CVE-2026-72899: Improper Neutralization of Special Elements used in an SQL Command

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter dimension parameter...

CVE-2026-72898: Improper Neutralization of Special Elements used in an SQL Command

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/resetpassword' database endpoint and gain administrator access to the connected Metabase instance...

Photon OS 5.0: Postgresql15 PHSA-2025-5.0-91-0683

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0683. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SPIP Unauthenticated Blind SQLi via Date Field Escaping Bypass

This module exploits an unauthenticated blind SQL injection in SPIP use auxiliary/scanner/http/spip/anneesqli msf undefinedanneesqli show actions ...actions... msf undefinedanneesqli set ACTION msf undefinedanneesqli show options ...show and set options... msf undefinedanneesqli run This module...

CVE-2026-19049: Improper Neutralization of Special Elements used in an SQL Command

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

CVE-2026-16949: Improper Neutralization of Special Elements used in an SQL Command

The Term Pages WordPress plugin before 2.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

CVE-2026-32227: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue...

CVE-2026-19384: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

PT-2026-69976

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.109.0 ERPNext versions prior to 16.20.0 Description An authenticated low-privilege user can perform SQL injection to extract sensitive information. This occurs because the get tax template function in...

PT-2026-69328

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Doctors Appointment System version 1.0 Description A SQL injection flaw exists that allows remote attackers to manipulate the ID argument. This issue occurs within an unknown function in the '/admin/ajax.php?action=set...

CVE-2025-13294: Improper Neutralization of Special Elements used in an SQL Command

An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploi...

CVE-2026-72914: Asymmetric Resource Consumption (Amplification)

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning...

PT-2026-69427

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.9.0 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database...

Photon OS 5.0: Postgresql13 PHSA-2025-5.0-91-0490

An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0490. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

ALSA-2026:52772 Important: perl-DBI:1.641 security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: DBI: Heap overflow when...

RHEL 8 : perl-DBI:1.641 (RHSA-2026:52772)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:52772 advisory. The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independen...

Exploit for CVE-2026-69084

CVE-2026-69084 / CVE-2026-69085 — SiYuan Arbitrary SQL Executi...

CVE-2026-19364

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-19364

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-19364 itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...