CVE-2026-94491: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...

Security Bulletin: NVIDIA Infrastructure Controller - September 2026

NVIDIA has released a software update for NVIDIA® Infrastructure Controller. To protect your system, clone or update this software to version 2.0 or later from NVIDIA/infra-controller on GitHub. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities th...

PT-2026-96730

Name of the Vulnerable Software and Affected Versions KarelIPS versions prior to 22092026 Description An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true o...

CVE-2026-88414

Versions 6.1.1 through 6.2.1 of MCMS are affected by a SQL injection vulnerability located in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). The vulnerability allows for unauthorized interaction with the backend database. While the technical impact is rated as critical with high sc...

CVE-2026-88414

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...

PT-2026-96327

Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description A weakness in the /cardcase/search list.jsp file allows for remote SQL injection. This occurs when the address argument is manipulated, enabling an attacker to execute unauthorized database queries...

PT-2026-96908

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...

PT-2026-96328

Name of the Vulnerable Software and Affected Versions Yonyou U8cloud versions 5.x Description A SQL injection issue exists within the OpenAPI component. A remote attacker can exploit this by manipulating the operator argument in the '/u8cloud/openapi/so.saleorder.sendaudit' endpoint. SQL injectio...

CVE-2026-94492: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...

PT-2026-96983

Name of the Vulnerable Software and Affected Versions Adobe Connect versions prior to 12.12 Description Adobe Connect contains an SQL Injection flaw, which occurs when special elements used in an SQL command are not properly neutralized. This allows a low-privileged attacker to execute arbitrary...

CVE-2026-82009: Improper Neutralization of Special Elements used in an SQL Command

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...

PT-2026-96909

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

PT-2026-96961

Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description SQL injection occurs in the 'PageAction.verify' endpoint GET '/ms/mdiy/page/verify.do'. SQL injection is a type of vulnerability that allows an attacker to interfere with the queries that an...

CVE-2026-65128: Improper Neutralization of Special Elements used in an SQL Command

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

PT-2026-97106

Name of the Vulnerable Software and Affected Versions anirbandutta9 College-Notes-Gallery versions up to 8c1cf3d98f30982d069c88ca172612c001eb39f6 Description A remote SQL injection exists in the login.php file. This issue occurs when the user and pass arguments are manipulated, allowing an attack...

PT-2026-97117

Name of the Vulnerable Software and Affected Versions itsourcecode Leave Management System version 1.0 Description A remote SQL injection exists in the /module/leavetype/index.php endpoint. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL command...

PT-2026-97115

Name of the Vulnerable Software and Affected Versions TDuckCloud tduck-platform versions prior to 5.4 Description Remote SQL injection is possible through the manipulation of the orders0.column argument within the PaginationInnerInterceptor.concatOrderBy function, located in the...

PT-2026-96751

Name of the Vulnerable Software and Affected Versions NVIDIA Infrastructure Controller for Linux affected versions not specified Description An issue exists that allows an attacker to perform SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. A...

CVE-2026-88414: Improper Neutralization of Special Elements used in an SQL Command

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...

PT-2026-96695

Name of the Vulnerable Software and Affected Versions DevItems HashBar – WordPress Notification Bar versions prior to 2.0.4 Description An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an...