857 matches found
CVE-2026-76954: Synology DiskStation Manager (DSM): An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology…
An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager DSM before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read or write arbitrary files and conduct denial-of-service...
PT-2026-145506
Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 8.0.0 through 8.0.1 FortiAnalyzer versions 7.6.0 through 7.6.7 FortiAnalyzer version 7.4 FortiAnalyzer version 7.2 FortiAnalyzer Cloud versions 8.0.0 through 8.0.1 FortiAnalyzer Cloud versions 7.6.0 through 7.6.7...
Fortinet FortiManager Improper neutralization of special elements used in an SQL command (FG-IR-26-221)
The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-221 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
Fortinet FortiAnalyzer Improper neutralization of special elements used in an SQL command (FG-IR-26-221)
The version of FortiAnalyzer installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-221 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
Fortinet FortiAnalyzer Improper neutralization of special elements used in an SQL command (FG-IR-26-233)
The version of FortiAnalyzer installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-233 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
Fortinet FortiManager Improper neutralization of special elements used in an SQL command (FG-IR-26-233)
The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-233 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
PT-2026-144875
Name of the Vulnerable Software and Affected Versions FortiMail versions 8.0.0 through 8.0.1 FortiMail versions 7.6.0 through 7.6.6 FortiMail versions 7.4.0 through 7.4.8 FortiMail version 7.2 all versions Description An improper neutralization of special elements used in an SQL command, known as...
CVE-2026-84030
IBM Guardium Data Protection version 12.2.4 is vulnerable to a SQL Injection vulnerability (CVE-2026-84030 ) caused by the improper neutralization of special elements used in an SQL command. A remote attacker could exploit this to execute arbitrary SQL commands . IBM has addressed this vulnerabil...
CVE-2026-17345
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 are affected by multiple vulnerabilities involving improper neutralization of special elements used in an SQL command . A remote authenticated attacker could exploit this flaw to obtain sensitive information . No sp...
CVE-2026-89310
A SQL Command Injection vulnerability exists in JTL-WMS (CVE-2026-89310). The flaw occurs because a parameter from the request body is inserted into a T-SQL statement without proper escaping or parameterization. This allows a remote attacker to execute arbitrary SQL commands within the context of...
CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...
CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...
CVE-2026-89196
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL...
CVE-2026-89196
A vulnerability exists in RUGGEDCOM CROSSBOW (all versions
CVE-2026-89198: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the...
CVE-2026-89196: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL...
PT-2026-111395
Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize the...
PT-2026-111393
Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize input...
