CVE-2026-89089: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

PT-2026-89680

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reports config permission can inject...

PT-2026-89734

Security Advisory: SQL Injection in Custom Reports via Malicious Report Configuration Summary Impact A SQL injection vulnerability exists in the Custom Reports bundle bundles/CustomReportsBundle/src/Tool/Adapter/Sql.php:84-135. An authenticated attacker with reports config permission can inject...

CVE-2026-7188: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection due to the improper neutralization of special elements used in an SQL command. The flaw is located within the src/Modules/Items/Repositories/ItemsRepository.php file. This vulnerability allows for unauthorized access to or manipulation of the under...

CVE-2026-9163: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in GIS Informatics GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...

VulnCheck KEV: CVE-2022-1057

The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection...

CVE-2026-78082: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, pricerangedropdown, and psizerangedropdown by directly...

PT-2026-89748

Name of the Vulnerable Software and Affected Versions Sticky Chat Widget versions prior to 1.4.3 Description Unauthenticated attackers can perform SQL Injection through the scw form fields parameter array keys within the scw save form data AJAX action. The issue occurs because the save form data...

CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...

PT-2026-89411

Name of the Vulnerable Software and Affected Versions Garlic-Hub version 1.0.1 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, within the file src/Modules/Items/Repositories/ItemsRepository.php...

PT-2026-89300

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

VulnCheck KEV: CVE-2026-18884

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

VulnCheck KEV: CVE-2026-42031

CKAN is an open-source DMS data management system for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastoresearchsql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information This vulnerability is fixed ...

PT-2026-89443

Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...

PT-2026-89498

FileRun before 2026.3.0 contains a SQL injection vulnerability that allows delegated or simple administrators to execute arbitrary SQL by submitting the description parameter as an array, causing the getValuesString method in DB/DP.php to interpolate raw array values directly into an INSERT...

CVE-2026-88890: Improper Neutralization of Special Elements used in an SQL Command

OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile. filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inje...

CVE-2026-81800: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...

PT-2026-89588

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLE USER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

PT-2026-89348

Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property 4.1.4 - The property search and listing query builders assembled several WHERE and ORDER BY clauses zipcode, sorting, price range dropdown, and psize range dropdown by directly...