CVE-2026-108965: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/editquantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been...

PT-2026-113432

Name of the Vulnerable Software and Affected Versions SQL Server affected versions not specified Description A heap-based buffer overflow allows an authorized attacker to execute arbitrary code over a network, which can affect the system. A heap-based buffer overflow occurs when a program writes...

PT-2026-113436

Name of the Vulnerable Software and Affected Versions SQL Server affected versions not specified Description A heap-based buffer overflow allows an authorized attacker to execute arbitrary code locally or remotely, potentially affecting the entire system. A heap-based buffer overflow occurs when ...

CVE-2026-106035: Insertion of Sensitive Information into Log File

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...

PT-2026-111280

Name of the Vulnerable Software and Affected Versions SourceCodester Performance Indicator System version 1.0 Description A security flaw allows remote attackers to perform SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. The issue exists...

VulnCheck KEV: CVE-2026-15381

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

VulnCheck KEV: CVE-2026-2413

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the getglobalremediations method, where it is directly concatenated...

VulnCheck KEV: CVE-2025-7402

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘siteid’ parameter in all versions up to, and including, 4.95 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

VulnCheck KEV: CVE-2023-6063

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

VulnCheck KEV: CVE-2023-39309

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ThemeFusion Fusion Builder.This issue affects Fusion Builder: from n/a through 3.11.1...

VulnCheck KEV: CVE-2026-49772

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2...

VulnCheck KEV: CVE-2026-3830

The Product Filter for WooCommerce by WBW WordPress plugin before 3.1.3 does not sanitize and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

VulnCheck KEV: CVE-2024-8275

The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribehasnextevent' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Microsoft SQL Server: CVE-2026-88083: Microsoft SQL Server Remote Code Execution Vulnerability

Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network...

PT-2026-113446

Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network...

PT-2026-113435

Name of the Vulnerable Software and Affected Versions SQL Server affected versions not specified Description A heap-based buffer overflow allows an authorized attacker to elevate privileges over a network. A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer...

VulnCheck KEV: CVE-2026-19949

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

PT-2026-113454

Name of the Vulnerable Software and Affected Versions SQL Server affected versions not specified Description A heap-based buffer overflow allows an authorized attacker to execute arbitrary code over a network, which can affect the system. A heap-based buffer overflow occurs when a program writes...

CVE-2026-108966: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly...

Microsoft SQL Server: CVE-2026-88086: Microsoft SQL Server Information Disclosure Vulnerability

Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network...