PT-2026-94368

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 4.5.12 CakePHP versions prior to 4.6.5 CakePHP versions prior to 5.1.9 CakePHP versions prior to 5.2.14 CakePHP versions prior to 5.3.7 Description Certain methods in src/Database/FunctionsBuilder.php allow...

PT-2026-94272

Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...

PT-2026-95104

Name of the Vulnerable Software and Affected Versions ITFlow versions prior to 26.07 Description An authenticated user with Technician privileges or higher who has access to at least one client invoice can perform SQL injection. The issue occurs at the 'agent/post/recurring invoice.php' endpoint...

PT-2026-94273

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

CVE-2026-52851: Improper Neutralization of Special Elements used in an SQL Command

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. PermissionLinkedHashMap in...

CVE-2026-66626: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in SKT Addons for Elementor = 4.0 versions...

CVE-2026-54354: Improper Neutralization of Special Elements used in an SQL Command

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gml type=Integer are configured,...

PT-2026-94277

Administrator SQL Injection in MC Woocommerce Wishlist = 1.9.21 versions...

PT-2026-95049

Several code paths in Marten's LINQ provider and tenant-management internals interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted string literal without escaping or parameterization. A value containing a single quote ' could break out of the literal...

CVE-2025-55787

A SQL injection vulnerability exists in MailData Email Archiving System v4.2 and earlier . This flaw allows an attacker to execute unauthorized SQL commands, potentially leading to high impact on confidentiality , integrity , and availability . While the vulnerability is confirmed in the provided...

EUVD-2025-210930

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

CVE-2026-66628: Improper Neutralization of Special Elements used in an SQL Command

Shop manager SQL Injection in WP-Lister Lite for eBay = 3.8.11 versions...

CVE-2026-53557: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-92903: Improper Neutralization of Special Elements used in an SQL Command

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can...

PT-2026-95139

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description SQLBot is a Text-to-SQL system utilizing large language models and Retrieval-Augmented Generation RAG. An authenticated user can submit a crafted tableName value within the Excel datasource...

CVE-2026-66580: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in Product Feed Manager = 7.12.0 versions...

CVE-2026-76450

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76449

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76448

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76425

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...