CVE-2026-94110 QCMS Content Detail Controllers.php self_Tmp sql injection

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-94110

QCMS up to 6.0.6 is vulnerable to a remote SQL injection in the self_Tmp function of Lib/Config/Controllers.php (Content Detail Page component). The root cause is unsanitized use of the ID argument. A publicly disclosed proof-of-concept exploit is available. Notably, the router parses raw REQUEST...

PT-2026-96302

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3 Description Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls the applySqlVariables function from server/sources/shared/sql/sql.variables.js without enabling the...

CVE-2026-65651: Uncontrolled Recursion

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses...

PT-2026-96040

Name of the Vulnerable Software and Affected Versions drogonframework drogon versions prior to 1.9.14 Description A remote SQL injection is possible within the ORM Mapper component. The issue resides in the Mapper::orderBy function located in the Mapper.h library, where improper handling of the...

PT-2026-96305

Name of the Vulnerable Software and Affected Versions Pagekit CMS versions prior to 1.0.19 Description An unauthenticated attacker can perform SQL injection, a technique used to manipulate database queries, by submitting a malicious credentials array to the public login endpoint 'POST...

CVE-2026-88756: Improper Neutralization of Special Elements used in an SQL Command

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-65980: Improper Neutralization of Special Elements used in an SQL Command

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-61852: Improper Neutralization of Special Elements used in an SQL Command

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

VulnCheck KEV: CVE-2026-48842

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuserquery plugin via a pregreplace backslash escape bypass...

CVE-2026-61851: Incomplete List of Disallowed Inputs

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

PT-2026-96030

Name of the Vulnerable Software and Affected Versions QCMS versions prior to 6.0.7 Description A remote SQL injection exists in the Content Detail Page component within the self Tmp function located in the Lib/Config/Controllers.php library. The issue occurs when the ID argument is manipulated...

CVE-2026-94144: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library ormlib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been...

PT-2026-96045

Name of the Vulnerable Software and Affected Versions drogonframework drogon versions prior to 1.9.14 Description A flaw in the ORM component affects the makeCriteria function within the orm lib/src/Criteria.cc library. A remote attacker can perform a SQL injection by manipulating the filter...

CVE-2026-88402: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

EUVD-2026-84194

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-94143: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...

ROS-20260921-73-0136

The vulnerability in pgadmin4 is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...