CVE-2026-58243 Privilege Escalation vulnerability in SAP ABAP Developer Tools

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

EUVD-2026-55873

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...

PT-2026-70143

Name of the Vulnerable Software and Affected Versions e107 version 2.4.0 Description An SQL injection allows unauthenticated remote attackers to execute arbitrary SQL commands. This occurs because the news item page ID parameter is concatenated directly into a SQL WHERE clause without proper...

PT-2026-70033

Name of the Vulnerable Software and Affected Versions SAP ABAP Development Tools affected versions not specified Description SAP ABAP Development Tools fails to perform required authorization checks for specific functionality. This allows an attacker with low privileges to execute unauthorized...

PT-2026-70614

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

PT-2026-70238

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without...

PT-2026-70042

Name of the Vulnerable Software and Affected Versions SAP Social intelligence affected versions not specified Description An authenticated attacker can exploit an SQL Injection flaw to inject SQL DDL Data Definition Language strings directly into the underlying database without additional...

CVE-2026-19425: Improper Neutralization of Special Elements used in an SQL Command

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-72607: Improper Neutralization of Special Elements used in an SQL Command

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = itemsbatchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The...

PT-2026-81355

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description A path sandbox bypass exists in corpus-reader constructors, enabling attackers to read files outside the intended data root. By supplying arbitrary corpus root paths to the LinThesaurusCorpusReader and...

PT-2026-70847

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue allows an authenticated user with a limited database-scoped role to perform unauthorized actions against protected system collections. This flaw could enable the dropping and...

CVE-2026-48771: Exposure of Sensitive Information to an Unauthorized Actor

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive...

CVE-2026-72608: Improper Neutralization of Special Elements used in an SQL Command

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...

CVE-2026-47702: Cleartext Storage of Sensitive Information

TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...

CVE-2026-63522: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally...

PT-2026-70125

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

CVE-2026-72550: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

CVE-2026-66770: Improper Neutralization of Special Elements used in an SQL Command

Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL Data Definition Language string into the underlying database without further authorization. Successful exploitation could allow the attacker to make malicious changes to th...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability exists in public shared cards containing field-filter template tags, where a specially structured parameter value can be interpreted by HoneySQL as raw query structure rathe...

CVE-2026-58243: Missing Authorization

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify...