SQL Injection

CakePHP is vulnerable to SQL Injection. The vulnerability is due to insufficient validation and escaping of user-controlled dataType, part, and unit values used in generated SQL statements, which allows an attacker to inject malicious SQL queries and potentially access, modify, or delete database...

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

EUVD-2026-82656

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

CVE-2026-18912

ManageEngine DataSecurity Plus versions prior to 6310 are affected by an authenticated SQL injection vulnerability in the Reports module . An attacker with technician-level credentials can execute arbitrary SQL queries, leading to high confidentiality impact (data exfiltration) with a changed sco...

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

CVE-2025-69295

CVE-2025-69295 — TeconceTheme Coven Core Blind SQL Injection Vulnerability CVE-2025-69295 is a SQL Injection vulnerability affecting the Coven Core component of the TeconceTheme Coven Core WordPress theme. The vulnerability exists due to improper neutralization of user-supplied input before it is...

PT-2026-95394

Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-182 Description Authenticated users can extract arbitrary database contents, including user credential hashes and email addresses, through a time-based blind SQL injection. This occurs when the msg id paramet...

PT-2026-95645

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The create partition time function reads the time encoder value from the part config table and interpolates it into a dynamically executed SELECT statement without proper identifier quoting. A use...

PT-2026-95370

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.3 Description An SQL injection issue exists in the query2Stmt function within graph.go. The flaw occurs because tag values are concatenated directly into SQL string literals without escaping single quotes. A...

PT-2026-95642

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.0 Description The POST '/account-pool/page' endpoint allows an authenticated user with MODULE SETTING:UPDATE permissions to inject a crafted sort.name value into a dynamic SQL ORDER BY expression due to a lack o...

PT-2026-95628

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description The Analytic Grid Service Handler contains a SQL injection flaw. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, which may lead to...

PT-2026-95598

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

PT-2026-95625

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An issue exists in the New Query Builder REST Processor where a low-privileged authenticated user can perform a SQL injection. This occurs via the 'newQueryBuilder' REST endpoint, allowing...

PT-2026-95693

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A remote authenticated attacker can obtain sensitive information due to improper neutralization of special elements used in an SQL command, which leads to an SQL injection. SQL injection is...

CVE-2026-84239: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command...

CVE-2026-81626: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-61781: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, createpartitiontime reads the writable partconfig.timeencoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with the documented...

CVE-2026-81656: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the New Query Builder REST Processor. A low-privileged authenticated user can inject SQL statements through the newQueryBuilder REST endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-93591: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGrap...

PT-2026-95287

Name of the Vulnerable Software and Affected Versions WP Multi Store Locator Pro versions prior to 4.5.2 Description An issue exists where unauthenticated attackers can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs...