PT-2026-97110

Name of the Vulnerable Software and Affected Versions ReactPress versions prior to 3.7.0 Description API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers. Because TypeORM parameterizes values but not column names,...

PT-2026-96983

Name of the Vulnerable Software and Affected Versions Adobe Connect versions prior to 12.12 Description Adobe Connect contains an SQL Injection flaw, which occurs when special elements used in an SQL command are not properly neutralized. This allows a low-privileged attacker to execute arbitrary...

PT-2026-96910

Name of the Vulnerable Software and Affected Versions Adobe Campaign Classic ACC affected versions not specified Description An Improper Neutralization of Special Elements used in an SQL Command, known as SQL Injection, allows a low-privileged attacker to bypass security features. This issue...

PT-2026-97031

Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description A SQL injection issue exists within the custom model/form import feature. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: qt5-qtbase (UTSA-2023-001575)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001575 advisory. Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. The affected versions are 5.x...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-sqlalchemy (UTSA-2026-090396)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090396 advisory. SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled. Tenable has extracted the preceding description block directly from the Unity Linux...

CVE-2026-82011: Improper Neutralization of Special Elements used in an SQL Command

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...

CVE-2026-82009: Improper Neutralization of Special Elements used in an SQL Command

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...

CVE-2026-88414

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...

PT-2026-96908

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...

CVE-2026-88416

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

CVE-2026-88414

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...

PT-2026-96328

Name of the Vulnerable Software and Affected Versions Yonyou U8cloud versions 5.x Description A SQL injection issue exists within the OpenAPI component. A remote attacker can exploit this by manipulating the operator argument in the '/u8cloud/openapi/so.saleorder.sendaudit' endpoint. SQL injectio...

CVE-2026-88414: Improper Neutralization of Special Elements used in an SQL Command

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...

PT-2026-96327

Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description A weakness in the /cardcase/search list.jsp file allows for remote SQL injection. This occurs when the address argument is manipulated, enabling an attacker to execute unauthorized database queries...

CVE-2026-94117: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3...

PT-2026-96695

Name of the Vulnerable Software and Affected Versions DevItems HashBar – WordPress Notification Bar versions prior to 2.0.4 Description An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an...

CVE-2026-65128: Improper Neutralization of Special Elements used in an SQL Command

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

RockyLinux 9 : postgresql:18 (RLSA-2026:67848)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67848 advisory. postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary...

CVE-2026-12718: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection. This issue affects KarelIPS: through 22092026. NOTE: The vendor was contacted and it was learned that the product is no...