CVE-2026-81675 Multiple Vulnerabilities in TOOOLS' iSquad

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

EUVD-2026-67011

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81675

CVE-2026-81675 is an SQL injection vulnerability in TOOOLS' iSquad , specifically in the endpoint /ws/apiprensa/getVideoUltimasSeccion via the id_seccion parameter. The parameter is directly embedded in a complex SQL query involving grouping and sorting operations, allowing an attacker to disrupt...

EUVD-2026-67010

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the idambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

CVE-2026-78260

An unauthenticated SQL injection vulnerability was identified in the WordPress plugin Epayco (Epayco Gateway) in versions 8.4.6 and earlier . The flaw was discovered by Lee Chul Woong and is rated CVSS 9.3 (Critical) with a changed scope, high confidentiality impact, and low availability impact. ...

CVE-2026-78260 WordPress Epayco plugin <= 8.4.6 - SQL Injection vulnerability

Unauthenticated SQL Injection in Epayco = 8.4.6 versions...

CVE-2026-16895

CVE-2026-16895 is a fail-open logic vulnerability in the Metasploit Framework 's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the internal flag msf.auth_initialize...

CVE-2026-16895 Authentication Bypass in Metasploit JSON-RPC Service When DB Health Check Fails

A logic vulnerability fail-open condition has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check db.check and the environment variable MSFWSJSONRPCAPITOKEN is not explicitly set, the application resets the...

EUVD-2026-66763

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

PT-2026-82730

Name of the Vulnerable Software and Affected Versions ServiceNow AI platform affected versions not specified Description An unauthenticated user can execute arbitrary SQL statements against the underlying database of the ServiceNow AI platform. This occurs via a SQL injection in the dynamic schem...

CVE-2026-75417

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the getarrchildid function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FINDINSET SQL clause without proper sanitization. This allows ...

CVE-2026-75417

A SQL injection vulnerability exists in YzmCMS 7.5 within the get_arrchildid() function located in application/admin/controller/category.class.php. The flaw arises because the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without sufficient sanitizati...

CVE-2026-81528: Improper Neutralization of Special Elements in Data Query Logic

A MongoDB C driver document-replacement code path omits the element-name/shape validation that the equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements. An application that passes untrusted,...

CVE-2026-81523: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of...

CVE-2026-81675: Improper Neutralization of Special Elements used in an SQL Command

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the idseccion parameter. The parameter is directly embedded in a complex SQL query that includes grouping and sorting operations. By injecting SQL syntax, an attacker can disrupt the query structure and...

CVE-2026-81673: Improper Neutralization of Special Elements used in an SQL Command

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

PT-2026-82418

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

PT-2026-82737

Name of the Vulnerable Software and Affected Versions MongoDB libmongocrypt affected versions not specified Description A missing input-validation issue exists in the automatic-encryption context setup of MongoDB libmongocrypt. This flaw allows a caller-supplied database identifier to be accepted...

PT-2026-82738

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description A weakness exists where the driver fails to sanitize special elements in caller-supplied database and collection name components during the composition of the target namespace for an...

CVE-2026-81525: Improper Neutralization of Special Elements in Data Query Logic

The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations...