CVE-2026-86743 Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acceptances across all companies. Attackers can access the unacceptedassets report page or CSV export to disclose cross-company inventory...

CVE-2026-57230 OpenReplay: Authenticated ClickHouse SQL injection via session search

OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an...

PT-2026-54741

Name of the Vulnerable Software and Affected Versions Guardian language-system affected versions not specified Description An authenticated attacker can perform error-based SQL injection to extract database contents. This occurs because the application passes the id GET parameter directly into an...

GLPI Mreporting SQL Injection

The vulnerability of the Mreporting plugin for the GLPI system is related to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ivanti Endpoint Manager Unauthorized Access

The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks relates to the lack of security measures for SQL query structures. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

JoomlaUX JUX Real Estate SQLi

The vulnerability of the GET Parameter Handler component in the JoomlaUX JUX Real Estate plugin for the Joomla content management system is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL code remotely...

phpPgAdmin Display Command Execution

The vulnerability of the display.php script in the phpPgAdmin web administration tool for PostgreSQL databases is related to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

FortiVoice SQL Injection

The vulnerability of the FortiVoice corporate telephony software relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ivanti Endpoint Manager SQL Injection Information Disclosure

The vulnerability of the Ivanti Endpoint Manager software management tool is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to read arbitrary data remotely...

Ivanti Endpoint Manager SQL Injection Information Disclosure

The vulnerability of the Ivanti Endpoint Manager software management tool is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to read arbitrary data remotely...

Ivanti Endpoint Manager SQL Injection Information Disclosure

The vulnerability of the Ivanti Endpoint Manager software management tool is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to read arbitrary data remotely...

Ivanti Endpoint Manager SQL Injection Information Disclosure

The vulnerability of the Ivanti Endpoint Manager software management tool is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to read arbitrary data remotely...

Ivanti Endpoint Manager SQL Injection Information Disclosure

The vulnerability of the Ivanti Endpoint Manager software management tool is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to read arbitrary data remotely...

CVE-2025-9073 All in one Minifier <= 3.2 - Unauthenticated SQL Injection

The All in one Minifier plugin for WordPress is vulnerable to SQL Injection via the 'postid' parameter in all versions up to, and including, 3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

Secure LogIn and SignUp API in PHP security vulnerabilities

Secure LogIn and SignUp API in PHP is a security interface software by Vishnu Sivadas Individual Developer. A security vulnerability exists in Secure LogIn and SignUp API in PHP, which stems from an insecure SQL query construct in DataBase.php that could lead to SQL injection...

NetworkServlet getNextTrapPage Code Execution

The vulnerability of the NetworkServlet.getNextTrapPage function in the system for centrally managing network devices and ports of Advantech iView is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Trend Micro Endpoint Encryption BuildEnterpriseSearchString Privilege Escalation

The vulnerability of the BuildEnterpriseSearchString method implemented by the PolicyServer server of the Trend Micro Endpoint Encryption TMEE encryption data solution is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability can allow an attacker...

Qsync Central SQL Injection

The vulnerability of the Qsync Central file synchronization application is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

UnlockWebServerGatewaySettings Code Execution File Read Write

The vulnerability of the UnlockWebServerGatewaySettings method in the software for managing and monitoring remote devices in telemetering and telemechanics systems is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to...

Safari Code Execution

The vulnerability of the Safari browser in operating systems macOS, iOS, and iPadOS is related to the lack of security measures for handling SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...