CVE-2021-35042

CVE-2021-35042 Django SQL injection bug Question: explore how exploitable is it? Answer: I'm terrified Install poetry install poetry run ./manage.py migrate poetry run ./manage.py loaddata dummydata.json Interactive Demo poetry run ./manage.py runserver Ordering by random fields go to...

CVE-2026-26198-analysis

CVE-2026-26198 — SQL Injection in Ormar ORM A deep dive into a critical CVSS 9.8 SQL injection vulnerability in a Python async ORM, with reproduction, analysis, and fix. The Vulnerability Ormar is a popular async mini ORM for Python, commonly used with FastAPI and Starlette. Versions 0.9.9 throug...

CVE-2026-91198 GrowthBook through 5.0.1 Information Disclosure via Public Endpoints

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text,...

CVE-2026-46696

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

CVE-2026-46696

CVE-2026-46696 affects October CMS (system module) versions prior to 3.7.17 and 4.2.21 . A chained bypass in the Twig sandbox security policy occurs when cms.safe_mode is enabled: the Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through ...

CVE-2026-46696 October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safemode is enabled. The Laravel session store was exposed to Twig with unrestricted...

PT-2026-91277

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when cms.safe mode is enabled. The Laravel session store was exposed to Twig with unrestricte...

Exploit for SQL Injection in Mikro-Orm Mikroorm

CVE-2026-43220 MikroORM SQL Injection ★ CVE-2026-43220 Mikro...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2025-14603

vsDesk is vulnerable to blind SQL injection due to insecure handling of user-supplied parameters that are passed directly into SQL queries. An unauthenticated remote attacker can exploit this over the network with low complexity to potentially expose database contents or render the application un...

CVE-2025-14603 Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and...

CVE-2026-65822

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-65822 ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...

CVE-2026-71282

ChirpStack's SQLite-backend device tag filtering chirpstack/src/storage/device.rs, in both getcount and list interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind...

CVE-2026-6453: Improper Neutralization of Special Elements used in an SQL Command

The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 1.1.30. This is due to insufficient input sanitization in the cubewpremoverelation AJAX function, specifically the use of wpunslash on the relationid parameter before interpolating it...

SUSE CVE-2026-41422

Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed verbatim to goqu.L - a raw SQL literal expression builder - without any validation. This bypassed all parameterization and allowed...

EUVD-2026-49723

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

CVE-2026-47255

The CVE-2026-47255 entry concerns AgenticMail API/core vulnerabilities in versions prior to 0.9.32 and 0.9.10, respectively. The connected documents specify multiple hardening and validation weaknesses across storage and outbound relay handling, including: (1) validation and binding of inactive-a...

CVE-2026-44970

dbt-mcp prior to v1.17.1 serializes and transmits the full MCP tool call arguments (including sql_query from show and vars from run/build/test) to the dbt Labs telemetry service without redaction, by default. This telemetry is enabled by default unless explicitly opted out, and a fix is available...

CVE-2026-44970 dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emittoolcalledevent in src/dbtmcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabsvortex.producer.logproto without redaction,...