CVE-2026-9586

Sangoma Switchvox SMB Edition 8.3 (104997) is vulnerable to an unauthenticated SQL injection in the /pa endpoint. The endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. A sing...

EUVD-2026-45084

OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint crosstab export endpoint that constructs PostgreSQL queries by concatenating asset display names into raw SQL. An authenticated attacker with asset creation or rename permissions can inject SQL through...

PT-2026-60810

Name of the Vulnerable Software and Affected Versions Sangoma Switchvox versions prior to 8.4.0.2 Description An unauthenticated SQL injection exists in the /pa endpoint, which processes XML content beginning with . The issue occurs because the PhoneIP variable is concatenated directly into...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2021-47782

Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to inject malicious database queries. Attackers can exploit the vulnerability by sending crafted payloads to the /rass/api/v1/trafficCycle/ endpoint to manipulate...

CVE-2021-47782

Odine Solutions GateKeeper 1.0 is affected by a SQL injection in the trafficCycle API endpoint (/rass/api/v1/trafficCycle/). The root cause is a database query manipulation in PostgreSQL that could lead to extraction of sensitive information. Mitigation: apply updates to address the SQL injection...