PT-2026-115108

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

CVE-2026-55239: Improper Neutralization of Special Elements used in an SQL Command

Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, the getDateQuery function in src/server/utils/prisma.ts constructs raw SQL through Prisma.sql by interpolating the timezone request value without parameter binding. The timezone value can reach...

CVE-2026-109698: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4...

Linux Distros Unpatched Vulnerability : CVE-2026-93484

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper...

RHEL 9 : mariadb-connector-c (RHSA-2026:83518)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83518 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

RHEL 9 : mariadb-connector-c (RHSA-2026:83519)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83519 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

RHEL 9 : mariadb-connector-c (RHSA-2026:83608)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83608 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

PT-2026-114862

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin json.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100...

PT-2026-114923

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

PT-2026-114875

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-55871: Improper Neutralization of Special Elements used in an SQL Command

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the searchname and searchemail GET parameters into both the user-list query and the COUNT query used for pagination without prepare...

CVE-2026-109688: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Blind SQL Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...

CVE-2026-26244: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...

CVE-2026-63314: Improper Neutralization of Special Elements used in an SQL Command

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/adminjson.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100...

PT-2026-115369

Name of the Vulnerable Software and Affected Versions Backuply versions prior to 1.5.9 Description Backuply is subject to a second-order SQL Injection that allows authenticated users with subscriber-level access and above to escalate privileges and take full control of a site. The issue occurs wh...

RHEL 8 : mariadb-connector-c (RHSA-2026:83517)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83517 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

PT-2026-114913

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Kitae Park Mang Board WP mangboard allows SQL Injection.This issue affects Mang Board WP: from n/a through 2.4.4...

UBUNTU-CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

PT-2026-114754

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders such as findOneByEmail, the query builder's whereproperty, value and whereproperty, operator, value, string/UUID-key lookup paths findByKey, updateByKey, deleteByKey and...