CVE-2026-121881: Posit Software, PBC Posit Workbench: SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench…

SQL injection vulnerability in the getlastseen code-server session-state RPC in Posit Software, PBC Posit Workbench before 2026.08.0 allows authenticated users to read arbitrary data from the Workbench database via the sessionIds parameter. NOTE: exploitation requires a valid authenticated sessio...

PT-2026-138058

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.8 Craft CMS versions 5.0.0 through 5.11.1 Description An unauthenticated SQL injection exists in the element search endpoint. This occurs because the attribute parameter is concatenated into the query...

CVE-2026-123489: craftcms cms: Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the…

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123859: Snowflake: When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality…

When identifier escaping is disabled through a non-default configuration, the writepandas data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python Universal Core did not escape DataFrame column names before including them in generated SQL, which coul...

CVE-2026-63774: Subnet Solutions: Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute…

Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands...

CVE-2026-123491: craftcms cms: Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading:…

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply a parenthesized...

CVE-2026-112341: wazuh: Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due…

Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent...

CVE-2025-71458: cern-fts fts-monitoring: FTS3 Web Monitoring (fts-monitoring) versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection…

FTS3 Web Monitoring fts-monitoring versions 3.12.0 through 3.13.2 and 3.14.0 contain an unauthenticated sql injection vulnerability in the /linkinfo endpoint handled by getlinkinfo. Remote attackers can inject SQL through the sourcese and destse query parameters to perform blind injection and rea...

CVE-2026-123488: craftcms cms: Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the…

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and...

CVE-2021-42665

CVE-2021-42665 CVE-2021-42665 - SQL Injection authentication bypass vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal login form which can allow an attacker to bypass authentication. Affected components...

CVE-2019-9053-POC

CMS Made Simple ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explicit permission to test. The author and contributors are not responsible for any misuse or damage caused by this tool. 🎯 What is this? This is a...

CVE-2026-88985

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON pagetoken parameter before constructing list queries. An attacker who can invoke an...

CVE-2026-111492

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive...

CVE-2026-88985 Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON pagetoken parameter before constructing list queries. An attacker who can invoke an...

CVE-2026-88985

Prior to version 2.17.0 , Kubeflow Pipelines is vulnerable to an SQL injection vulnerability in its API server. The application trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter when constructing list queries. An attacker capable of invoking an affe...

CVE-2026-111492

The MatchPoint Android app is vulnerable to SQL injection within its push notification handler. The application processes messages from Firebase Cloud Messaging and insecurely constructs database queries by concatenating untrusted data. An attacker capable of interacting with this component can m...

CVE-2026-33944

Dolibarr ERP/CRM contains a SQL Injection vulnerability in the Third Party (Company) update functionality. The application fails to properly sanitize or cast the localtax1_value and localtax2_value properties (passed via lt1 and lt2 POST parameters), concatenating them directly into an SQL UPDATE...

CVE-2026-33944 Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1value and localtax2value ...

CMS-Made-Simple-2.2.9-CVE-2019-9053

Disclaimer This repository provides a Python 3 compatible exploit targeting an unauthenticated SQL injection vulnerability in CMS Made Simple versions 2.2.9 and earlier. The flaw, tracked as CVE-2019-9053, allows attackers to extract sensitive administrator data, including username, hashed...

CVE-2024-9465

CVE-2024-9465 Checkpoint SQL Injection via Time-Based Attack CVE-2024-9465 SHODAN SEARCH https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA SEARCH https://en.fofa.info/ body="Expedition Project" || title="Expedition Project" USAGE python3...