272554 matches found
CVE-2026-96600 Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...
CVE-2026-96600 Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks
Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...
CVE-2026-96600
Isotope eCommerce versions through 2.9.10 are vulnerable to a blind SQL injection within backend callbacks. The root cause is the direct interpolation of request-controlled identifiers and administrator-supplied values into SQL statements. This flaw allows authenticated Contao backend users with ...
CVE-2026-86677
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...
postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse
A SQL injection flaw in PostgreSQL's EXTRACT expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pgdump or psql inspect o...
CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...
CVE-2026-86677 Broken Authentication vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...
EUVD-2026-85295
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...
CVE-2026-86677
ZohoCorp ManageEngine Applications Manager (versions 182000 and below) is vulnerable to a Broken Authentication issue caused by the improper neutralization of special elements in an SQL command . This flaw allows a low-privileged user to execute unauthorized SQL commands, which could lead to admi...
CVE-2026-86677 Broken Authentication vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...
vulnerabilities in Adobe Connect and the Adobe Connect Android Mobile App
Adobe has identified 9 vulnerabilities in Adobe Connect and the Adobe Connect Android Mobile App. These vulnerabilities are present in Adobe Connect 12.12 and Adobe Connect Android Mobile App 4.5. The vulnerabilities concern various security issues in Adobe Connect, including SQL injection,...
WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Tainacan versions = 1.2.0...
CVE-2026-14913
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...
CVE-2026-14913
ZohoCorp ManageEngine OpManager and Firewall Analyzer (versions 12.8.669 and below) are vulnerable to an SQL Injection vulnerability within Rule Management Search Reports . This flaw occurs due to the improper neutralization of special elements used in an SQL command. Exploitation details are not...
CVE-2026-14913 SQL Injection vulnerability
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...
CVE-2026-14913 SQL Injection vulnerability
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...
EUVD-2026-85233
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports...
WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Email Log versions = 2.63...