CVE-2026-118378

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

EUVD-2026-111554

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118378 Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118378 Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118378 Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118378

Tabularis before version 0.28.0 is vulnerable to an SQL injection in its SQLite driver . This flaw allows MCP clients to execute stacked statements by providing a crafted table_name to the describe_table tool. Specifically, an attacker can close the quoted PRAGMA argument and append additional co...

CVE-2026-118378

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

PT-2026-127744

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table name to the describe table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argumen...

Tabularis SQL injection vulnerability

Versions Tabularis from 0.10.0 up to but not including 0.28.0 contain an SQL injection vulnerability. This vulnerability stems from improper handling of the special tablename parameter by the describetable tool within the SQLite driver. It makes the system susceptible to SQL injection attacks;...

CVE-2026-118378: TabularisDB tabularis: Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute…

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-115330

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

EUVD-2026-108132

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-115330

Lotus versions up to and including 0.10.2 are vulnerable to an SQL injection vulnerability. Authenticated organization users can execute arbitrary SQL by submitting semicolon-separated stacked statements via POST /app/metrics/ . This method bypasses first-statement-only validation, potentially al...

CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

PT-2026-121368

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

Lotus SQL injection vulnerability

Lotus 0.10.2 and earlier versions contain an SQL injection vulnerability. This vulnerability arises from the addition of stacked statements to custom metric queries. Attackers can submit SQL statements separated by semicolons via POST /app/metrics/, bypassing only the first statement validation...

GHSA-VH22-H7HF-WWW7 SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write

CVE: This vulnerability corresponds to CVE-2026-69084. Summary The /api/search/searchEmbedBlock endpoint passes a client-supplied SQL statement verbatim to the database with no validation. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous...

CVE-2026-72550 Friendica Friendica - SQL Injection

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

PT-2026-70125

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...

CVE-2026-72550: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query via a bare PDO::query call, enabling stacked...