94249 matches found
PT-2026-102161
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-101331
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-100561
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-87775: Improper Neutralization of Special Elements used in an SQL Command
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...
CVE-2026-61820: Improper Neutralization of Special Elements used in an SQL Command
pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherittemplateproperties manually surrounds primary-key column names from pgattribute.attname with double quotes without escaping embedded double-quote characters. A partmanuser who owns a template...
CVE-2026-85878: Improper Authorization
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network...
CVE-2026-18442: Improper Neutralization of Special Elements used in an SQL Command
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2026-93591: Improper Neutralization of Special Elements used in an SQL Command
SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGrap...
CVE-2026-61817: Improper Neutralization of Special Elements used in an SQL Command
pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...
PT-2026-95245
Name of the Vulnerable Software and Affected Versions Tz Weekly Radio Schedule versions prior to 1.8.2 Description The plugin fails to sanitize and escape the week parameter before incorporating it into a SQL query within an AJAX action. This flaw allows unauthenticated attackers to execute SQL...
PT-2026-100817
Security vulnerability affects the litellm-database package. This issue is resolved in later releases. See references for vulnerability details...
CVE-2026-63445: Improper Limitation of a Pathname to a Restricted Directory
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...
CVE-2026-87767: Improper Neutralization of Special Elements used in an SQL Command
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data...
CVE-2026-17607: Improper Neutralization of Special Elements used in an SQL Command
The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the wpinventory shortcode in versions up to, and including, 2.5.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the...
NextGen Mirth Connect < 4.7.2 Multiple Vulnerabilities (ICSMA-26-253-01)
According to its self-reported version, the instance of NextGen Mirth Connect running on the remote web server is prior to 4.7.2. It is, therefore, affected by multiple vulnerabilities: - NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL...
Oracle Database Server (September 2026 CSPU)
The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and...
PT-2026-95394
Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3-182 Description Authenticated users can extract arbitrary database contents, including user credential hashes and email addresses, through a time-based blind SQL injection. This occurs when the msg id paramet...
PT-2026-95304
Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description An authenticated attacker can exploit a SQL Injection flaw and a Cross-Tenant Data Exposure flaw. These issues allow the injection of database commands to extract...
PT-2026-95374
Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description An access control bypass exists in the query database tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to the DatabaseContext, which...
PT-2026-95244
Name of the Vulnerable Software and Affected Versions Product Question and Answer versions prior to 1.1.1 Description The Product Question and Answer WordPress plugin fails to sanitize and escape parameters used in SQL queries during AJAX actions accessible to unauthenticated users. This allows a...