phpMyAdmin -- Multiple vulnerabilities, no fix available

VulnCheck reports: Seven vulnerabilities in phpMyAdmin up to and including 5.2.3 were published on 2026-10-30. The most severe of them, an authentication bypass, is in the WebAuthn second factor: assertion signatures are never verified against the stored public keys, so an attacker who already ha...

PT-2026-133471

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 5.4.3 Description An issue exists where attackers can execute SQL commands with the privileges of the database connection. This occurs when applications forward unvalidated user input into the OVER clause, specificall...

PT-2026-133585

CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated order parameter appended to ORDER BY. Attackers can inject subqueries that bypass SqlSugar's field check and use boolean-based or time-based blind technique...

PT-2026-133701

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'columns array keys' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-65874: Apache Software Foundation Apache Fineract: This issue affects Apache Fineract versions up to and including 1.15.0

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

CVE-2026-61620: seancorfield honeysql: HoneySQL turns Clojure data structures into SQL

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL DSL by calling keyword or symbol on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a JDBC driver. So...

PT-2026-133315

Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.16.1 Description An SQL injection issue exists due to insufficient neutralization of special elements used in SQL commands. The flaw affects the /fineract-provider/api/v1/search/advance API endpoint via the...

CVE-2026-63224: openremote: OpenRemote is an open-source internet-of-things platform

OpenRemote is an open-source internet-of-things platform. Prior to 1.26.0, the datapoint export API constructs CSV crosstab SQL by concatenating an asset name and attribute name into a COPY query that uses crosstab and streams TO STDOUT. The asset name enters both a double-quoted column identifie...

CVE-2026-64618: Apache Software Foundation Apache Fineract: Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache…

Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" vulnerability exists in Apache Fineract through version 1.15.0. The vulnerability affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint, allowi...

CVE-2026-62849: mqttsnet thinglinks: ThingLinks is an enterprise IoT platform

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the TDengine TDS APIs allows request-controlled JSON field values submitted to /anyUser/tds/insertTableData to reach unsafe SQL construction in the TDS mapper. A remote unauthenticated...

CVE-2026-117572: Unknown WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter…

The WP Visitor Statistics Real Time Traffic WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks...

CVE-2025-68393: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67...

CVE-2025-68394: ARKETEAM: ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67...

PT-2026-133472

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation can append SQL after the...

PT-2026-133586

CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts an...

WordPress Transliterator SQL injection vulnerability

WordPress Transliterator versions 2.5.13 and earlier contain an SQL injection vulnerability. This vulnerability arises from insufficient sanitization of special elements, allowing unauthenticated attackers to exploit it...

PT-2026-133776

Name of the Vulnerable Software and Affected Versions Transliterator versions 2.5.13 and earlier Description An unauthenticated attacker can perform a SQL Injection, which allows the execution of arbitrary SQL queries to read or modify the site database. This issue occurs within a CMS plugin...

CVE-2026-39732: Ivijan-Stefan Stipic Transliterator: Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

Unauthenticated SQL Injection in Transliterator = 2.5.13 versions...

PT-2026-134204

Name of the Vulnerable Software and Affected Versions ThingLinks versions prior to 1.4.0 Description An unauthenticated SQL injection exists in the TDengine TDS APIs where request-controlled JSON field values submitted to the '/anyUser/tds/insertTableData' endpoint reach unsafe SQL construction...

PT-2026-133513

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...