PT-2026-90593

Name of the Vulnerable Software and Affected Versions rtMedia for WordPress, BuddyPress and bbPress versions prior to 4.7.12 Description The plugin is subject to time-based blind SQL Injection, a technique where an attacker asks the database true/false questions and determines the answer based on...

PT-2026-89895

The GamiPress plugin for WordPress is vulnerable to authenticated Subscriber+ SQL Injection via the 'q' parameter of the wpForo integration AJAX selector action gamipress wpforo get posts in versions up to, and including, 7.9.7. The value is passed only through $wpdb-esc like and interpolated...

CVE-2026-18561: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : PHP vulnerabilities (USN-8743-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8743-1 advisory. It was discovered that PHP incorrectly handled backslash escaping in the...

SQL Server Management Studio (September 2026)

The SQL Server Management Studio installation on the remote host is missing a security update. It is, therefore, affected by an other vulnerability: - Improper neutralization of special elements in output used by a downstream component 'injection' in SQL Server allows an unauthorized attacker to...

Microsoft SQL Server (September 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. CVE-2026-77482 - Integer overflow or wraparound ...

Microsoft SQL Server (September 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. CVE-2026-77482 - Integer overflow or wraparound ...

CVE-2026-52630

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37983)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure of the /pages/custedit1.php file to properly validate the ID...

PT-2026-89749

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

PT-2026-89878

CVE-2026-82583 CVSS 8.3 impacts Mirth Connect 4.7.1 and earlier. Authenticated users can execute arbitrary SQL via Database Connector, risking stored credential disclosure. Update if deployed. via NVD Recent High CVSS CyberSecurity InfoSec Vulnerability https://t.co/xBS3E6mUo3...

CVE-2026-82583: Improper Neutralization of Special Elements used in an SQL Command

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37988)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the improper handling of the Username parameter in the /pages/ustransac.p...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37985)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure to properly validate the user ID parameter input in the...

EUVD-2026-75176

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite...

Improper Authentication

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Authentication in the getuserbyoauthsub or getuserbyscimexternalid process. An attacker can gain unauthorized access to another user's account, including administrator accounts, by supplying speciall...

CVE-2026-89089

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089

A SQL injection vulnerability in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_USER ) to exploit the DATE_FORMAT parameter in two shipped JasperReports ("Maintenance contracts expired" and "Maintenance contracts strategy") via the reporting REST API (POST /rest/rep...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...