284833 matches found
CVE-2026-66628: Improper Neutralization of Special Elements used in an SQL Command
Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...
CVE-2026-66626: Improper Neutralization of Special Elements used in an SQL Command
Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...
CVE-2026-66630: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in PublishPress Series = 3.1.3 versions...
CVE-2026-93426: Improper Neutralization of Special Elements used in an SQL Command
SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 queryrange API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals,...
CVE-2026-54647: Improper Neutralization of Special Elements used in an SQL Command
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled downloadexpire POST parameter into a raw UPDATE statement for CubeCartdownloads without numeric validation. An authenticated administrator can supply...
CVE-2026-53556: Improper Neutralization of Special Elements used in an SQL Command
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...
CVE-2026-54646: Improper Neutralization of Special Elements used in an SQL Command
CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...
CVE-2026-53557: Improper Neutralization of Special Elements used in an SQL Command
SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...
CVE-2026-54597: Improper Neutralization of Special Elements used in an SQL Command
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...
CVE-2026-54596: Improper Neutralization of Special Elements used in an SQL Command
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...
CVE-2026-54354: Improper Neutralization of Special Elements used in an SQL Command
MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml type=Integer are configured,...
PT-2026-95139
Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description SQLBot is a Text-to-SQL system utilizing large language models and Retrieval-Augmented Generation RAG. An authenticated user can submit a crafted tableName value within the Excel datasource...
PT-2026-95138
Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An issue exists where the POST /api/v1/datasource/previewData endpoint incorporates the client-controlled table name value into generated SQL without safe identifier handling. An authenticated user ca...
PT-2026-95082
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
CVE-2025-55787
In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...
PT-2026-95065
Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.7.0 Description An authenticated user with the HR User role can perform SQL injection through filters in the Salary Payments Based on Payment Mode report. The issue occurs in the salary payments based on payment...
PT-2026-95104
Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint...
PT-2026-94270
Administrator SQL Injection in WP Maps = 4.9.9 versions...
PT-2026-94271
Name of the Vulnerable Software and Affected Versions Newsletters versions prior to 4.19 Description An SQL Injection issue exists in the administrator section, allowing an attacker to interfere with the queries that an application makes to its database. Recommendations Update to a version newer...