EUVD-2026-88695

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. S3ToTeradataOperator and AzureBlobStorageToTeradataOperator interpolate the source bucket's credentials as plain string literals into the CREATE MULTISET TABLE ... LOCATION statement whenever the...

intigriti-0926-writeup

Intigriti Challenge 0926 — Critter Gallery: UNION-based SQL In...

CVE-2026-96430

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...

CVE-2026-96429

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96428

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

CVE-2026-96430 Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...

CVE-2026-96430

Flowring Agentflow 4.0 (versions before 2026/08/28) contains an Exposed Dangerous Method or Function within the /WebAgenda/SQLWin.do API endpoint. This vulnerability allows remote authenticated users to execute arbitrary SQL commands via the sql parameter . The impact includes high severity conse...

EUVD-2026-88659

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...

CVE-2026-96429

Flowring Agentflow 4.0 (versions prior to 2025/08/08 ) is vulnerable to SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint. This flaw allows remote attackers to execute arbitrary SQL commands by manipulating the id parameter. The vulnerability has a CRITICAL base severity score ...

CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96429 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

EUVD-2026-88658

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2026-96428

A SQL Injection vulnerability exists in the Flowring Agentflow 4.0 software (versions before 2025/08/08 ). The flaw is located in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint, where remote attackers can execute arbitrary SQL commands by manipulating the words parameter. This vulnerability h...

CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

CVE-2026-96428 Flowring Agentflow 4.0 - SQL Injection

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

EUVD-2026-88655

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter...

WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by sungbyeongchan in WordPress Plugin Books Gallery versions = 4.8.3...

sitesentinel

SiteSentinel A drop-in website security module that partici...

Exploit for CVE-2026-101110

CVE-2026-101110 — OrdaSoft Book Library Free unauthenticated...

EUVD-2026-88559

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations witho...