EUVD-2026-98003

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...

EUVD-2026-98002

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate...

EUVD-2026-98156

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...

EUVD-2026-98195

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to...

CVE-2026-89113

SAP Commerce Cloud contains an SQL Injection vulnerability (CWE-89) due to insufficient validation of user-supplied input before it is used in database queries. An authenticated user can exploit this by sending specially crafted requests to affected functionality to inject arbitrary SQL commands....

CVE-2026-89113 SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)

SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to...

VulnCheck KEV: CVE-2026-3326

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

PT-2026-113455

Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network...

KLA91344 Multiple vulnerabilities in Microsoft SQL Server

Multiple vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote...

Microsoft SQL Server: CVE-2026-88081: Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network...

PT-2026-112905

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

PT-2026-111797

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.4 FortiAnalyzer versions 7.4.0 through 7.4.7 FortiAnalyzer version 7.2 FortiAnalyzer Cloud versions 7.6.2 through 7.6.4 FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 FortiAnalyzer Cloud versions 7.2....

PT-2026-111777

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.4 FortiAnalyzer versions 7.4.0 through 7.4.7 FortiAnalyzer version 7.2 FortiAnalyzer Cloud versions 7.6.2 through 7.6.4 FortiAnalyzer Cloud versions 7.4.1 through 7.4.7 FortiAnalyzer Cloud versions 7.2....

Cisco License On-Prem Unauthorized Access

The vulnerability in the web interface for managing Cisco License On-Prem previously known as Cisco Smart Software Manager On-Prem is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized...

CVE-2026-23707: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

Microsoft SQL Server: CVE-2026-70189: Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally...

Microsoft SQL Server: CVE-2026-88082: Microsoft SQL Server Elevation of Privilege Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally...

Microsoft SQL Server: CVE-2026-88086: Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network...

Microsoft SQL Server: CVE-2026-88084: Microsoft SQL Server Denial of Service Vulnerability

Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network...

Microsoft SQL Server: CVE-2026-85886: Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...