287225 matches found
PYSEC-2026-3945 WsgiDAV MySQL provider has a blind SQL injection
Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...
soda-sql (>=2.0.0b17, <=2.0.0b27), soda-sql-snowflake (>=2.1.0b12, <=2.1.6) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.4.0)
snowflake-connector-python PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - soda-sql =2.0.0b17, =2.1.0b12, =2.1.6 Source cves: CVE-2026-15925 Source advisory: OSV:PYSEC-2026-3920...
PYSEC-2026-3921 Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities
Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...
Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities
Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...
SQL Injection
Apache Hive is vulnerable to SQL Injection. The vulnerability is due to unsanitized partition names being concatenated into direct SQL queries, allowing an authenticated user to alter partition lookups and read, modify, truncate, or affect unintended partition metadata...
CVE-2026-7188
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
CVE-2026-7188
Armiya Information Technologies Ltd. Co. Access Control System versions before Version 2 are affected by an SQL injection vulnerability caused by improper neutralization of special elements used in an SQL command. The vulnerability is rated CRITICAL (CVSS 9.8) with a network attack vector, low co...
EUVD-2026-75293
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
CVE-2026-7188 SQLi in Armiya Information Technologies' Access Control System
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
CVE-2026-7188 SQLi in Armiya Information Technologies' Access Control System
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...
WordPress Quentn WP plugin 1.2.13-1.2.14 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Quentn WP versions 1.2.13-1.2.14...
Exploit for SQL Injection in Wordpress
wp2shell Lab — CVE-2026-60137 & CVE-2026-63030 WordPress Core...
Exploit for SQL Injection in Osgeo Geoserver
Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/P...
WordPress ELEX WooCommerce Request a Quote plugin < 2.4.1 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Artus KG in WordPress Plugin ELEX WooCommerce Request a Quote versions 2.4.1...
CLEANSTART-2026-MQ51708 sqlparse is a non-validating SQL parser module for Python
Multiple security vulnerabilities affect the apache-superset package. sqlparse is a non-validating SQL parser module for Python. See references for individual vulnerability details...
EUVD-2026-75219
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...
EUVD-2026-75182
A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function updaterecord of the file includes/manage.php. The manipulation of the argument updatecategory/cid/updatebrand/updateproduct leads to sql injection. The...
CVE-2026-87925
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...
CVE-2026-73698: Improper Neutralization of Special Elements used in an SQL Command
FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...