Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection

A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this...

WhatsUp Gold HasErrors SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6670 info: name: WhatsUp Gold HasErrors SQL Injection - Authentication Bypass author: DhiyaneshDK,princechaddha severity:...

CVE-2026-56292-AcyMailing-SQLi

CVE-2026-56292 — AcyMailing for Joomla Unauthenticated SQL Injection Author: nullwhisper For authorized security research / vulnerability validation only. AcyMailing for Joomla exposes the public front-end task frontentityselect::loadEntityFront. In older versions the columns parameter is passed...

EUVD-2026-101723

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2025-9776

CVE-2025-9776: Authenticated SQL Injection in CatFolders WordPress Plugin Keywords: CVE-2025-9776, CatFolders WordPress vulnerability, SQL injection WordPress, authenticated SQL injection, WordPress security, CSV import vulnerability, WordPress plugin exploit, CWE-89, WordPress database attack,...

PT-2026-115369

Name of the Vulnerable Software and Affected Versions Backuply versions prior to 1.5.9 Description Backuply is subject to a second-order SQL Injection that allows authenticated users with subscriber-level access and above to escalate privileges and take full control of a site. The issue occurs wh...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

UBUNTU-CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-55239: Improper Neutralization of Special Elements used in an SQL Command

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

Linux Distros Unpatched Vulnerability : CVE-2026-93484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper...

RHEL 9 : mariadb-connector-c (RHSA-2026:83518)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83518 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

RHEL 9 : mariadb-connector-c (RHSA-2026:83608)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83608 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

CVE-2026-110840

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2026-110840 n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2026-110840 n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field

n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL injection vulnerability in version 1 of the Microsoft SQL node, which substitutes Query field expression values directly into SQL text without parameterisation. When a workflow binds untrusted input such as webhook fields to the Query...

CVE-2026-110840

The n8n automation tool (versions before 2.41.4 and 2.42.x before 2.42.1 ) is vulnerable to an SQL injection in version 1 of the Microsoft SQL node . The root cause is the direct substitution of Query field expression values into SQL text without proper parameterisation . If a workflow binds untr...

Exploit for CVE-2026-107081

CVE-2026-107081 — SQL Injection via Identifier Injection in SL...

CVE-2026-110670

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the...

CVE-2026-55683

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract$REQUEST and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT...

CVE-2026-55684

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...