CVE-2026-84113: Improper Neutralization of Special Elements used in an SQL Command

The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks...

PT-2026-88792

The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo reward' Post Meta in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EUVD-2026-75136

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

CVE-2026-79322: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 mageplaza/magento-2-blog-extension through 4.3.2 allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents via the id parameter to /mpblog/post/view...

CVE-2026-19778: Improper Neutralization of Special Elements used in an SQL Command

The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQL Injection via the 'feed' parameter in all versions up to, and including, 2.23.7 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-79322

A SQL injection vulnerability exists in the RelatedProduct block of the Mageplaza Blog for Magento 2 extension (mageplaza/magento-2-blog-extension) versions through 4.3.2 . This flaw allows remote unauthenticated attackers to execute arbitrary SQL commands and read arbitrary database contents by ...

CVE-2026-79387

PbootCMS versions 3.2.0 through 3.2.5 (and possibly earlier) are vulnerable to a SQL injection (CWE-89) in the user management module. The root cause is located in the mod() method of UserController.php and the modUser() method of UserModel.php, where the field and value parameters from a GET req...

Debian dsa-6491 : libpam-slurm - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6491 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6491-1 [email protected] https://www.debian.org/securit...

EUVD-2026-65121

CakePHP: FunctionsBuilder::jsonValue vulerable to SQL injection with PostgresDriver...

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Impact The FunctionsBuilder::jsonValue$field, $jsonPath methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter. Patches 5.1.10, 5.2.15, 5.3.7 Workarounds Don't provide user controlled data to these functions/parameters...

GHSA-FXF7-VHH8-7VPQ CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

Impact The FunctionsBuilder::jsonValue$field, $jsonPath methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the $jsonPath parameter. Patches 5.1.10, 5.2.15, 5.3.7 Workarounds Don't provide user controlled data to these functions/parameters...

CVE-2026-78623

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...

CVE-2026-75746

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary...

EUVD-2026-74165

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...

CVE-2026-78623 Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...

CVE-2026-78623

The Okta Access Gateway is vulnerable to SQL injection because it fails to sanitize SAML assertion values before interpolating them into database queries within the advanced mode datastore configuration . These unsanitized values are directly substituted into the query string before preparation, ...

CVE-2026-78623 Improper Handling of SAML Assertion Attributes in Okta Access Gateway Advanced Mode Datastores

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...

CVE-2026-75746

Adobe ColdFusion is affected by a SQL injection (CWE-89) vulnerability caused by improper neutralization of special elements used in an SQL command. A successful exploit allows an attacker to execute arbitrary code in the context of the current user. The vulnerability requires high privileges but...

EUVD-2026-74072

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary...

CVE-2026-75746 ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary...