CVE-2026-78837: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

EUVD-2026-72959

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

PT-2026-87144

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

EUVD-2026-72909

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79570

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79569

The Movie_Recommend v1.0.0 software is vulnerable to a SQL injection flaw within the sort parameter at the /loadingmore endpoint. This vulnerability exists because of improper neutralization of special elements used in an SQL command, which allows an attacker to execute a crafted SQL statement to...

EUVD-2026-71862

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

EUVD-2026-70982

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-85540 Interinfo｜DreamMaker - SQL Injection

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

PT-2026-85453

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2018-18964

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:17+00:00| seen| https://t.me/hackingAttack/27117 2026-09-01 20:02:17+00:00| seen|...

CVE-2026-65642

A flaw was found in Plesk. This vulnerability, known as an Insecure Direct Object Reference IDOR, allows remote authenticated users to bypass authorization checks. An attacker can exploit this to read and modify other customers' databases, leading to unauthorized information disclosure and data...

CVE-2026-74820: Improper Neutralization of Special Elements used in an SQL Command

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or...

CVE-2026-65642

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

CVE-2026-65642

CVE-2026-65642 is an Insecure Direct Object Reference (IDOR) vulnerability in Plesk , affecting versions 18.0.79.7 and earlier and 18.0.80 through 18.0.80.3 . The flaw allows remote authenticated users to read and modify other customers' databases via the database management interface. The CVSS 4...

CVE-2026-65642

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

CVE-2026-65642

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

[SECURITY] Fedora 43 Update: perl-DBI-1.652-1.fc43

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used...

PT-2026-82316

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...