PT-2026-133443

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks. This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67...

CVE-2026-61789: bytebase dbhub: DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to 0.22.6, read-only SQL validation can be bypassed on the MySQL and MariaDB connectors. In src/utils/sql-parser.ts, scanSingleLineComment treats every double dash as a comment start, whereas MySQL and...

CVE-2026-119418: cakephp: CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying…

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range and frame. Attackers can pass crafted values through applications forwarding user input into the OVER clause to execut...

CVE-2026-119562: phpMyAdmin: phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by…

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

CVE-2026-111503: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an…

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

PT-2026-133500

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col extra and col attribute values to /database/central-columns. Attackers can inject SQL into pma central columns INSERT and UPDATE queries run with controluser...

PT-2026-133306

This issue affects Apache Fineract versions up to and including 1.15.0. The Center read endpoint GET /api/v1/centers and the datatable entry read endpoints GET /api/v1/datatables/datatable/apptableId and GET /api/v1/datatables/datatable/apptableId/datatableId concatenate caller-supplied ordering...

Arista VeloCloud Orchestrator SQL Injection Vulnerability (SA0199)

The version of Arista VeloCloud Orchestrator running on the remote device is affected by a SQL injection vulnerability as referenced in security advisory SA0199. - A SQL injection vulnerability exists in Arista VeloCloud Orchestrator. A remote attacker could access privileged internal functionali...

PT-2026-134235

Name of the Vulnerable Software and Affected Versions OpenRemote versions prior to 1.26.0 Description The datapoint export API constructs SQL for CSV crosstab by concatenating an asset name and attribute name into a COPY query. Because escaping single quotes does not protect double-quoted...

CVE-2026-118698: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

[SECURITY] [DSA 6596-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6596-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 29, 2026 https://www.debian.org/security/faq -...

CVE-2026-6183-SQLI

SQL Injection via id Parameter in index.php - Simple Content Management System in PHP Description A SQL Injection vulnerability exists in Simple Content Management System PHP. The id parameter in index.php is not sanitized before being passed to the SQL query, allowing an unauthenticated attacker...

SQL-e-XSS-em-APIs

Laboratório Prático: Testes contra Injeção de SQL e XSS em API...

AWE

AWE: Adaptive Agents for Dynamic Web Penetration Testing Akshat Singh Jaswal · Ashish Baghel Accepted at NDSS LAST-X 2026 Abstract Modern web applications are increasingly produced through AI-assisted development and rapid no-code deployment pipelines, widening the gap between accelerating softwa...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: SQL Injection CWE: CWE-89 Affected Endpoint: /admin/jobs-admins/delete-jobs.php Parameter: id GET Impact: Allows deletion of all job records in th...

CVE-2026-11587

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database...

CVE-2026-25554

OpenSIPS versions 3.1 before 3.6.4 containing the authjwt module prior to commit 3822d33 contain a SQL injection vulnerability in the jwtdbauthorize function in modules/authjwt/authorize.c when dbmode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT...

WordPress JoomSport – for Sports: Team & League, Football, Hockey & more plugin <= 5.7.14 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin JoomSport versions = 5.7.14...

MCPwn

MCPwn — Offensive Security Framework for AI Agent Protocols...

CVE-2026-11587 Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database...