PT-2026-115894

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO BACKSLASH ESCAPES mode, including in...

PT-2026-115893

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

PT-2026-115395

Name of the Vulnerable Software and Affected Versions Frappe HRMS versions prior to 14.38.2 Frappe HRMS versions prior to 15.64.0 Frappe HRMS versions prior to 16.18.0 Description Missing input validation in certain endpoints allows an authenticated attacker, including those with low-privilege...

PT-2026-115467

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks on sites that use the WCFM Delivery add-on. This occurs because the plugin fails to sanitize and escape a parameter...

PT-2026-115541

Name of the Vulnerable Software and Affected Versions Vitepos – Point of Sale POS for WooCommerce versions prior to 3.5.2 Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow unauthenticated attackers or users with any POS role, such as...

Red Hat: CVE-2026-86047: mariadb: mariadb: SQL injection via improper identifier quoting

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...

CVE-2026-55796: Improper Neutralization of Special Elements used in an SQL Command

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The...

CVE-2026-111718: Improper Neutralization of Special Elements used in an SQL Command

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the orderby and groupby fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that bypass the SqlGuard denylist and...

CVE-2026-111686: Improper Neutralization of Special Elements used in an SQL Command

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path parameter of /WebArticle/findarticlesbynum. Attackers can append crafted SQL after the LIMIT clause concatenated into a MyBatis-Plus QueryWrapper to extract...

CVE-2026-86047: Improper Neutralization of Special Elements used in an SQL Command

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A...

CVE-2026-62362: Improper Neutralization of Special Elements used in an SQL Command

PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField...

CVE-2026-64959: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly...

CVE-2026-92766: Improper Neutralization of Special Elements used in an SQL Command

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'srcby' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

PT-2026-115407

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NO BACKSLASH ESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings...

PT-2026-115521

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3...

PT-2026-115481

Name of the Vulnerable Software and Affected Versions WX Subscribe 微信支付付费订阅 WordPress plugin versions prior to 1.2.2 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to perform SQL...

PT-2026-115498

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'dataorderby' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-115595

Name of the Vulnerable Software and Affected Versions MapSVG versions prior to 8.16.2 Description An SQL Injection issue exists in the MapSVG mapsvg-lite-interactive-vector-maps component. This occurs due to the improper neutralization of special elements used in an SQL command, which allows an...

PT-2026-115666

PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField...

PT-2026-116018

🚨 CVE-2026-111619 FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and...