress, حقن SQL في WordPress, حقن SQL بعد المصادقة, أمان WordPress, ثغرة استيراد CSV, استغلال إضافات WordPress, CWE-89, هجوم قاعدة بيانات WordPress, ثغرة مكتبة الوسائط,...

PT-2026-108147

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions 3.2.0 through 3.2.4 MariaDB Connector/Node.js versions 3.3.x prior to 3.3.4 MariaDB Connector/Node.js versions 3.4.x prior to 3.4.7 MariaDB Connector/Node.js versions 3.5.x prior to 3.5.4 Description When the...

PT-2026-107825

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

Apache OzHera 2.2.6 Authenticated SQL Injection

Summary Apache OzHeraIncubating is an Application Performance Monitoring APM platform designed for the cloud-native era. It revolves around applications and integrates capabilities such as metric monitoring, distributed tracing, logging, and alerting. The platform's mission is to enhance the onli...

Aruba ClearPass Policy Manager 6.11.x < 6.11.16 / 6.14.x < 6.14.1 Multiple Vulnerabilities (HPESBNW05158)

The version of Aruba ClearPass Policy Manager installed on the remote host is 6.11.x prior to 6.11.16, or 6.14.x prior to 6.14.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBNW05158 advisory. - Deserialization of untrusted data vulnerabilities exist in the web...

CVE-2026-67401

CVE-2026-67401 — Injection SQL dans cPanel/WHM EmailTrack → RCE en root Preuve de concept pour CVE-2026-67401 , une vulnérabilité critique d'injection SQL dans la fonctionnalité EmailTrack de cPanel & WHM qui permet à un utilisateur authentifié disposant de privilèges liés au courrier d'écrire de...

CVE-2025-67644-LangGraph-3.0.1-SQLite-Checkpoint-SQL-Injection

CVE-2025-67644 PoC – حقن SQL في نقاط تحقق SQLite الخاصة بـ LangGraph CVE-2025-67644 هي ثغرة حقن SQL CWE-89 في حزمة langgraph-checkpoint-sqlite جزء من النظام البيئي LangGraph / LangChain. تتيح للمهاجم حقن SQL اعتباطي عبر مفاتيح مرشح البيانات الوصفية غير المعقَّمة التي تُمرَّر إلى طريقتي list / ali...

CVE-2026-76270

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...

CVE-2025-65354

CVE-2025-65354 — ثغرة حقن SQL الملخص توجد ثغرة حقن SQL في تطبيق إدارة الأحداث PuneethReddyHC الإصدار 1.0 بسبب معالجة غير صحيحة للمدخلات. نوع الثغرة حقن SQL المكون المتأثر Endpoint: /Grocery/searchproductsitname.php المعامل: sitemname POST نوع الهجوم عن بُعد التأثير يمكن لمهاجم عن بُعد غير مصادق...

EUVD-2026-94622

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...