PT-2026-103704

The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-102379: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...

CVE-2026-103338: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

PT-2026-103881

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62060: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2...

CVE-2026-103690: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

CVE-2026-56097: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...

CVE-2026-103543: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/leavetype/controller.php. Such manipulation of the argument LEAVTID leads to sql injection. The attack can be launched remotely. The exploit has been disclos...

POMS PHP 1.0 SQL Injection

The password parameter in POMS PHP By Oretnom23 version 1.0 suffers from a remote SQL injection vulnerability. https://packetstorm.news/download/233756...

ROS-20261001-73-0055

The vulnerability of the management server’s software for collaborative work, SOGo, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data and affect the integrity of the data...

The vulnerability of the `StopWords::add()` method in the phpMyFAQ web application’s file `phpMyFAQ/src/phpMyFAQ/StopWords.php` allows a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the StopWords::add method in the phpMyFAQ web application’s file phpMyFAQ/src/phpMyFAQ/StopWords.php relates to the lack of measures taken to protect the SQL query structure when processing the word parameter. Exploiting this vulnerability allows an attacker to compromise the...

Rocky Linux 9 [CIQ] Security Update: apcu-panel / php / php-bcmath / php-bcmath-debuginfo / php-cli / etc Multiple Vulnerabilities (crlsa-2026_61903)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202661903 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives...

Rocky Linux 8 [CIQ] Security Update: python-nose-docs / python3-PyMySQL / python3-docs / etc Multiple Vulnerabilities (crlsa-2019_0984)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20190984 advisory. python-sqlalchemy: SQL Injection when the orderby parameter can be controlled CVE-2019-7164 python-sqlalchemy: SQL Injection when the groupby parameter can...

Rocky Linux 9 [CIQ] Security Update: postgresql-jdbc (crlsa-2024_1436)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20241436 advisory. PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE CVE-2024-1597 Tenable has extracted the preceding description block directly fr...

Rocky Linux 10.2 [CIQ] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (crlsa-2026_43505)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202643505 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted...

Rocky Linux 8 [CIQ] Security Update: apcu-panel / libzip / libzip-debuginfo / libzip-debugsource / etc Multiple Vulnerabilities (crlsa-2026_62334)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202662334 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives...

PT-2026-103850

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

PT-2026-103843

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...

PT-2026-103858

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2...

PT-2026-103914

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...