GHSA-RW77-VQ4G-X3HP phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

SQL Injection

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

SQL Injection

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection in the add function. An attacker can execute arbitrary SQL commands by submitting crafted input as the word parameter in the stop-word...

phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

Summary The StopWords::add method in phpMyFAQ builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, StopWords::update, which modifies an existin...

CVE-2026-97321

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-13016

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-96883

The AWS pgcollection PostgreSQL extension versions 2.0.0 through 2.1.1 are vulnerable to a type confusion issue. An authenticated remote user can execute arbitrary code as the postgres operating system user by sending crafted SQL statements that exploit mismatched type metadata during collection ...

CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

EUVD-2026-86406

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

CVE-2026-96883 Type confusion in AWS pgcollection allows remote code execution

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

EUVD-2026-86399

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-13016 Unauthenticated SQL Injection in ServiceNow AI Platform

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-13016 Unauthenticated SQL Injection in ServiceNow AI Platform

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

CVE-2026-13016

The ServiceNow AI Platform contains a SQL injection vulnerability that could allow an unauthenticated user to execute arbitrary SQL statements against the instance's underlying database. Successful exploitation could result in unauthorized access to, or modification of, instance data. ServiceNow ...

CVE-2026-97321 YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-97321

The YunaiV/zhijiantianya ruoyi-vue-pro software (up to version 2026.08) contains a SQL injection vulnerability in the GoView Data Endpoint component. Specifically, the GoViewDataServiceImpl.getDataBySQL function in the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/...

CVE-2026-97321 YunaiV/zhijiantianya ruoyi-vue-pro GoView Data Endpoint GoViewDataServiceImpl.java GoViewDataServiceImpl.getDataBySQL sql injection

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

EUVD-2026-86388

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-61788

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in...