PT-2026-95230

Name of the Vulnerable Software and Affected Versions ManageEngine DataSecurity Plus versions prior to 6310 Description An authenticated technician can execute arbitrary SQL queries through the Reports module. This is caused by a SQL injection, which occurs when untrusted data is inserted into a...

PT-2026-95370

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.3 Description An SQL injection issue exists in the query2Stmt function within graph.go. The flaw occurs because tag values are concatenated directly into SQL string literals without escaping single quotes. A...

PT-2026-95242

Name of the Vulnerable Software and Affected Versions wp shortcut link and advertisement baner WordPress plugin versions prior to 1.2.1 Description An issue exists where a parameter is not sanitized or escaped before being used in a SQL query within an AJAX action accessible to unauthenticated...

CVE-2026-87770: Improper Neutralization of Special Elements used in an SQL Command

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

PT-2026-95290

Name of the Vulnerable Software and Affected Versions WP Inventory Manager versions prior to 2.5.2 Description Authenticated attackers with Contributor-level access and above can perform SQL Injection through the where shortcode attribute of the wpinventory shortcode. The issue occurs in the...

PT-2026-95295

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2026-95598

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

ColdFusion SQL Injection Code Execution

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Cisco Nexus Dashboard Software Security Hardening Release: September 2026 (cisco-sa-hardening-ndw1-psFvnrg)

According to its self-reported version, Cisco Nexus Dashboard is affected by multiple vulnerabilities. - An improper access control vulnerability affecting authorization, authentication, privileges, and bypasses. CVE-2026-20322 - An improper neutralization of special elements used in a command...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input...

NextGen Mirth Connect < 4.7.2 Multiple Vulnerabilities (ICSMA-26-253-01)

According to its self-reported version, the instance of NextGen Mirth Connect running on the remote web server is prior to 4.7.2. It is, therefore, affected by multiple vulnerabilities: - NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-multi-hrP9jQSQ)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation o...

PT-2026-95645

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The create partition time function reads the time encoder value from the part config table and interpolates it into a dynamically executed SELECT statement without proper identifier quoting. A use...

PT-2026-95649

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The inherit template properties function manually surrounds primary-key column names from pg attribute.attname with double quotes without escaping embedded double-quote characters. A user with...

PT-2026-95291

Name of the Vulnerable Software and Affected Versions WCFM Marketplace versions prior to 3.8.2 Description The WCFM Marketplace plugin for WordPress is subject to SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs because the...

PT-2026-95599

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

PT-2026-95597

Name of the Vulnerable Software and Affected Versions Weaver E-cology affected versions not specified Description An unauthenticated SQL injection allows remote attackers to execute arbitrary SQL queries. This occurs when malicious input is submitted through the userIdentifiers GET parameter in t...

PT-2026-95617

Name of the Vulnerable Software and Affected Versions IBM Platform RTM affected versions not specified Description An issue exists where a remote attacker can execute specially crafted SQL statements. This allows the attacker to view, add, modify, or delete information within the back-end databas...

PT-2026-95394

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-182 Description Authenticated users can extract arbitrary database contents, including user credential hashes and email addresses, through a time-based blind SQL injection. This occurs when the msg id paramet...

PT-2026-95267

Name of the Vulnerable Software and Affected Versions InfiniteWP Client plugin for WordPress versions prior to 1.14.0 Description An issue exists in the get comments action where insufficient escaping of array-key names in the JSON request body allows for SQL Injection. The IWP MMB Comment::get...