CVE-2026-120441 OwnTone Server through 29.3 SQL Injection via MPD sticker find Command

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

EUVD-2026-115201

OwnTone Server through 29.3 contains an sql injection vulnerability in mpdstickerfind in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listener on TCP port 6600 to bypass path...

CVE-2026-74993

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

CVE-2026-114364

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized...

CVE-2026-74993

The Starnet Computer and Network Systems Inventory Tracking Application contains an SQL injection vulnerability due to the improper neutralization of special elements used in an SQL command. This flaw allows an attacker to perform SQL injection attacks against the application. The vulnerability a...

CVE-2026-74993 SQL Injection in Starnet Computer Systems' Inventory Tracking Application

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

CVE-2026-74993 SQL Injection in Starnet Computer Systems' Inventory Tracking Application

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

EUVD-2026-115183

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16...

EUVD-2026-115155

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized...

CVE-2026-114364

Apache Syncope is vulnerable to SQL injection (CWE-89) due to an incomplete fix for CVE-2026-77051. The root cause is the lack of proper sanitization of opEvent parameters within the Audit Events search functionality. An administrator with adequate entitlements can leverage these unsanitized para...

CVE-2026-114364 Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized...

Exploit for Interpretation Conflict in Wordpress

Full Reproducibility Report for CVE-2026-63030 & CVE-2026-6013...

CVE-2026-2613

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

CVE-2026-118871

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...

EUVD-2026-115116

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

CVE-2026-2613 SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

CVE-2026-2613

Multiple WSO2 products are affected by a blind SQL injection vulnerability in the Admin REST API . The root cause is the lack of adequate sanitization for user-supplied input, which allows it to be included in the structure of SQL statements. An attacker with administrator privileges can exploit ...

CVE-2026-2613 SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer...

EUVD-2026-115113

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...

CVE-2026-118871 SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product

SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in...