PT-2026-94021

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37975)

Sales and Inventory System is a sales and inventory management enterprise resource planning system developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements in the parameter ID with...

VulnCheck KEV: CVE-2022-0412

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the itemid parameter before using it in a SQL statement via the wishlist/removeproduct REST endpoint, allowing unauthenticated attackers to perform SQL...

PT-2026-94026

Name of the Vulnerable Software and Affected Versions Marten versions 7.0.0 through 9.12.0 Description Several paths within the LINQ provider and tenant-management internals interpolate runtime strings into single-quoted SQL literals without proper escaping or parameterization. This allows an...

PT-2026-93994

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to perform a SQL injection attack. This occurs due to insufficient validation of...

PT-2026-94014

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-93970

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue in the SXP REST API allows an authenticated remote attacker to perform SQL injection attacks due to insufficient validation of user-supplied input in REST API calls. A successful...

CVE-2026-92465: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

PT-2026-93976

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An authenticated remote attacker with at least low-privileged administrative credentials can perform SQL injection attacks. This issue stems from improper validation of user-supplied input,...

PT-2026-94133

New CVE published: CVE-2026-71548 Sometimes you don't need to break the syntax, just go with it 🎯 Authenticated SQL injection in SuiteCRM's AOR Reports module High, CVSS 8.8. Any low-privileged user who can save a report could read the whole database, including the admin password hash. Fixed in...

PT-2026-93938

Tanium addressed a SQL injection vulnerability in Threat Response...

PT-2026-93282

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37976)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements in the parameter named...

PT-2026-93935

Tanium addressed a SQL injection vulnerability in Asset...

PT-2026-93874

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/btn functions.php?action=add. Performing a manipulation of the argument difficulty id results in sql injection. Remote...

PT-2026-94015

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-93786

Name of the Vulnerable Software and Affected Versions code-projects Matrimonial System version 1.0 Description An SQL injection issue exists in the Regular Search component within the '/search.php' endpoint. A remote attacker can exploit this by manipulating the sex, mothertongue, maritialstatus,...

PT-2026-93934

Tanium addressed a SQL injection vulnerability in Asset...

PT-2026-93261

Name of the Vulnerable Software and Affected Versions gedelumbung HospitalManagement versions up to c2d45543789a3887067d3915f69d44cfc2cf76a8 Description A remote SQL injection is possible through the manipulation of the cari argument within the generate index pasien function located in the...

ALSA-2026:67848 Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector an...