CVE-2026-65761

CVE-2026-65761 — EasyStore Joomla Pre-Auth SQL Injection filtersortby Direction → ORDER BY Injection → Full DB Read Overview CVE-2026-65761 CVSS 9.3 Critical is an unauthenticated SQL injection in EasyStore for Joomla by JoomShaper, affecting versions ≤ 2.0.1. The filtersortby product listing...

CVE-2025-29529

SQLi ITC Multiplan CVE-2025-29529 Descubrimiento El 21 de febrero de 2025, se identificó una vulnerabilidad de inyección SQL en la plataforma “Multiplan” desarrollada por ITC Systems durante un trabajo con un cliente. Versiones afectadas Esta vulnerabilidad solo se ha probado en v3.7.4.1002 Vecto...

CVE-2026-52763

YesWiki , a PHP-based wiki system, is affected by a stored SQL injection in the recentchanges action (actions/recentchanges.php). The period argument supplied via the action syntax ({{recentchanges period="..."}}) bypasses a whitelist that only validates the $_GET form, flowing unvalidated into P...

CVE-2026-82871

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

EUVD-2026-68406

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' table schemas and row data. Attackers can supply arbitrary organization IDs in URL parameters to list tables, retrieve column definitions, and...

CVE-2026-26980

CVE-2026-26980 — 👻 Ghost CMS Inyección SQL no autenticada vía Content API Una vulnerabilidad de inyección SQL existía en la API de contenido de Ghost que permitía a atacantes no autenticados leer datos arbitrarios de la base de datos...

CVE-2026-81636

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashgraphql allows an unauthenticated client to bypass the configured GraphQL query-complexity limit and force an unbounded database read. AshGraphql.Graphql.Resolver.querycomplexity/3 multiplies child complexity by...

CVE-2026-81636

ash_graphql (ash-project) versions 0.16.23 through before 1.11.0 contain an allocation-of-resources flaw that lets an unauthenticated client bypass the configured GraphQL query-complexity limit. The root cause is in AshGraphql.Graphql.Resolver.query_complexity/3, which multiplies child complexity...

PT-2026-83631

Name of the Vulnerable Software and Affected Versions ash graphql versions 0.16.23 through 1.10.9 Description An unauthenticated client can bypass the configured GraphQL query-complexity limit to force an unbounded database read. This occurs because the query complexity/3 function in...

CVE-2026-26980-PoC

CVE-2026-26980 — Ghost CMS Content API Blind SQL Injection Affetti: Ghost 3.24.0 – 6.19.0 Corretto in: Ghost 6.19.1 Autenticazione richiesta: Nessuna — la chiave dell'API Content è pubblica Impatto: Lettura non autenticata dell'intero database credenziali, chiavi API Vulnerabilità...

CVE-2026-80236 Thinking Software Technology｜Efence - SQL Injection

Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents...

CVE-2026-80236

Efence , a product developed by Thinking Software Technology , is affected by a SQL Injection vulnerability. An unauthenticated remote attacker can access the file upload functionality to read database contents . The CVSS v3.1 score is 8.2 (HIGH) , reflecting network-reachable exploitation with l...

CVE-2026-76571

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2026-76571 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

CVE-2026-76571

Fabrik (a Joomla extension by fabrikar.com) versions prior to 4.7.3 are vulnerable to an unauthenticated SQL injection in the list filter condition parameter. The root cause is that the condition parameter is concatenated verbatim into the WHERE clause constructed by getFilterQuery(), allowing an...

CVE-2026-76571 Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.2 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

EUVD-2026-64327

Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik 4.7.3 - The condition parameter passed to a list filter is concatenated verbatim into the WHERE clause built by getFilterQuery. An unauthenticated attacker can supply arbitrary SQL through...

PT-2026-79571

Name of the Vulnerable Software and Affected Versions Fabrik versions prior to 4.7.2 Description An unauthenticated attacker can perform a SQL injection by supplying arbitrary SQL through the condition parameter passed to a list filter. This occurs because the parameter is concatenated verbatim...

Cisco Unified Intelligence Center < 12.6 / 12.6.x < 12.6(2) ES08 / 15.0.x < 15.0(1) SU2 SQL Injection (cisco-sa-cuic-sql-inject-2qbfWSm5)

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-20327

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...