PT-2026-98881

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane stores an administrator-controlled custom field table value without validating it against allowed table names. The Mdl custom fields::used function later concatenates this stored...

CVE-2026-54790: Improper Neutralization of Special Elements used in an SQL Command

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an administrator-controlled customfieldtable value without validating it against the allowed custom-field table names. Mdlcustomfields::used later concatenates...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the CREATE STATISTICS command. A table owner can exploit this vulnerability by creating a statistics object in an arbitrary schema, blocking other users with valid CREATE privileges from creating a statistics...

WordPress Rank Math SEO plugin <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Schema Deletion vulnerability discovered by Webbernaut in WordPress Plugin Rank Math SEO versions = 1.0.235...