WsgiDAV MySQL provider has a blind SQL injection

SummaryThe sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

PYSEC-2026-3945 WsgiDAV MySQL provider has a blind SQL injection

Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...

PYSEC-2026-3921 Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request...

SQL Injection

Apache Hive is vulnerable to SQL Injection. The vulnerability is due to unsanitized partition names being concatenated into direct SQL queries, allowing an authenticated user to alter partition lookups and read, modify, truncate, or affect unintended partition metadata...

CVE-2026-7188

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

CVE-2026-7188

Armiya Information Technologies Ltd. Co. Access Control System versions before Version 2 are affected by an SQL injection vulnerability caused by improper neutralization of special elements used in an SQL command. The vulnerability is rated CRITICAL (CVSS 9.8) with a network attack vector, low co...

EUVD-2026-75293

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

CVE-2026-7188 SQLi in Armiya Information Technologies' Access Control System

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

CVE-2026-7188 SQLi in Armiya Information Technologies' Access Control System

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

WordPress Quentn WP plugin 1.2.13-1.2.14 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Quentn WP versions 1.2.13-1.2.14...

Exploit for SQL Injection in Wordpress

wp2shell Lab — CVE-2026-60137 & CVE-2026-63030 WordPress Core...

Exploit for SQL Injection in Osgeo Geoserver

Lab CVE-2023-25157 va CVE-2023-25158 Lab nay dung GeoServer/P...

WordPress ELEX WooCommerce Request a Quote plugin < 2.4.1 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Artus KG in WordPress Plugin ELEX WooCommerce Request a Quote versions 2.4.1...

EUVD-2026-75219

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...

EUVD-2026-75182

A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the function updaterecord of the file includes/manage.php. The manipulation of the argument updatecategory/cid/updatebrand/updateproduct leads to sql injection. The...

CVE-2026-87925

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...

CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...

CVE-2026-73698: Improper Neutralization of Special Elements used in an SQL Command

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...

CVE-2026-87925: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument proname results in sql injection. The...