PT-2026-115537

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint...

CVE-2026-109414: Improper Neutralization of Special Elements used in an SQL Command

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

PT-2026-115395

Name of the Vulnerable Software and Affected Versions Frappe HRMS versions prior to 14.38.2 Frappe HRMS versions prior to 15.64.0 Frappe HRMS versions prior to 16.18.0 Description Missing input validation in certain endpoints allows an authenticated attacker, including those with low-privilege...

PT-2026-115595

Name of the Vulnerable Software and Affected Versions MapSVG versions prior to 8.16.2 Description An SQL Injection issue exists in the MapSVG mapsvg-lite-interactive-vector-maps component. This occurs due to the improper neutralization of special elements used in an SQL command, which allows an...

CVE-2026-111686: Improper Neutralization of Special Elements used in an SQL Command

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract...

PT-2026-115603

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 5 through 5.0.4 Description An issue involving missing authentication for critical functions and improper neutralization of special elements used in SQL commands allows for SQL Injection. This occurs when certain backend...

PT-2026-115666

PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField...

Fedora 44 : wordpress (2026-5ada1f2961)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5ada1f2961 advisory. WordPress 6.9.10 Security Release Security updates included in this release - A stored XSS on the Comments administration page, exploitable via pending...

Fedora 43 : wordpress (2026-e0ebe50146)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e0ebe50146 advisory. WordPress 6.9.10 Security Release Security updates included in this release - A stored XSS on the Comments administration page, exploitable via pending...

Security Updates for Microsoft Endpoint Configuration Manager (October 2026)

The Microsoft Endpoint Configuration Manager installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authoriz...

CVE-2026-111178: Improper Neutralization of Special Elements used in an SQL Command

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'dataorderby' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-103518: Improper Neutralization of Special Elements used in an SQL Command

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants. ' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-115894

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO BACKSLASH ESCAPES mode, including in...

CVE-2026-111472: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint...

PT-2026-115893

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2026-111399: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows SQL Injection.This issue affects MapSVG: from n/a through 8.16.1...

PT-2026-115917

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

PT-2026-115905

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2026-91833: Improper Neutralization of Special Elements used in an SQL Command

The WX Subscribe 微信支付付费订阅 WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks on installs where the payment key has not been configured...

PT-2026-116099

🚨 CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en US/eql, escaping the unsanitized...