PT-2026-114106

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the...

PT-2026-113624

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-114328

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An SQL injection issue exists within the Custom Reports module. This occurs due to the improper neutralization of special elements used i...

PT-2026-113702

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41...

CVE-2026-55684: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

CVE-2026-55683: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract$REQUEST and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT...

CVE-2026-110668: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and coul...

CVE-2026-103946: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...

CVE-2026-110609: Improper Neutralization of Special Elements used in an SQL Command

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-94348: Improper Neutralization of Special Elements used in an SQL Command

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-105067: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

CVE-2026-103307: Improper Neutralization of Special Elements used in an SQL Command

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

PT-2026-113976

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str...

CVE-2026-42093: Improper Neutralization of Special Elements used in an SQL Command

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

PT-2026-114222

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro cobranca.php endpoint accepts POST input through extract$ REQUEST and directly incorporates valor, valor pago, id pessoa, id socio, and id sociotipo into UPDATE, INSERT, and...

CVE-2026-101926: Improper Neutralization of Special Elements used in an SQL Command

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...

RHEL 8 : mariadb-connector-c (RHSA-2026:83079)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83079 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

CVE-2026-105107: Improper Neutralization of Special Elements used in an SQL Command

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-102251: Improper Neutralization of Special Elements used in an SQL Command

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-78193: Improper Neutralization of Special Elements used in an SQL Command

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...