CVE-2026-17607: Improper Neutralization of Special Elements used in an SQL Command

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...

CVE-2026-93594: Incorrect Authorization

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation o...

NextGen Mirth Connect < 4.7.2 Multiple Vulnerabilities (ICSMA-26-253-01)

According to its self-reported version, the instance of NextGen Mirth Connect running on the remote web server is prior to 4.7.2. It is, therefore, affected by multiple vulnerabilities: - NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL...

PT-2026-95648

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description When pg jobmon is installed and part config.jobmon is set to true, exception handlers in several functions place the p parent table variable verbatim into a SQL string literal used to call the pg...

PT-2026-95642

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.0 Description The POST '/account-pool/page' endpoint allows an authenticated user with MODULE SETTING:UPDATE permissions to inject a crafted sort.name value into a dynamic SQL ORDER BY expression due to a lack o...

CVE-2026-61819: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pgjobmon is installed and partconfig.jobmon is true, exception handlers in multiple pgpartman functions place pparenttable verbatim inside a SQL string literal used to call pgjobmon.addjob. A...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input...

PT-2026-95624

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An unauthenticated user can perform a SQL injection in the Load Balancer Groups component. This occurs through the Load Balancer Servlet endpoint, allowing the injection of SQL statements...

CVE-2026-17576: Improper Neutralization of Special Elements used in an SQL Command

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments...

PT-2026-95393

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-182 Description Authenticated users can extract arbitrary data from the database via a blind SQL injection. This occurs when the check photo parameter is submitted as an array, bypassing the clean requests...

CVE-2026-18442: Improper Neutralization of Special Elements used in an SQL Command

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-95267

Name of the Vulnerable Software and Affected Versions InfiniteWP Client plugin for WordPress versions prior to 1.14.0 Description An issue exists in the get comments action where insufficient escaping of array-key names in the JSON request body allows for SQL Injection. The IWP MMB Comment::get...

PT-2026-95315

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...

PT-2026-95646

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The extension manages partitioned tables by time or ID. The functions run maintenance, show partitions, show partition info, undo partition, and partition data time interpolate the writable part...

CVE-2026-77928: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msgid parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass unsanitize...

CVE-2023-54399: Improper Neutralization of Special Elements used in an SQL Command

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

CVE-2026-84064: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-67100: Improper Neutralization of Special Elements used in an SQL Command

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

CVE-2026-87767: Improper Neutralization of Special Elements used in an SQL Command

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data...