PT-2026-70154

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = label creator permission to execute arbitrary SQL via the image name field of a patron card layout. The image name value is stored verbatim in the layout XML...

PT-2026-70796

Name of the Vulnerable Software and Affected Versions ishankportfolio versions prior to 1.0.1 Description Contact form submissions may be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database...

PT-2026-70133

Name of the Vulnerable Software and Affected Versions CiviCRM versions prior to 6.18.alpha1 Description An SQL injection issue exists where the contact search RLIKE clause concatenates user-supplied values into a SQL query without proper sanitization. This allows authenticated users with...

CVE-2026-72558: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all...

CVE-2026-72599: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...

CVE-2026-46670: Improper Neutralization of Special Elements used in an SQL Command

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...

CVE-2026-72915

creationtimestamp| type| source ---|---|--- 2026-08-10 23:00:13+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msr7ckt7oy23 2026-08-10 23:04:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fjk6ypp3ovspk 2026-08-12 06:12:39+00:00| seen|...

CVE-2026-72877

creationtimestamp| type| source ---|---|--- 2026-08-10 20:36:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqxasur462v...

CVE-2026-72881

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...

CVE-2025-13294

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (July 2026)

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2025-13294 Unauthenticated SQL Injection

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

EUVD-2025-210667

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

CVE-2025-13294

Affected software: TBEA TLogger web server (firmware version V2.1.0.0B0.0.0.0). Vulnerability: Unauthenticated SQL injection in multiple HTTP endpoints that incorporate attacker-controlled parameters directly into SQLite queries. Impact: attacker can read, modify, or delete data in CCU.db; high c...

CVE-2026-72881

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...

CVE-2026-72881

Dokploy (PaaS) is affected before 0.29.13 by a command injection in the backup/restore code paths. The vulnerable components are database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts, which interpolate database na...

CVE-2026-72881 Dokploy: Command Injection via database credentials in backup/restore commands

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...

CVE-2026-72881 Dokploy: Command Injection via database credentials in backup/restore commands

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...

EUVD-2026-55789

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...