EUVD-2026-51526

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

CVE-2026-46593

The CVE-2026-46593 entry describes an authenticated SQL injection in the PHP Jabbers – PHP Poll Script. The vulnerability arises from improper neutralization of user input to the pjAdminPolls.controller.php endpoint, enabling an authenticated attacker to perform SQL Injection attacks. The issue i...

EUVD-2025-210567

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the...

CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

EUVD-2026-51428

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

CVE-2026-63221

CodeIgniter (PHP) 4.x contains a SQL injection in the Query Builder deleteBatch() path from 4.3.0–4.7.3. When used with where() conditions, deleteBatch() substitutes bound values into generated SQL and ignores escape flags, allowing user-controlled values to be interpreted as SQL. The issue does ...

CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

CVE-2026-14538

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enfor...

CVE-2026-14538 BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enfor...

PT-2026-66785

Name of the Vulnerable Software and Affected Versions cPanel affected versions not specified Description Improper preservation of SQL mode when renaming databases allows the execution of SQL commands in root context. Recommendations At the moment, there is no information about a newer version tha...

PT-2026-66750

A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1...

PT-2026-66859

Name of the Vulnerable Software and Affected Versions SourceCodester Modern Loan Management System version 1.0 Description An issue exists in the 'ajaxData.php' endpoint where improper handling of the district id, division id, region id, and ward id parameters allows for SQL Injection. SQL...

The vulnerability of the qs.stringify() function in the string query analysis and transformation library allows a attacker to cause a service failure.

The vulnerability of the qs.stringify function in the string query analysis and conversion library is related to pointer arithmetic errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2026-66776

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.13 through 9.16 Description An issue exists where the AI Assistant's execute sql query tool fails to properly validate queries supplied by a Large Language Model LLM. The tool uses sqlparse to ensure only one...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2670)

Cross-site scripting XSS vulnerability in the Brother MFC-9970CDW printer with firmware G 1.03 and L 1.10 allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter name QUERYSTRING to admin/adminmain.html, a different vulnerability than CVE-2013-2507 and...

EUVD-2025-210575

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/deletegroup.php?id=1...

CVE-2025-69935

CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenuereport.php via the fromDate parameter...

CVE-2025-69930

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /printmembershipcard.php?id=1...

SUSE CVE-2026-52810

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST .../git-receive-pack using the client-supplied service query string so ?service=git-upload-pack is evaluated as read access while routing still runs git receive-pack, allowing push where only read shou...