CVE-2026-89180

EFence , developed by Thinking Software Technology , contains a SQL Injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands and read database contents . The vulnerability requires no user interaction and can be exploited over the network with low comp...

CVE-2026-89180 Thinking Software Technology｜EFence - SQL Injection

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...

CVE-2026-89180 Thinking Software Technology｜EFence - SQL Injection

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents...

PT-2026-91155

Name of the Vulnerable Software and Affected Versions EFence affected versions not specified Description An issue exists where unauthenticated remote attackers can perform a SQL Injection, which is a technique used to insert malicious SQL code into a query. This allows the attacker to execute...

EUVD-2026-75136

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

CVE-2026-52763

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...

CVE-2026-84221: Improper Neutralization of Special Elements used in an SQL Command

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

EUVD-2026-71798

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...

CVE-2026-52763

YesWiki , a PHP-based wiki system, is affected by a stored SQL injection in the recentchanges action (actions/recentchanges.php). The period argument supplied via the action syntax ({{recentchanges period="..."}}) bypasses a whitelist that only validates the $_GET form, flowing unvalidated into P...

CVE-2026-52763 YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against 'day','week','month'. The action-argument form takes the else branch wi...

CVE-2026-82871

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

EUVD-2026-68406

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

CVE-2026-82871: Missing Authorization

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

PT-2026-83748

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An issue exists where organization membership is not validated in database read routes. This allows any authenticated user to access table schemas and row data belonging to other organizations. An...

CVE-2026-81636

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636

ash_graphql (ash-project) versions 0.16.23 through before 1.11.0 contain an allocation-of-resources flaw that lets an unauthenticated client bypass the configured GraphQL query-complexity limit. The root cause is in AshGraphql.Graphql.Resolver.query_complexity/3, which multiplies child complexity...

CVE-2026-81636

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

EUVD-2026-68286

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

EEF-CVE-2026-81636 Query-complexity limit bypass via first/last pagination arguments in AshGraphql enables denial of service

Summary Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child...