262389 matches found
CVE-2026-53556: Improper Neutralization of Special Elements used in an SQL Command
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...
CVE-2026-54646: Improper Neutralization of Special Elements used in an SQL Command
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
CVE-2026-53557: Improper Neutralization of Special Elements used in an SQL Command
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
CVE-2026-54596: Improper Neutralization of Special Elements used in an SQL Command
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...
CVE-2026-54354: Improper Neutralization of Special Elements used in an SQL Command
MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml type=Integer are configured,...
PT-2026-95139
Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description SQLBot is a Text-to-SQL system utilizing large language models and Retrieval-Augmented Generation RAG. An authenticated user can submit a crafted tableName value within the Excel datasource...
PT-2026-95138
Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An issue exists where the POST /api/v1/datasource/previewData endpoint incorporates the client-controlled table name value into generated SQL without safe identifier handling. An authenticated user ca...
PT-2026-95025
Name of the Vulnerable Software and Affected Versions code-projects Matrimonial System version 1.0 Description A remote SQL injection exists in the /partner preference.php file. The issue occurs within the writepartnerprefs function when the education variable is manipulated, allowing an attacker...
PT-2026-94275
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
PT-2026-95082
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
CVE-2025-55787
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
PT-2026-95065
Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.7.0 Description An authenticated user with the HR User role can perform SQL injection through filters in the Salary Payments Based on Payment Mode report. The issue occurs in the salary payments based on payment...
PT-2026-95104
Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint...
PT-2026-94270
Administrator SQL Injection in WP Maps = 4.9.9 versions...
PT-2026-94271
Name of the Vulnerable Software and Affected Versions Newsletters versions prior to 4.19 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a version newer...
PT-2026-94267
Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...
PT-2026-94274
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
PT-2026-95155
Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists in the ecommerce software where the endpoint 'admin/sources/settings.index.inc.php' directly concatenates the download expire POST parameter into a raw UPDATE statement for CubeCart...
PT-2026-94276
Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 3.1.4 Description An SQL Injection issue exists that allows an administrator to execute malicious SQL queries. SQL Injection is a technique where an attacker inserts malicious SQL code into a query,...