CVE-2026-55857: Cleartext Transmission of Sensitive Information

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

CVE-2026-55860: Cleartext Transmission of Sensitive Information

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a...

PT-2026-83372

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description When a Java application connects using...

CVE-2026-55855: Improper Neutralization of Special Elements used in an SQL Command

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis,...

PT-2026-83348

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description MariaDB Connector/Node.js can...

PT-2026-83373

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description When using PAM dialog authentication, the connector ca...

PT-2026-83376

Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1 Description The driver does not require a secure transport before using clear-text password authentication plugins. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest...

CVE-2026-55858: Inappropriate Encoding for Output Context

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the connector encodes and decodes protocol text and performs client-side escaping under the assumption that the connection character set is UTF-8. The...

CVE-2026-81676

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81677

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

CVE-2026-81674

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the idambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

CVE-2026-81677

TOOOLS' iSquad is affected by a SQL injection vulnerability in the /ws/apiprensa/getVideo endpoint, caused by improper validation of the GET parameter id_ambito. User input is incorporated directly into MariaDB queries without sanitization or prepared statements, allowing an attacker to inject SQ...

EUVD-2026-67013

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

CVE-2026-81677 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

CVE-2026-81677 Multiple Vulnerabilities in TOOOLS' iSquad

The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...

EUVD-2026-67012

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81676 Multiple Vulnerabilities in TOOOLS' iSquad

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81676 Multiple Vulnerabilities in TOOOLS' iSquad

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limitvideos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-81676

CVE-2026-81676 is an error-based SQL injection in TOOOLS' iSquad , affecting the endpoint /ws/apitribuna/ultimosVideos. The limit_videos parameter is directly concatenated into a MariaDB SQL query without sanitization or parameterization, allowing a remote, unauthenticated attacker to inject SQL ...

EUVD-2026-67010

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the idambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...