CVE-2026-120065 psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065 psqlODBC does not escape a server-supplied column name in its updatable-cursor queries

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065

Versions of psqlODBC before 18.00.0006 are vulnerable to SQL injection due to improper handling of server-supplied column names in updatable cursors. When a table lacks OIDs but has an auto-increment int4 column, the driver uses that column for row identification. It places the column name betwee...

EUVD-2026-115378

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120062 psqlODBC SQL injection through SQLSpecialColumns table and schema names

SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with th...

CVE-2026-120062 psqlODBC SQL injection through SQLSpecialColumns table and schema names

SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with th...

CVE-2026-120062

The psqlODBC driver is vulnerable to SQL injection in versions prior to 18.00.0006 . The SQLSpecialColumns function fails to escape table and schema names when splicing them into catalog queries, unlike other catalog functions. This allows an attacker providing untrusted names to execute arbitrar...

teler

!IMPORTANT Dear users, We wanted to share some important updates regarding the development of teler IDS. 🛑 The development of teler IDS is currently on hold. However, we're thrilled to inform you that we've decided to take a bold step by embarking on a complete refactor, starting from scratch to...

EUVD-2026-115359

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search...

CVE-2026-105604

The Joomla extension DJ-Classifieds (versions prior to 3.11.3 ) is vulnerable to an unauthenticated SQL injection via the frontend search functionality. This vulnerability allows an attacker to execute arbitrary SQL commands, potentially impacting the confidentiality, integrity, and availability ...

CVE-2026-105604 Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search...

CVE-2026-105604 Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search...

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements for example DROP TABLE, which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root caus...

GHSA-J656-3HF2-FVJC DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements for example DROP TABLE, which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root caus...

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas also published as awswrangler 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any tab...

EUVD-2026-115329

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas also published as awswrangler 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any tab...

CVE-2026-77881

Control Web Panel CWP before webpanelversion 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...

CVE-2026-77879

Control Web Panel CWP before webpanelversion 1.16 contains a SQL injection vulnerability in the loopback API authentication gate accesstoken, which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorizationcode...

sqliv

SQLiv Massive SQL injection scanner Features 1. multiple domain scanning with SQL injection dork by Bing, Google, or Yahoo 2. targetted scanning by providing specific domain with crawling 3. reverse domain scanning both SQLi scanning and domain info checking are done in multiprocessing so the...

EUVD-2026-115248

Control Web Panel CWP before webpanelversion 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauthclients table. Attackers can send crafted...