PT-2026-95154

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists in the admin/sources/maintenance.index.inc.php endpoint where administrator-controlled tablename values are inserted into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements witho...

PT-2026-94272

Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...

CVE-2025-55787

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

PT-2026-95101

Name of the Vulnerable Software and Affected Versions MapServer versions prior to 8.6.4 Description MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and the msPostGISLayerTranslateFilter function fails to verify that input from the CGI qstring or OGC API Features featureId is ...

CVE-2025-55787

A SQL injection vulnerability exists in MailData Email Archiving System v4.2 and earlier . This flaw allows an attacker to execute unauthorized SQL commands, potentially leading to high impact on confidentiality , integrity , and availability . While the vulnerability is confirmed in the provided...

PT-2026-95006

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.88.0 through 0.142.0 Description Authenticated attackers can execute arbitrary SQL queries and retrieve results in HTTP responses. This occurs because the trace-funnel analytics endpoints interpolate the service name and span...

PT-2026-95130

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.87.0 through 0.141.0 Description Authenticated users with a Viewer role or higher can perform SQL injection by providing specially crafted telemetry field-key names. The application fails to properly escape these names in the...

Linux Distros Unpatched Vulnerability : CVE-2026-77874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization...

PT-2026-95049

Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote ' could break out of the literal...

PT-2026-94275

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

CVE-2026-92796

Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtai...

CVE-2026-92788

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete...

CVE-2026-76450

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76451

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76449

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76448

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76425

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...

CVE-2026-76426

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL...

CVE-2026-76428

A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the session database. This vulnerability is due to certain parameters being concatenated directly into SQL clauses without parameterization. An...

CVE-2026-75513

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQL literals without escaping or parameterization. The primary...