EUVD-2026-85711

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

CVE-2026-96751

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

PT-2026-98249

Name of the Vulnerable Software and Affected Versions YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09 Description A remote SQL injection issue exists in the GoView Data Endpoint. The flaw is located in the getDataBySQL function within the GoViewDataServiceImpl.java file. An attacker...

PT-2026-97732

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description SQL Injection in DIAEnergie. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Recommendations Update ...

CVE-2026-96803: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql leads to sql injection. The attack may be launched remotely...

CVE-2026-78309: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78311: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

PT-2026-97684

Name of the Vulnerable Software and Affected Versions java110 MicroCommunity versions prior to 2.1 Description Remote manipulation of the fallBackSql argument within the QueryServiceSMOImpl.fallBack function of the BusinessApi.java file in the fallBack API endpoint allows for SQL injection. SQL...

PT-2026-98197

Name of the Vulnerable Software and Affected Versions DBHub versions prior to 0.22.6 Description Setting readonly = true on the execute sql tool fails to enforce a read-only connection. The database-level read-only controls are not activated because the required configuration value is never...

CVE-2026-77874: Improper Neutralization of Special Elements used in an SQL Command

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

CVE-2026-56738: Improper Neutralization of Special Elements used in an SQL Command

phpMyFAQ is an open source FAQ web application. The StopWords::add method inversions prior to 4.1.6 builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A siblin...

CVE-2026-47132: Improper Input Validation

phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL...

Ubuntu 20.04 LTS / 26.04 LTS : SQL parse vulnerabilities (USN-8808-1)

The remote Ubuntu 20.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8808-1 advisory. It was discovered that SQL parse contained multiple algorithmic complexity flaws when parsing SQL statements with deeply nested parentheses,...

PT-2026-97683

Name of the Vulnerable Software and Affected Versions Forma LMS versions prior to 4.1.44 Description A SQL injection issue exists in the Multi-User-Selector AJAX Endpoint. This occurs when the Name argument is manipulated within the UserselectorAdmController::getDataTask function, located in the...

PT-2026-98235

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description A SQL injection issue exists in the ServiceNow AI Platform. This flaw allows an unauthenticated user to execute arbitrary SQL statements against the underlying database,...

PT-2026-98258

Name of the Vulnerable Software and Affected Versions AWS pgcollection versions 2.0.0 through 2.1.1 Description A type confusion issue exists in this PostgreSQL extension. An authenticated remote user can execute arbitrary code as the postgres operating system user by using crafted SQL statements...

PT-2026-97730

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description SQL Injection in DIAEnergie. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Recommendations Update ...

PT-2026-97838

Name of the Vulnerable Software and Affected Versions IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 IBM Enterprise Build of Quarkus versions 3.33.1 through 3.33.3.SP1 Description An issue exists where a remote unauthenticated attacker can execute SQL injection by sending...

PT-2026-98142

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description An issue exists in the StopWords::add function where user-supplied input is inserted into a SQL INSERT statement using sprintf without proper database escaping. This occurs specifically in the code...

CVE-2026-91133: Improper Neutralization of Special Elements in Data Query Logic

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifie...