CVE-2026-72731

Discourse vulnerability CVE-2026-72731 affects 2026.1.0-latest through 2026.8.0-latest.1, including the Data Explorer query path and plugin data_explorer code, where parameterized Data Explorer queries could be crafted to escape the intended query via non-recursive and recursive parameter interpo...

Security Bulletin: IBM Informix Server Vulnerability in SQL Interface Handler Could Allow Remote Code Execution (CVE-2026-13361)

Summary A remote code execution vulnerability exists in the SQL Interface component of IBM Informix Dynamic Server. An admitted SQL Interface client can send a specially crafted request to cause a stack-based buffer overflow. Vulnerability Details CVEID:CVE-2026-13361 DESCRIPTION: IBM Informix...

CVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-63106

ReadyEcommerce prior to 4.5.2 exposes an unauthenticated SQL injection in the product listing API: the rating parameter is concatenated into a MySQL HAVING clause in ProductController.php, enabling time-based blind SQL injection to exfiltrate full database contents (including user credentials and...

CVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

Inside the Metabase SQLi: Exploited in the Wild

Reverse engineering Metabase CVE-2026-72898 with AI to accelerate defense...

WordPress WPJAM Basic plugin <= 7.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by dutafi in WordPress Plugin WPJAM Basic versions = 7.0.1...

CVE-2026-72565

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

CVE-2026-32227

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...

WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Zainul Anwar Adi Putra in WordPress Plugin Church Admin versions = 5.1.1...

CVE-2026-72565 Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

EUVD-2026-55241

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

CVE-2026-72565

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

CVE-2026-72565

Tencent APIJSON (up to 8.1.8) contains a SQL injection in the Map-form @having operator that bypasses per-table access control, enabling unauthenticated remote attackers to read arbitrary database tables. The APIJSONORM AbstractSQLConfig.java applies per-role allow-list checks only to the String ...

CVE-2026-72565 Tencent APIJSON - Unauthenticated SQL Injection via @having Operator Map-Form Bypass

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator...

EUVD-2026-55253

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...

CVE-2026-32227 Apache Ranger: SQL Injection vulnerability in lookup functionality

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...

WordPress Everest Backup plugin <= 2.3.12 - SQL Injection vulnerability

SQL Injection vulnerability discovered by manop55555 in WordPress Plugin Everest Backup versions = 2.3.12...

CVE-2026-18666

The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password...

CVE-2026-19049

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...