CVE-2026-92221: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

PT-2026-93282

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

CVE-2026-75513: Improper Neutralization of Special Elements used in an SQL Command

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary...

CVE-2026-76425: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...

PT-2026-93269

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5 Description The plugin is susceptible to blind SQL Injection, a technique that allows an attacker to infer data from a database by observing the application's response to specific queries. The issue...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37977)

Sales and Inventory System is a sales and inventory management enterprise resource planning system developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external input SQL statements in the parameter I...

PT-2026-94015

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-93786

Name of the Vulnerable Software and Affected Versions code-projects Matrimonial System version 1.0 Description An SQL injection issue exists in the Regular Search component within the '/search.php' endpoint. A remote attacker can exploit this by manipulating the sex, mothertongue, maritialstatus,...

CVE-2026-20247: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected...

PT-2026-93286

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37975)

Sales and Inventory System is a sales and inventory management enterprise resource planning system developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements in the parameter ID with...

PT-2026-93964

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks on an affected device due to improper validation of user-supplied input. By sending a crafted request, an attacker could...

PT-2026-94026

Name of the Vulnerable Software and Affected Versions Marten versions 7.0.0 through 9.12.0 Description Several paths within the LINQ provider and tenant-management internals interpolate runtime strings into single-quoted SQL literals without proper escaping or parameterization. This allows an...

PT-2026-94133

New CVE published: CVE-2026-71548 Sometimes you don't need to break the syntax, just go with it 🎯 Authenticated SQL injection in SuiteCRM's AOR Reports module High, CVSS 8.8. Any low-privileged user who can save a report could read the whole database, including the admin password hash. Fixed in...

PT-2026-93845

Name of the Vulnerable Software and Affected Versions MikroORM versions prior to 6.6.16 MikroORM versions prior to 7.1.7 Description The shared SQL layer validates the field key of an orderBy clause but fails to validate its direction value before the AbstractSqlPlatform.getOrderByExpression...

PT-2026-93869

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been...

PT-2026-93934

Tanium addressed a SQL injection vulnerability in Asset...

CVE-2026-20361: Improper Neutralization of Special Elements used in an SQL Command

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

PT-2026-93938

Tanium addressed a SQL injection vulnerability in Threat Response...

PT-2026-93970

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue in the SXP REST API allows an authenticated remote attacker to perform SQL injection attacks due to insufficient validation of user-supplied input in REST API calls. A successful...