PT-2026-107435

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...

PT-2026-107474

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

PT-2026-107427

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

PT-2026-107404

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...

PT-2026-107477

Name of the Vulnerable Software and Affected Versions Pix por Piggly para Woocommerce versions prior to 2.1.3 Description An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks...

PT-2026-107407

The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes...

CVE-2026-76452: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...

PT-2026-107629

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

PT-2026-107487

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...

CVE-2026-42713: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9...

Apache OzHera 2.2.6 Authenticated SQL Injection

Apache OzHera version 2.2.6 contains an authenticated SQL injection vulnerability in Doris-backed log searches. Apache OzHera 2.2.6 Authenticated SQL Injection Vendor: The Apache Software Foundation Product web page: https://ozhera.apache.org Affected version: 2.2.6-incubating Summary: Apache...

MiracleLinux 9 : mariadb-connector-c-3.2.6-2.el9_8 (AXSA:2026-1988:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1988:02 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has...

Oracle Linux 8 : dovecot (ELSA-2026-76763)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-76763 advisory. - fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR protocol violation RHEL-251995 - fix CVE-2026-42007: heap use-after-free in...

Microsoft SQL Server OLE DB Code Execution

The vulnerability of the OLE DB driver of the Microsoft SQL Server database management system is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

MiracleLinux 8 : mariadb-connector-c-3.1.11-3.el8_10 (AXSA:2026-1985:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1985:01 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has...

CVE-2026-42710: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in 10Web Slider by 10Web slider-wd allows Blind SQL Injection.This issue affects Slider by 10Web: from n/a through 1.2.63...

Rocky Linux 9 [CIQ] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (crlsa-2026_75673)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675673 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted th...

Adobe Campaign Classic < 7.4.3 build 9398 Multiple Vulnerabilities (APSB26-114)

The version of Adobe Campaign Classic installed on the remote host is prior to 7.4.3 build 9398. It is, therefore, affected by multiple vulnerabilities: - An incorrect authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of thi...

Rocky Linux 8 [CIQ] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (crlsa-2026_75674)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675674 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted th...

CVE-2024-1207

Booking Calendar = 9.9 - Unauthenticated SQL Injection CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent: Mozilla/5.0...