284875 matches found
CVE-2026-102158: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...
PT-2026-106485
SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...
CVE-2026-105921: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file searchclass.php. Such manipulation of the argument schoolyear leads to sql injection. The attack may be launched remotely. The...
PT-2026-107193
Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks against an affected interface of ClearPass Policy Manager. SQL injection is a technique where malicious S...
WP < 7.1.3 - Author+ SQLi via WXR Export
Description WordPress does not properly validate some post meta values before using them in a database query when exporting content in some cases, which could allow users with Author-level access and above to store a crafted value that results in SQL injection executed when an administrator later...
PT-2026-106719
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password resul...
CVE-2026-105919: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysqlquery of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password result...
CVE-2025-45871
LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name...
CVE-2026-103059: Authentication Bypass by Primary Weakness
When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...
PT-2026-107169
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When the built-in SSH server is enabled via the START SSH SERVER variable, the system performs a lookup of the presented public key using an SQL LIKE comparison of its encoded content. Because...
PT-2026-106394
Name of the Vulnerable Software and Affected Versions WP2LEADS versions prior to 3.5.8 Description An SQL injection flaw exists that allows a user with subscriber privileges to execute unauthorized database queries. Recommendations Update to a version newer than 3.5.7...
PT-2026-106758
A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file search class.php. Such manipulation of the argument school year leads to sql injection. The attack may be launched remotely. The...
CVE-2026-25434: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in WP2LEADS = 3.5.7 versions...
PT-2026-106789
Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload versions prior to 4.0.0-canary.34 Payload Postgres packages versions prior to 3.73.0 Description An attacker with read and create or update access to a collection containing a json field or a blocks fie...
CVE-2026-105856: Improper Neutralization of Special Elements used in an SQL Command
Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operator...
CVE-2026-105317: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...
PT-2026-106389
Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...
RHEL 8 : Red Hat Single Sign-On 7.6.13 security update on RHEL 8 (Important) (RHSA-2026:76129)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76129 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...
AlmaLinux 8 : mariadb-connector-c (ALSA-2026:75674)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75674 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted t...