CVE-2026-120065

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065 psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065 psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065

Versions of psqlODBC before 18.00.0006 are vulnerable to SQL injection due to improper handling of server-supplied column names in updatable cursors. When a table lacks OIDs but has an auto-increment int4 column, the driver uses that column for row identification. It places the column name betwee...

CVE-2026-120065: PostgreSQL psqlODBC: For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to…

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2021-28079

CVE-2021-28079 - POC Jamovi file example.omv example.omv: Zip archive data, at least v2.0 to extract All OMV files are archived data. So, you can extract it and modify to exploit the XSS bug. 🔥\ unzip example.omv Archive: example.omv inflating: META-INF/MANIFEST.MF inflating: index.html inflating...

CVE-2026-92730 LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...

CVE-2026-92730 LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page...

GHSA-3G44-3M7X-CGG2 Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the executeSql process. An attacker can execute arbitrary code with the privileges of the server process by injecting malicious Java code into a column name, which is then compiled and executed by the...

Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Overview Yamcs compiles StreamSQL expressions to Java on the fly with the Janino SimpleCompiler no restrictive class-loading policy or expression sandbox. When a StreamSQL aggregate such as sum... is applied to a column, the column's name is interpolated unescaped into the generated Java source...

CVE-2026-55511 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

EUVD-2026-67836

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55511 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55511 Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs allows a user with SystemPrivilege.ControlArchiving to create a double-quoted StreamSQL column name that is interpolated into generated Java source by Expression.fillCodeInputDefVars and Expression.sanitizeName. A sum aggrega...

CVE-2026-55511

Yamcs is a mission control framework. In versions prior to 5.12.8 and 5.13.2 , an authenticated user holding the SystemPrivilege.ControlArchiving privilege can inject arbitrary Java into the StreamSQL aggregate expression compiler by crafting a malicious double-quoted column name. The column name...

WordPress Dinatur plugin <= 1.18 - Unauthenticated SQL Injection via Column Name Injection vulnerability

Unauthenticated SQL Injection via Column Name Injection vulnerability discovered by João Ramos Maciel and Theo Antonio da Fonseca in WordPress Plugin Dinatur versions = 1.18...

ANT-2026-FW0V6SAJ · dhis2-core · SQL Injection

query-injection high CVE-2026-55084 GHSA-pwmg-mvjw-4m23 Severity Claude high · Security research firm high · Maintainer - REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-FW0V6SAJ: SQL Injection via Unquoted Column Name in...

EUVD-2026-54895

The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...

CVE-2026-15533

A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The attack is possible to be carried out remotely. The exploit...