PT-2026-72887

Name of the Vulnerable Software and Affected Versions WPML Multilingual CMS versions prior to 4.9.6 Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with translator-level access or higher to perform SQL Injection...

PT-2026-72148

Name of the Vulnerable Software and Affected Versions Image Uploader for Welcart versions prior to 1.4.7 Description The Image Uploader for Welcart plugin for WordPress contains a SQL Injection flaw. This occurs because the plugin does not sufficiently escape the post title parameter and fails to...

PT-2026-72156

Name of the Vulnerable Software and Affected Versions Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms versions prior to 5.2 Description This issue is a generic SQL Injection that occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparati...

PT-2026-72143

Name of the Vulnerable Software and Affected Versions Object Sync for Salesforce versions prior to 2.2.14 Description An unauthenticated SQL Injection exists in the /wp-json/object-sync-for-salesforce/push/ REST endpoint. The issue occurs because the can process permission callback only verifies...

PT-2026-73046

Name of the Vulnerable Software and Affected Versions Jinher OA version 1.0 Description A SQL injection flaw exists in the file /C6/JHSoft.Web.HrmAttendance/attendance out approve.aspx. A remote attacker can exploit this by manipulating the httpOID argument. SQL injection is a technique where...

PT-2026-72889

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A remote SQL injection flaw exists in the /viewmedicine.php file. The issue occurs when the delid argument is manipulated, allowing an attacker to execute arbitrary SQL commands o...

CVE-2026-19899: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected element is an unknown function of the file /editteacher.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-15453: Improper Neutralization of Special Elements used in an SQL Command

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existi...

PT-2026-73063

Name of the Vulnerable Software and Affected Versions code-projects Online Food Order System version 1.0 Description A flaw in the file delete food items1.php allows for remote SQL injection. This occurs when the checkbox argument is manipulated, enabling an attacker to interfere with the databas...

CVE-2026-12248: Improper Neutralization of Special Elements used in an SQL Command

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible fo...

SUSE CVE-2026-15741

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

CVE-2026-73648 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, pghero-fips, gitlab-rails-ce-fips, pghero, gitlab-rails-ce, commercial-gitlab-rails-ee-fips, ruby3.3-rails, ruby4.0-rails, commercial-gitlab-rails-ee...

CVE-2026-59732 vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-71310 vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-71312 vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-71571

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...

CVE-2026-67365

Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda 4.0.0-4.0.11 - Unauthenticated SQL injection in modicagendacalendar iCagenda, reachable via comajax with no session, token or account...

CVE-2026-17227

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper neutralization of special elements used in an SQL command...

CVE-2026-71571

Technical details are not publicly available in the provided documents. Monitor for updates from official sources.

CVE-2026-71571 Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11

Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...