CVE-2026-62251: Improper Neutralization of Special Elements used in an SQL Command

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

PT-2026-107476

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Gopiplus Post title marquee scroll post-title-marquee-scroll allows Blind SQL Injection.This issue affects Post title marquee scroll: from n/a through 9.9...

PT-2026-111412

Name of the Vulnerable Software and Affected Versions Payload CMS versions prior to 3.90.0 Payload CMS versions prior to 4.0.0-canary.34 Description An authenticated attacker can perform SQL Injection attacks due to improper neutralization of user input provided to the in and not in query...

CVE-2026-76452: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, could allow an authenticated, remote attacker to conduct SQL injection attacks against an affected application. This vulnerability is due to insufficient...

CVE-2026-107103: Improper Neutralization of Special Elements used in an SQL Command

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

PT-2026-107477

Name of the Vulnerable Software and Affected Versions Pix por Piggly para Woocommerce versions prior to 2.1.3 Description An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks...

PT-2026-114479

Уязвимость веб-интерфейса управления локального сервера лицензирования Cisco License On-Prem ранее Cisco Smart Software Manager On-Prem SSM On-Prem связана с непринятием мер по защите структуры запроса SQL. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить...

Apache OzHera 2.2.6 Authenticated SQL Injection

Apache OzHera version 2.2.6 contains an authenticated SQL injection vulnerability in Doris-backed log searches. Apache OzHera 2.2.6 Authenticated SQL Injection Vendor: The Apache Software Foundation Product web page: https://ozhera.apache.org Affected version: 2.2.6-incubating Summary: Apache...

CVE-2026-42708: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0...

CVE-2026-104667: Improper Neutralization of Special Elements used in an SQL Command

The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can rea...

CVE-2026-42721: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

PT-2026-107473

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...

PT-2026-107474

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1...

CVE-2026-42720: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4...

CVE-2026-42714: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Piggly Dev Pix por Piggly para Woocommerce pix-por-piggly allows Blind SQL Injection.This issue affects Pix por Piggly para Woocommerce: from n/a through 2.1.2...

Adobe Campaign Classic < 7.4.3 build 9398 Multiple Vulnerabilities (APSB26-114)

The version of Adobe Campaign Classic installed on the remote host is prior to 7.4.3 build 9398. It is, therefore, affected by multiple vulnerabilities: - An incorrect authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of thi...

MiracleLinux 9 : mariadb-connector-c-3.2.6-2.el9_8 (AXSA:2026-1988:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1988:02 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has...

CVE-2024-1207

Booking Calendar = 9.9 - Unauthenticated SQL Injection CVE-2024-1207 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/booking/booking-calendar-99-unauthenticated-sql-injection POC: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: vulnerablesite.com User-Agent: Mozilla/5.0...

CVE-2026-79811

A SQL injection vulnerability in the API of ClearPass Policy Manager could allow a remote authenticated attacker with administrative privileges to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to execute arbitrary...

CVE-2026-79798

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...