CVE-2026-56738 phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

phpMyFAQ is an open source FAQ web application. The StopWords::add method inversions prior to 4.1.6 builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A siblin...

CVE-2026-56738 phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion

phpMyFAQ is an open source FAQ web application. The StopWords::add method inversions prior to 4.1.6 builds a SQL INSERT statement using sprintf and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A siblin...

CVE-2026-77874

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Summary The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable. Although the value is wrapped in backticks via escapeIdentifier preventing classical SQL injection, this still...

CVE-2026-61781

A flaw was found in pgpartman. A low-privileged database user with specific INSERT and UPDATE permissions can exploit a SQL injection issue in the createpartitiontime function. This allows the user to store malicious SQL code, which is later executed with superuser privileges by the pgpartmanbgw...

CVE-2026-61820

A flaw was found in pgpartman. A local user with partmanuser privileges, who owns a template table, can exploit a SQL injection issue within the inherittemplateproperties function. By crafting a malicious column name, the user can bypass proper escaping, allowing arbitrary SQL commands to be...

CVE-2026-61817

A flaw was found in pgpartman. A user with partmanuser privileges can exploit a SQL injection vulnerability by storing malicious SQL in the partconfig.timedecoder value. This malicious SQL is then executed without proper validation during certain maintenance operations. This can lead to privilege...

CVE-2026-77874 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

CVE-2026-77874 IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

EUVD-2026-86012

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

CVE-2026-77874

IBM Enterprise Build of Quarkus (versions 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1) is vulnerable to SQL injection within the Hibernate component. A remote unauthenticated attacker can send specially crafted SQL statements, potentially allowing them to view, add, modify, or delete...

CVE-2026-61819

A flaw was found in pgpartman. A database user with partmanuser privileges can exploit a SQL injection vulnerability by crafting a malicious parent-table name. When the extension is configured to use pgjobmon, this crafted input is improperly processed during an exception, allowing the injection...

CVE-2026-61818

A flaw was found in pgpartman. The undopartition function improperly handles input from partconfig.timeencoder, allowing it to be interpreted as executable SQL code. A user with partmanuser access can inject malicious SQL, which then executes with the privileges of the user invoking undopartition...

web-attack-log-analyzer

Web Server Log Analyzer — Web Attack Detection A Python tool...

CVE-2026-78309

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78311

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78311 SQL Injection in DIAEnergie

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

EUVD-2026-85820

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78311 SQL Injection in DIAEnergie

SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-78311

A SQL Injection vulnerability exists in DIAEnergie software, specifically affecting versions before 1.11.00.022 . The vulnerability allows for potential unauthorized access or manipulation of the underlying database. While the documents confirm the existence of the flaw and its impact on confiden...