CVE-2026-115192

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

CVE-2026-115192

An SQL Injection vulnerability exists in the Mautic dashboard widget data API endpoint (/api/data/{type}). The root cause is the improper validation of client-supplied chart filter parameters before they are used in database queries. An authenticated user with API access can leverage blind SQL in...

EUVD-2026-109796

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

CVE-2026-89199

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal...

CVE-2026-89203

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker ...

CVE-2026-89204

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized...

CVE-2026-89203

A vulnerability exists in RUGGEDCOM CROSSBOW (all versions

CVE-2026-89199

The RUGGEDCOM CROSSBOW (all versions

EUVD-2026-98065

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

EUVD-2026-98038

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information...

EUVD-2026-98029

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

PT-2026-111400

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Improper access control allows authenticated users to execute database queries and retrieve system-wide information beyond their assigned privilege level. This could enable an attacker to...

PT-2026-111401

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Improper access control exists regarding database queries used for subnet management. An authenticated attacker can exploit this to read, modify, or delete subnet configurations, resulting ...

CVE-2026-89203: Insertion of Sensitive Information Into Sent Data

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker ...

CVE-2026-109647

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information...

CVE-2026-109638

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

CVE-2026-109639

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to...

CVE-2026-109674 Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

CVE-2026-109663

Frappe ERPNext versions before 15.113.0 and 16.x before 16.22.0 are vulnerable to an SQL injection due to missing input validation in certain endpoints. Authenticated remote attackers can exploit this by sending specially crafted requests to manipulate database queries and extract sensitive infor...

CVE-2026-109649 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive...