amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134

Update 2026-09-11: Increased risk score to reflect publicly documented methods for developing exploits. This module integrates amazee.ai's AI services into Drupal, including a Postgres/pgvector vector database backend for use with Search API AI Search. The module doesn't sufficiently sanitize...

CVE-2026-87921: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function updaterecord of the file includes/manage.php. The manipulation of the argument updatecategory/cid/updatebrand/updateproduct leads to sql injection. The...

PT-2026-89169

Name of the Vulnerable Software and Affected Versions Rizwan17 inventory-management-system versions up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f Description A remote SQL injection is possible through the manipulation of the update category, cid, update brand, or update product arguments within...

PT-2026-88871

Name of the Vulnerable Software and Affected Versions Quentn WP versions prior to 1.2.15 Description Unauthenticated attackers can extract arbitrary data from the database through SQL injection. This occurs because the plugin fails to adequately escape request parameters before incorporating them...

CVE-2026-87034: Improper Neutralization of Special Elements used in an SQL Command

Tanium addressed a SQL injection vulnerability in Comply...

CVE-2026-76009: Improper Authentication

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-79640: Improper Neutralization of Special Elements used in an SQL Command

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this...

CVE-2026-79387: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields including passwords and roles via crafted parameters to the User/mod interface, enabling account takeover...

CVE-2026-71808: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

CVE-2026-85788: Incomplete List of Disallowed Inputs

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

CVE-2026-67401: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component...

CVE-2026-79972: Improper Neutralization of Special Elements used in an SQL Command

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this...

PT-2026-89106

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach file-read and file-write SQL sinks via SQL inline comments that the regex engine does not treat as...

PT-2026-88893

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this...

CVE-2026-84068: Improper Neutralization of Special Elements used in an SQL Command

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection...

PT-2026-88945

siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and...

EUVD-2026-75136

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

CVE-2026-79322

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

PT-2026-88946

SiYuan versions = 3.8.1 contain an incomplete fix for CVE-2026-32767 GHSA-j7wh-x834-p3r7. The prior fix commit d5e2d0bc added an administrator check for SQL mode method=2 in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for...

PT-2026-88872

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...