EUVD-2026-125596

NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents,...

CVE-2026-129171

The NginxPulse monitoring tool (versions prior to 1.6.26 ) is vulnerable to an unauthenticated SQL injection via the /api/stats/:type endpoint. The root cause is the improper handling of the id and locationType parameters, which allows remote attackers to append SQL commands. Impact includes the ...