PT-2026-70245

Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA MODEL permission to supply settings.asExpression for the system TS VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneFiel...

EUVD-2026-55671

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the...

CVE-2026-52521

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature...

SQL Injection

Overview org.webjars.npm:sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server. Affected versions of this package are vulnerable to SQL Injection via the escape function. An attacker can execute arbitrary SQL commands by supplying specially crafted...

CVE-2026-39931

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

EUVD-2026-50294

SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using str.format without employing parameterized queries, allowing the name docname of a Supplier record containing SQL metacharacters to be...

EUVD-2026-49936

The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party actin...

CVE-2026-50736

The CVE concerns the pglogical queue mechanism in PostgreSQL, where the apply worker runs payloads at superuser privilege. A publisher can craft queue messages to execute arbitrary SQL on a subscriber as superuser, breaking tenant isolation in shared deployments. Exploitation requires directing a...

CVE-2026-50736

The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party actin...

PT-2026-65562

The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party actin...

CVE-2026-57308

CVE-2026-57308 is an SQL injection in Apache Syncope where an administrator can trigger arbitrary SQL through unsanitized sort parameters via stacked queries. Affected versions: 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.6, and 4.1.0-M0–4.1.1. Upgrading to 4.0.7 or 4.1.2 mitigates the issue. The impact is hig...

CVE-2026-57308 Apache Syncope: SQL injection vulnerability in Audit Events search

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

EUVD-2026-45274

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction,...

PT-2026-60425

Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions prior to 4.7.1 Snowflake Connector for Python versions prior to 3.18.1 Description Improper TLS hostname verification allows a network-positioned attacker to bypass certificate hostname validation on HTT...

EUVD-2026-43644

Multiple input validation vulnerabilities in the Snowflake Spark Connector spark-snowflake versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An...

CVE-2026-15293

The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-59257 n8n - SQL Injection in MySQL v1 executeQuery Operation via Expression Interpolation

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated ... expression values directly into the raw SQL string without parameterization. When a workflow uses...

CVE-2026-39178

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...

PYSEC-2026-1185 Apache Superset: Improper Neutralization of custom SQL on embedded context

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, whi...

PT-2026-56247

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.24 Description The '/de2api/datasetData/previewSql' endpoint lacks the mandatory @DePermit permission validation annotation. This allows any authenticated user to set the datasourceId variable to -1, granting...