CVE-2026-63307

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...

CVE-2026-49209

Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\Controller\BatchActionController::invoke iterates over the client-supplied actions array and issues a full HttpKernel sub-request for each entry; because the array size is never bounded, ...

CVE-2026-9586

CVE-2026-9586 describes an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3. The vulnerable component is the /pa endpoint, which processes XML beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries, enabling arbitrary SQL execution an...

CVE-2026-9586 Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

EUVD-2026-45205

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

EUVD-2026-45201

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

CVE-2026-8297 SQLi in GIS Informatics' GisLab Laboratory Management System

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: fr...

CVE-2026-16014

The CVE-2026-16014 entry concerns code-projects Hospital Bed Management System 1.0. It identifies a vulnerability in an unspecified part of the Login Form, where manipulating the Username argument triggers a SQL injection. The vulnerability enables remote exploitation, and public exploits exist. ...

SUSE-SU-2026:3098-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue: - CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...

Exposure Of Sensitive Information

github.com/forgekeep/nebula-mesh is vulnerable to Exposure of Sensitive Information. The vulnerability is due to operator session tokens being stored in plaintext in the database rather than in a protected or hashed form, which allows an attacker with access to the database e.g., through backups,...

CVE-2026-16009 itsourcecode Hospital Management System prescriptionorderdetail.php sql injection

A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The manipulation of the argument delid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used...

DBI::ProfileData versions before 1.651 for Perl do not limit the path index

...

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

...

CVE-2026-62238

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...

[SECURITY] Fedora 43 Update: perl-DBI-1.650-1.fc43

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used...

EUVD-2026-45084

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...

PT-2026-60805

Name of the Vulnerable Software and Affected Versions Chat2DB versions prior to 5.3.0 Description An insecure direct object reference occurs when the application provides direct access to objects based on user-supplied input. In the 'GET /api/connection/datasource/id' endpoint, the handler calls...

PT-2026-60855

Name of the Vulnerable Software and Affected Versions WordPress versions 6.8.0 through 6.8.5 WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1 Description WordPress Core contains multiple security issues that can be chained to allow a remote, unauthenticated attacker t...

Fedora 43 : perl-DBI (2026-71d7e4d1da)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-71d7e4d1da advisory. 1.650 bump - Fix CVE-2026-14739, CVE-2026-14740 and CVE-2026-14380 Tenable has extracted the preceding description block directly from the Fedora...

PT-2026-60861

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.4 Description A trap occurs during the compilation of specially crafted statements containing subqueries, which can lead to a denial of service. Recommendations At the...