113 matches found
CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...
CVE-2026-89310 SQL Command Injection Vulnerability in JTL-WMS
A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...
CVE-2026-89310
A SQL Command Injection vulnerability exists in JTL-WMS (CVE-2026-89310). The flaw occurs because a parameter from the request body is inserted into a T-SQL statement without proper escaping or parameterization. This allows a remote attacker to execute arbitrary SQL commands within the context of...
CVE-2026-89198: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the...
CVE-2026-89196: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL...
CVE-2026-84209
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...
CVE-2026-84082: Improper Neutralization of Special Elements used in an SQL Command
IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...
PT-2026-95677
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...
CVE-2026-17191: Improper Neutralization of Special Elements used in an SQL Command
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended...
CVE-2026-62527: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Import And Export. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...
CVE-2025-61024: Improper Neutralization of Special Elements used in an SQL Command
An issue in the sqlotryinloop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...
CVE-2025-61018: Improper Neutralization of Special Elements used in an SQL Command
An issue in the sqloplacedtset component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...
CVE-2025-61027: Improper Neutralization of Special Elements used in an SQL Command
An issue in the tsetpush component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...
CVE-2025-61023: Improper Neutralization of Special Elements used in an SQL Command
An issue in the stcompare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service DoS via crafted SQL statements...
CVE-2026-35228: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in the Oracle MCP Server Helper Tool product of Oracle Open Source Projects component: helper tool. The supported versions that is affected is 1.0.1-1.0.156. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle MCP Server...
CVE-2025-15625: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases...
CVE-2025-58112: Improper Neutralization of Special Elements used in an SQL Command
Microsoft Dynamics 365 Customer Engagement on-premises 1612 9.0.2.3034 allows the generation of customized reports via raw SQL queries in an upload of a .rdl Report Definition Language file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting...
CVE-2026-26980: Improper Neutralization of Special Elements used in an SQL Command
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1...
CVE-2026-22596: Improper Neutralization of Special Elements used in an SQL Command
Ghost is a Node.js content management system. In versions 5.90.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL. This issue has been patched in...
