PT-2026-135697

In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-114364: Apache Software Foundation Apache Syncope: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized...

CVE-2026-120347: dayrui XunRuiCMS: A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit h...

PT-2026-135534

Name of the Vulnerable Software and Affected Versions AWS SDK for pandas awswrangler versions 3.5.2 through 3.17.0 Description Improper neutralization of quoting syntax in SQL identifier construction within the Apache Iceberg write component allows an authenticated remote user with permissions to...

PT-2026-135335

A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit h...

PT-2026-135330

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This produ...

CVE-2026-120062: PostgreSQL psqlODBC: SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping…

SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with th...

PT-2026-135655

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120065: PostgreSQL psqlODBC: For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to…

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-105604: dj-extensions.com DJ-Classifieds extension for Joomla: Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension…

Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated SQL injection vector in the frontend search...

PT-2026-135430

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized...

Palo Alto Expedition CVE-2024-9465 SQLi Detect

Horizon3 check: Checkpoint parser SQL injection via SLEEP10. No session — chain with exploits/multi/http/paloaltoexpeditioncve20249464rce. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Palo Alto Expedition unauthenticated SQLi CVE-2024-9465, Horizon3.""" import time from kittysploit import...

CVE-2026-46531

A flaw was found in Cacti. An authenticated attacker with automation administration privileges can trigger information disclosure by injecting malicious Structured Query Language SQL commands into the automation tree rule item handler. Because these commands are stored and later concatenated...

CVE-2026-62048

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6...

EUVD-2026-114861

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6...

CVE-2026-62048 WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6...

CVE-2026-62048

The Liquid Web / StellarWP BookIt WordPress plugin (versions

CVE-2026-62048 WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6...

CVE-2026-119562

phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped colextra and colattribute values to /database/central-columns. Attackers can inject SQL into pmacentralcolumns INSERT and UPDATE queries run with controluser...

CVE-2025-25964

CVE-2025-25964: SQL Injection in School Information Management System v1.0 Introduction In today's digital landscape, SQL Injection SQLi remains one of the most common and dangerous vulnerabilities found in web applications. This blog post discusses a critical SQL Injection vulnerability...