CVE-2026-11391 Tanium addressed a SQL injection vulnerability in Patch.

Tanium addressed a SQL injection vulnerability in Patch...

php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

CVE-2026-7769

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to SQL injection. A remote attacker could send specially crafte...

CVE-2026-7769 SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to SQL injection. A remote attacker could send specially crafte...

AZL-94311 CVE-2026-16313 affecting package sg3_utils 1.48-1

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

UBUNTU-CVE-2026-54620

sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5...

CVE-2026-16313

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

EUVD-2026-49906

A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Summary Using Databasecreateaggregate, createaggregatehandler, or Databasedefineaggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault. Mitigati...

Security update for samba

This update for samba fixes the following issues CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. CVE-2026-58216: 6-byte heap...

Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion Detection

Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the...

DataEase <= 2.4.1 - Sensitive Information Exposure Detection

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. !/usr/bin/env python3...

Metabase Installer - Exposure Detection

Detected Metabase installer page, allowing unauthorized database setup and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Metabase installer page, allowing unauthorized database setup and configuration.""" from kittysploit import from lib.protocols.http.httpclient import...

IBM DB2 Database Server - Detect

IBM DB2 Database Server panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM DB2 Database Server panel was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'IBM...

Hospital Management System 1.0 - SQL Injection Detection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/doctor.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site...

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting Detection

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. !/usr/bin/env python3 --...

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection Detection

Teclib GLPI = 9.3.3 exposes a script /scripts/unlocktasks.php that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records. !/usr/bin/env python3 -- coding:...

CSE Bookstore 1.0 - SQL Injection Detection

CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database. !/usr/bin/env python3 -- coding: utf-8 --...

Hospital Management System 1.0 - SQL Injection Detection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/user-login.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site...