EUVD-2026-57091

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

CVE-2026-16977

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection...

PT-2026-71038

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

CVE-2026-17111: Improper Neutralization of Special Elements used in an SQL Command

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-18789: Missing Authorization

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

PT-2026-71027

The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently...

WordPress Creative Mail SQL Injection Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Creative Mail has a SQL injection vulnerability, which stems from improper handling of special elements in SQL commands. Attackers can exploit this vulnerability to obtain sensitive...

CVE-2026-16480: Client-Side Enforcement of Server-Side Security

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data...

LiteLLM SQL injection vulnerability

LiteLLM is an open-source application developed by Berri AI. It allows for the invocation of all LLM APIs in the OpenAI format. LiteLLM has a SQL injection vulnerability, and attackers can exploit this vulnerability to obtain sensitive database information...

PT-2026-71115

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

CVE-2025-41771: Improper Neutralization of Special Elements used in an SQL Command

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification...

PT-2026-71270

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description Remote attackers can execute SQL injection by sending specially crafted SQL statements. This allows unauthorized parties to view, add, modify, or delete information within the back-end database. SQL...

CVE-2026-64639: Incorrect Privilege Assignment

Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user customer, reseller to execute arbitrary code on behalf of the database server administrator...

PT-2026-71261

Name of the Vulnerable Software and Affected Versions CamaleonCMS version 2.9.1 Description Authenticated attackers with post creation or editing privileges can perform a SQL injection by submitting a crafted slug value. The database backend evaluates this value as part of an inadequately...

Linux Distros Unpatched Vulnerability : CVE-2026-72558

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The...

PT-2026-71233

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

CVE-2026-72791: Missing Authorization

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

CVE-2026-73300: Improper Neutralization of Special Elements used in an SQL Command

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading t...

PT-2026-71201

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading t...

The vulnerability of the Azure SQL Database cloud relational database, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.

The vulnerability of Azure SQL Database cloud relational database is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...