CVE-2026-107375: Improper Neutralization of Special Elements used in an SQL Command

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

PT-2026-108109

Name of the Vulnerable Software and Affected Versions JHipster versions 7.0.0 through 9.3.x Description Reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database are susceptible to SQL injection. The issue occurs because the sort request parameter in paginated...

PT-2026-107920

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...

Aruba ClearPass Policy Manager 6.11.x < 6.11.16 / 6.14.x < 6.14.1 Multiple Vulnerabilities (HPESBNW05158)

The version of Aruba ClearPass Policy Manager installed on the remote host is 6.11.x prior to 6.11.16, or 6.14.x prior to 6.14.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBNW05158 advisory. - Deserialization of untrusted data vulnerabilities exist in the web...

Apache OzHera 2.2.6 Authenticated SQL Injection

Summary Apache OzHeraIncubating is an Application Performance Monitoring APM platform designed for the cloud-native era. It revolves around applications and integrates capabilities such as metric monitoring, distributed tracing, logging, and alerting. The platform's mission is to enhance the onli...

RHLW-2026-B44D1F7DAC7A0D3D Lightwell Security Advisory: postgresql 42.3.3.rhlw-00006

Red Hat Lightwell has released org.postgresql:postgresql 42.3.3.rhlw-00006 with backported fixes for CVE-2022-31197, CVE-2022-41946, CVE-2024-1597, and CVE-2026-42198. CVE-2022-31197: SQL Injection in ResultSet.refreshRow with malicious column names in pgjdbc CVE-2022-41946: TemporaryFolder on...

CVE-2026-76270

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...

EUVD-2026-94622

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...

CVE-2026-76270 Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...

CVE-2026-76270

Splunk Enterprise and Splunk Cloud Platform versions below 10.4.3 (excluding 10.2.x, 10.0.x, and 9.4.x) are vulnerable to an SQL Injection in the SPL2 module filtering functionality. A user with the list_spl2_modules capability can exploit the lack of parameterized user-supplied values in databas...

CVE-2026-76270 Structured Query Language (SQL) Injection in the SPL2 Module Catalog in Splunk Enterprise

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...

GHSA-PJ7X-6WPF-PGVP Payload: SQL injection in SQLite/Postgres

Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. You are affected if: - You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite. -...

Payload: SQL injection in SQLite/Postgres

Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. You are affected if: - You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite. -...

EUVD-2026-93500

Payload: SQL injection in SQLite/Postgres...

SQL Injection

Overview @payloadcms/db-d1-sqlite is a The officially supported D1 SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are...

SQL Injection

Overview @payloadcms/db-postgres is a The officially supported Postgres database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are...

SQL Injection

Overview @payloadcms/db-vercel-postgres is a Vercel Postgres adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are interpolated into SQL...

SQL Injection

Overview @payloadcms/db-sqlite is a The officially supported SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via the convertPathToJSONTraversal function in SQLite JSON query construction, where user-controlled JSON path segments are interpolat...

Exploit for CVE-2026-102782

CVE-2026-102782 — OrdaSoft Simple Membership unauth SQLi Pyth...

CVE-2026-95605

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...