KB5077471 - Description of the security update for SQL Server 2017 CU31: March 10, 2026

None None...

KB5077470 - Description of the security update for SQL Server 2019 GDR: March 10, 2026

None None...

KB5077469 - Description of the security update for SQL Server 2019 CU32: March 10, 2026

None None...

KB5077466 - Description of the security update for SQL Server 2025 CU2: March 10, 2026

None None...

KB5077474 - Description of the security update for SQL Server 2016 SP3 GDR: March 10, 2026

None None...

KB5077473 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: March 10, 2026

None None...

SQL Server Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

KB5077464 - Description of the security update for SQL Server 2022 CU23: March 10, 2026

None None...

Microsoft SQL Server 访问控制错误漏洞

Microsoft SQL Server is a large-scale commercial database system developed by Microsoft Corporation, used under the Microsoft Windows operating system. There is an access control vulnerability in Microsoft SQL Server. Attackers can exploit this vulnerability to gain higher privileges. The followi...

KLA90922 PE vulnerabilities in Microsoft SQL Server

An elevation of privilege vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to gain privileges. Original advisories CVE-2026-21262 CVE-2026-26115 CVE-2026-26116 Exploitation Related products Microsoft-SQL-Server Microsoft-Azure CVE list...

PT-2026-24325

Name of the Vulnerable Software and Affected Versions SQL Server affected versions not specified Description Improper validation of a specified type of input in SQL Server can allow an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information...

PT-2026-24260

Name of the Vulnerable Software and Affected Versions SQL Server versions 2016 SP3 through 2025 Description An improper access control issue in SQL Server allows an authorized attacker to elevate privileges over a network. An attacker can gain sysadmin privileges remotely on affected SQL Server...

CVE-2026-26115: Improper Validation of Specified Type of Input

Improper validation of specified type of input in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-26116: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2026-21262: Improper Access Control

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network...

CVE-2025-15560

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can...

CVE-2025-15560

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can...

CVE-2025-15560

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can...

CVE-2025-15560

The NesterSoft WorkTime project tracking software contains a SQL injection vulnerability in the "widget" API endpoint . An authenticated attacker with minimal permissions can exploit this flaw to inject SQL queries. The impact depends on the database backend: if Firebird is used, attackers can re...

PT-2026-20799

An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Firebird backend is used, attackers are able to retrieve all data from the database backend. If the MSSQL backend is used the attacker can...