CVE-2026-72708: Improper Neutralization of Special Elements used in an SQL Command

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

CVE-2026-15462: Improper Neutralization of Special Elements used in an SQL Command

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

PT-2026-90493

Name of the Vulnerable Software and Affected Versions Woltlab WCF versions prior to 6.2.5 Description A remote attacker can perform a SQL Injection, which is a technique that allows an attacker to interfere with the queries that an application makes to its database. This issue occurs within the...

PT-2026-89911

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.18 Description An unauthenticated blind SQL injection exists in the SQL escaping layer. This issue allows attackers to inject arbitrary SQL by providing a crafted annee parameter value consisting of a word character...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37984)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure of the /pages/prosearchfrm.php file to properly validate the...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37989)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the improper validation of the companyname parameter in the /pages/suptransac.php file...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37986)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the failure to properly validate the ID parameter in the /pages/settings Edit.php...

VulnCheck KEV: CVE-2017-8917

SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors...

VulnCheck KEV: CVE-2018-18084

An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter...

IDORacle: Template-Guided SQL-Sink Mediation for Object-Level Authorization in Java Applications

Insecure Direct Object Reference IDOR, often modeled as Broken Object-Level Authorization BOLA, remains prevalent in Java database applications because identity and authorization checks at the controller or service layer are disconnected from SQL execution based on resource identifiers. Existing...

PT-2026-90024

Editor SQL Injection in Sky Addons for Elementor = 3.8.4 versions...

CVE-2026-52630

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37987)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper filtering of the ID parameter in the /pages/emp Edit1.php...

CVE-2026-15439: Improper Neutralization of Special Elements used in an SQL Command

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipresswpforogetposts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esclike and interpolated directl...

PT-2026-90593

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.12 Description The plugin is subject to time-based blind SQL Injection, a technique where an attacker asks the database true/false questions and determines the answer based on...

PT-2026-89895

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipress wpforo get posts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esc like and interpolated...

CVE-2026-18561: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : PHP vulnerabilities (USN-8743-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8743-1 advisory. It was discovered that PHP incorrectly handled backslash escaping in the...

SQL Server Management Studio (September 2026)

The SQL Server Management Studio installation on the remote host is missing a security update. It is, therefore, affected by an other vulnerability: - Improper neutralization of special elements in output used by a downstream component 'injection' in SQL Server allows an unauthorized attacker to...

Microsoft SQL Server (September 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. CVE-2026-77482 - Integer overflow or wraparound ...