219612 matches found
CVE-2026-17222 IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command...
CVE-2026-17222
IBM i CVE-2026-17222 affects IBM i 7.6, 7.5, 7.4, and 7.3 (5770-SS1) where an authenticated remote attacker could modify data in certain SQL tables due to improper neutralization of special elements in an SQL command. The IBM security bulletin lists related SQL vulnerabilities and provides fixes ...
EUVD-2026-57372
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command...
EUVD-2026-57366
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command...
CVE-2026-17419
IBM i (7.3–7.6) with 5770-SS1 is affected by CVE-2026-17419 due to improper neutralization of special elements in SQL commands, enabling a remote authenticated attacker to modify SQL tables. Affected versions include 7.3, 7.4, 7.5, and 7.6. CVSS 3.1 base score 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H...
CVE-2026-17419
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command...
CVE-2026-17418 IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command...
CVE-2026-17418
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command...
CVE-2026-17418
IBM i CVE-2026-17418 affects IBM i 7.3–7.6. A local authenticated attacker could cause a denial of service due to improper neutralization of special elements used in an SQL command. Remediation: apply IBM i PTFs SJ10867 (7.6), SJ10868 (7.5), SJ10869 (7.4), or SJ10870 (7.3). See IBM Security Bulle...
EUVD-2026-57365
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command...
CVE-2026-44741
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...
EUVD-2026-57357
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...
CVE-2026-44741
Summary of CVE-2026-44741 / GHSA-h4ph-crvj-9h92: The Pimcore Admin Classic Bundle contains a SQL injection in the translation grid date filter where the user-supplied property field is interpolated into a SQL expression (UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))) without parameterization. Affected...
CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied property field from the filter JSON is interpolated directly into a UNIXTIMESTAMPDATEFROMUNIXTIME...
SQL Injection
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the searchUsers process. An attacker can retrieve sensitive user information, such as user IDs and display names, by submitting...
SQL Injection
Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to SQL Injection via the searchUsers process. An attacker can retrieve sensitive user information, such as user IDs and display names, by submitting...
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape % and , which remain active LIKE...
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Impact The Backend Filter widget Backend\Widgets\Filter is vulnerable to SQL injection through the numberrange scope type when the scope is configured with a conditions key. An authenticated backend user with access to a list view containing a vulnerable filter scope can inject arbitrary SQL via...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection in the numberrange scope of the backend filter widget when the conditions key is configured. An attacker can access sensitive database information by injecting arbitrary SQL through the filter's AJAX handler. This is only...
