CVE-2026-80513: Deserialization of Untrusted Data

The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum...

PT-2026-98235

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform affected versions not specified Description A SQL injection issue exists in the ServiceNow AI Platform. This flaw allows an unauthenticated user to execute arbitrary SQL statements against the underlying database,...

PT-2026-97730

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description SQL Injection in DIAEnergie. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Recommendations Update ...

PT-2026-97683

Name of the Vulnerable Software and Affected Versions Forma LMS versions prior to 4.1.44 Description A SQL injection issue exists in the Multi-User-Selector AJAX Endpoint. This occurs when the Name argument is manipulated within the UserselectorAdmController::getDataTask function, located in the...

CVE-2026-13016: Improper Neutralization of Special Elements used in an SQL Command

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modif...

PT-2026-98142

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description An issue exists in the StopWords::add function where user-supplied input is inserted into a SQL INSERT statement using sprintf without proper database escaping. This occurs specifically in the code...

CVE-2026-96777: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.admserver.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql...

CVE-2026-77874: Improper Neutralization of Special Elements used in an SQL Command

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

PT-2026-97838

Name of the Vulnerable Software and Affected Versions IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 IBM Enterprise Build of Quarkus versions 3.33.1 through 3.33.3.SP1 Description An issue exists where a remote unauthenticated attacker can execute SQL injection by sending...

Red Hat: CVE-2026-77874: org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization bypass

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end databa...

CVE-2026-97321: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-96751: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

CVE-2026-61788: Incomplete List of Disallowed Inputs

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting readonly = true on the executesql tool does not make the connection read-only. The connectors are written to set PostgreSQL defaulttransactionreadonly=on and open SQLite in...

CVE-2026-96751 pmTicket Project-Management-Software add_project.php setSync sql injection

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

CVE-2026-96751

A SQL injection vulnerability exists in the pmTicket Project-Management-Software (up to commit 078fa56a782490c5059a0814f84df27984f4d7e2). The flaw is located in the setSync function within the /ajax/add_project.php file, where manipulation of the conn_settings argument allows for remote attack ex...

CVE-2026-96751 pmTicket Project-Management-Software add_project.php setSync sql injection

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/addproject.php. Such manipulation of the argument connsettings leads to sql injection. The attack may be launched remotely. Th...

CVE-2026-96604

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...

CVE-2026-96602

A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-96601

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

CVE-2026-96604 SoftNews Media Group DataLife Engine Search search.php strip_data sql injection

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function stripdata of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit i...