CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

EUVD-2026-75729

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reportsconfig permission can inject...

GHSA-23RH-XW42-FQ82 Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reportsconfig permission can inject...

SQL Injection

Overview pimcore/pimcore is a content & product management framework CMS/PIM/E-Commerce. Affected versions of this package are vulnerable to SQL Injection via the buildQueryString process. An attacker can execute arbitrary SQL commands and gain unauthorized access to, modify, or delete database...

web-app-pentest-travelbird

Web Application Penetration Test and Remediation: TravelBird A...

WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...

CVE-2026-73698

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...

CVE-2026-73698 FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...

CVE-2026-73698 FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...

EUVD-2026-75600

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...

CVE-2026-73698

FileRun versions prior to 2026.3.0 contain an authenticated SQL injection vulnerability in the Groups Add action. A delegated or simple administrator can submit the description parameter as an array, causing the getValuesString() method in DB/DP.php to interpolate raw array values into an INSERT ...

CVE-2026-81800

Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...

GO-2026-6410 SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel in github.com/siyuan-note/siyuan/kernel

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column queryBlocks: malicious imported package executes SQL on victim kernel in github.com/siyuan-note/siyuan/kernel...

GO-2026-6377 SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock publish mode : reader-reachable raw statement on read-write handle, cross-notebook read/write in github.com/siyuan-note/siyuan/kernel...

GO-2026-6374 SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB in github.com/siyuan-note/siyuan/kernel

SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent publish mode: reader-reachable raw SQL method 2 and unescaped REGEXP method 3 on read-write asset-content DB in github.com/siyuan-note/siyuan/kernel...

GO-2026-6402 SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel

SiYuan: SQL injection in backlink/mention search via unescaped stored and client input publish mode: first-order client keyword and second-order stored document title breakout on read-write handle in github.com/siyuan-note/siyuan/kernel...

GO-2026-6353 SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content in github.com/siyuan-note/siyuan/kernel

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content in github.com/siyuan-note/siyuan/kernel...

CVE-2026-81800 WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...

CVE-2026-81800

CVE-2026-81800 affects the WordPress plugin Verified Reviews (Avis Vérifiés) in versions ≤ 2.4.6 , where an unauthenticated SQL injection vulnerability is present. The flaw allows a remote attacker with no prior access to execute crafted SQL queries, resulting in a high confidentiality impact and...