CVE-2026-108107: Improper Neutralization of Special Elements used in an SQL Command

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw queries. Attackers can send crafted username, macAddr or nasid parameters to the accounting or authenticate actions to...

CVE-2026-107803: Improper Neutralization of Special Elements used in an SQL Command

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

CVE-2026-89235: Improper Neutralization of Special Elements used in an SQL Command

The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query...

CVE-2026-108100: Improper Neutralization of Special Elements used in an SQL Command

HortusFox hortusfox-web before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafted includeinfo values to the /api/locations/list endpoint. Attackers can place subqueries in includeinfo, which PlantsModel::getSpecificInfo concatenates into t...

PT-2026-108852

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1...

CVE-2026-96328: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1...

CVE-2026-96809: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in MultiNet Interactive AB EduAdmin Booking eduadmin-booking allows Blind SQL Injection.This issue affects EduAdmin Booking: from n/a before 6.0.0...

Splunk Enterprise 10.4.0 < 10.4.3 (SVD-2026-1001)

The version of Splunk Enterprise installed on the remote host is 10.4.x prior to 10.4.3. Splunk Enterprise 10.2.x, 10.0.x, and 9.4.x are not affected. It is, therefore, affected by a SQL injection vulnerability as referenced in the SVD-2026-1001 advisory. A user that holds a role with the...

CVE-2026-81932

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-80381

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

CVE-2025-71428

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-71428

Versions of Jivejdon through 5.0 are vulnerable to a SQL injection flaw in the AccountDaoSql.getAccountByNameLike() method. Authenticated users with the Admin role can exploit this by submitting crafted input to the /admin/user/userListAction endpoint via the username parameter . Successful explo...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2025-71428 Jivejdon through 5.0 SQL Injection via username in userListAction

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

CVE-2026-80381

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are vulnerable to a SQL injection flaw within the Sniffer component . This vulnerability (CWE-89) could allow a remote attacker to execute unauthorized SQL statements . To remediate this, IBM strongly recommends applying the latest Sniffe...

CVE-2026-80381 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

CVE-2026-81932 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-81932

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are vulnerable to SQL injection within the Sniffer component . A remote unauthenticated attacker can send specially crafted SQL statements to view, add, modify, or delete information in the back-end database. IBM recommends applying the l...

CVE-2026-16830

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...

CVE-2026-16830 Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability...