CVE-2026-20300: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of...

PT-2026-93963

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Management Center FMC Software affected versions not specified Description A flaw in the External Database Access feature allows an unauthenticated remote attacker to execute arbitrary commands with root privileges. The...

PT-2026-93786

Name of the Vulnerable Software and Affected Versions code-projects Matrimonial System version 1.0 Description An SQL injection issue exists in the Regular Search component within the '/search.php' endpoint. A remote attacker can exploit this by manipulating the sex, mothertongue, maritialstatus,...

CVE-2026-20344: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of...

CVE-2026-91924

pgweb versions through 0.17.0 leave the POST /api/connect endpoint unguarded when connect-backend authorization is configured. This allows an attacker with low privileges to supply an arbitrary database connection string, bypassing the intended resource-to-database mapping by providing a custom s...

CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

[SECURITY] Fedora 45 Update: perl-DBI-1.653-1.fc45

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used...

CVE-2026-53459: Not Failing Securely

Bambuddy is a self-hosted print archive and management system for Bambu Lab 3D printers. Starting in version 0.1.6 and prior to version 0.2.4.4, a fail-open in the authentication code allows any attacker to bypass authentication by flooding a public endpoint to exhaust resources causing database...

PT-2026-91929

Name of the Vulnerable Software and Affected Versions pgweb versions prior to 0.17.1 Description The application fails to implement authorization checks on the 'POST /api/connect' endpoint when connect-backend authorization is configured. This allows an attacker to bypass the resource-to-database...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37985)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability arises from the failure to properly validate the user ID parameter input in the...

CVE-2026-79570

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78837

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79573

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

PT-2026-87099

A SQL injection vulnerability in the ap form id parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

EUVD-2026-72851

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78837

AppNitro MachForm v30 is vulnerable to a remote SQL injection vulnerability within the ap_form_{id} parameter. An unauthenticated attacker can exploit the filter[filters][0][field] parameter in grid_datasource.php to execute crafted SQL statements. This flaw allows for the enumeration of valid co...

CVE-2026-79570

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79569: Improper Neutralization of Special Elements used in an SQL Command

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78837: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...