Ivanti Endpoint Manager Code Execution

The vulnerability of the Ivanti Endpoint Manager software control console relates to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-91222

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or...

VulnCheck KEV: CVE-2026-76461

Cisco AsyncOS software for Cisco Secure Email Gateway SEG contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system...

VulnCheck KEV: CVE-2022-32026

Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/managebooking.php?id=...

VulnCheck KEV: CVE-2022-32024

Car Rental Management System v1.0 is vulnerable to SQL Injection via car-rental-management-system/booking.php?carid=...

VulnCheck KEV: CVE-2022-32028

Car Rental Management System v1.0 is vulnerable to SQL Injection via /car-rental-management-system/admin/manageuser.php?id=...

PT-2026-91196

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...

VulnCheck KEV: CVE-2018-10735

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter...

ALSA-2026:67280 Important: postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

CVE-2026-55416: Improper Neutralization of Special Elements used in an SQL Command

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reportsconfig permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by...

CVE-2026-82232: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apach...

CVE-2026-82028: Improper Neutralization of Special Elements used in an SQL Command

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-76461: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. This vulnerability is due to insufficient validation in the email...

PT-2026-91270

Name of the Vulnerable Software and Affected Versions Cisco Secure Email Gateway versions prior to 15.5.5-014 Cisco Secure Email Gateway versions 16.0 through 16.0.4-301 Cisco Secure Email Gateway versions 16.5 through 16.5.0-779 Description An issue exists in the email parsing logic of Cisco...

CVE-2026-55072: Improper Input Validation

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can submit a malicious ClassDefinition UID because the name and ID validation expressions in models/DataObject/ClassDefinition.php validate only the beginning of...

Cisco Secure Email Gateway SQL Injection Vulnerability

Cisco AsyncOS software for Cisco Secure Email Gateway SEG contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system...

CVE-2026-90805: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely...

CVE-2026-15600: Improper Neutralization of Special Elements used in an SQL Command

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or...

PT-2026-91286

Name of the Vulnerable Software and Affected Versions subhajitkhan online-clinic-management-system versions up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 Description A remote SQL injection flaw exists in the doctorlogin.php file. This issue occurs when the doc mail and doc pswd arguments are...

PT-2026-91123

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro edit1.php. Such manipulation of the argument prodcode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed...