95175 matches found
RHSA-2026:49612 Red Hat Security Advisory: perl-DBI security update
Bulletin has no description...
CVE-2026-15721 Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HUMANIST Digital Human Resources
Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory
A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as loexport, loread, lolseek64, and lotell64. This allows the superuser to send an arbitrarily large response, overwriting the client's...
EUVD-2026-52587
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...
CVE-2026-18719 cemtan sar2html Search sar2html.py sql injection
A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...
CVE-2026-70592: Improper Limitation of a Pathname to a Restricted Directory
Ghost is a Node.js content management system. From 1.20.1 until 6.54.1, an Administrator-level user could remotely overwrite certain files on the filesystem through the database backup filename, leading to integrity and availability issues. The database export endpoint failed to reject path...
PT-2026-67885
Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.1 through 6.54.0 Description An Administrator-level user can remotely overwrite specific files on the filesystem, which may result in integrity and availability issues. This occurs because the database export endpoint does...
MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-1452:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1452:01 advisory. DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution CVE-2026-9698 Tenable has extracted the preceding description block directly...
CVE-2026-14872: Improper Neutralization of Special Elements used in an SQL Command
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...
PT-2026-67706
Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The reports/catalogue stats.pl script builds dynamic SQL within the calculate function by interpolating user-controlled Line and Column request parameters directly into identifier positions of t...
CVE-2026-69100: Improper Control of Generation of Code
LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the scrip...
CVE-2026-69259: Improper Control of Generation of Code
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...
CVE-2026-64631: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability allowing a low-privileged user to inject SQL and extract database contents...
VulnCheck KEV: CVE-2026-28409
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution RCE vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access which can be obtained via the previously reported...
PT-2026-73805
TuxCare rebuilt illuminate/database to address 1 CVE. Fixed in 5.4.36-p2+tuxcare...
PT-2026-78385
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description An authentication bypass exists in the SetupController when maintenance mode is enabled. This allows unauthenticated remote attackers to execute database migrations and create configuration backups...
PT-2026-67820
Name of the Vulnerable Software and Affected Versions Atals-Livre affected versions not specified Description Atals-Livre contains a SQL injection flaw that allows attackers to manipulate database queries. This occurs when unsanitized input is passed through a GET parameter to the supp deletion...
CVE-2026-67860
open62541 1.5.5 contains a heap-based buffer overflow in the default HistoryRead path when the default history database is used with the memory backend...
PT-2026-67709
Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description The circulation statistics report in reports/issues stats.pl contains a flaw where the calculate function constructs SQL queries by concatenating user-controlled request parameters directly into...