7191 matches found
CVE-2026-65462
Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...
EUVD-2026-48127
Contributor SQL Injection in Visualizer = 4.0.6 versions...
CVE-2026-65451
CVE-2026-65451 concerns the WordPress MapSVG plugin, affecting versions <= 8.14.0, with a SQL Injection vulnerability. The connected records specify that this is a contributor SQL injection in MapSVG
CVE-2026-9713
CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...
The vulnerability of the Cassandra export module in the Glances monitoring tool’s application programming interface allows a perpetrator to execute arbitrary code.
The vulnerability of the Cassandra export module in the Glances monitoring tool’s application programming interface is related to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary code...
mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...
CVE-2026-2395 SQLi in Xpoda Türkiye Informatics Technology's No Code Platform
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before 4.1.4...
EUVD-2026-47337
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...
The vulnerability of the WP_Query class in the WordPress content management system allows attackers to execute arbitrary code and gain unauthorized access to confidential information.
The vulnerability of the WPQuery class in the WordPress content management system is related to the lack of protection for the SQL query structure when processing the authornotin parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code and gain unauthorized access to...
EUVD-2026-46358
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...
CVE-2026-64880
Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...
CVE-2026-64877
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...
CVE-2026-55082
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...
CVE-2016-20096
Linknat VOS3000/VOS2009 (up to version 2.1.2.0) is affected by an unauthenticated SQL injection in the login flow. The vulnerability occurs via the name parameter in a POST to the login endpoint, enabling arbitrary SQL execution and potential extraction of plaintext credentials and other database...
CVE-2016-20096 Linknat VOS3000/VOS2009 2.1.2.0 SQL Injection via login.jsp
Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the logi...
EUVD-2026-46351
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...
CVE-2026-64877
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...
EUVD-2026-46175
Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection. This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3...
PT-2026-61818
A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and...