EUVD-2026-84858

MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...

EUVD-2026-84810

MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...

CVE-2026-82010: Improper Neutralization of Special Elements used in an SQL Command

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-82011: Improper Neutralization of Special Elements used in an SQL Command

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthoriz...

PT-2026-96983

Name of the Vulnerable Software and Affected Versions Adobe Connect versions prior to 12.12 Description Adobe Connect contains an SQL Injection flaw, which occurs when special elements used in an SQL command are not properly neutralized. This allows a low-privileged attacker to execute arbitrary...

PT-2026-97031

Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description A SQL injection issue exists within the custom model/form import feature. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially...

PT-2026-96909

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-82009: Improper Neutralization of Special Elements used in an SQL Command

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...

PT-2026-97110

Name of the Vulnerable Software and Affected Versions ReactPress versions prior to 3.7.0 Description API list endpoints build TypeORM QueryBuilder conditions using unsanitized HTTP query parameter names as SQL column identifiers. Because TypeORM parameterizes values but not column names,...

CVE-2026-65128: Improper Neutralization of Special Elements used in an SQL Command

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

PT-2026-96730

Name of the Vulnerable Software and Affected Versions KarelIPS versions prior to 22092026 Description An issue involving improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true o...

PT-2026-96908

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to...

postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse

A SQL injection flaw in PostgreSQL's EXTRACT expression deparser allows an authenticated object owner to execute arbitrary SQL commands with superuser privileges. By defining a hostile database object, an attacker can achieve privilege escalation when deparsing tools like pgdump or psql inspect o...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-61852

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-65980

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

EUVD-2026-84214

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-65980

Chartbrew , an open-source web application for creating charts from databases and APIs, is vulnerable to SQL injection in its ClickHouse protocol prior to version 5.2.3 . The root cause is that applySqlVariables() is called without the escapeBackslash option, allowing an attacker to supply a back...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...

CVE-2026-65980 Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chartbrew's ClickHouse protocol in server/sources/plugins/clickhouse/clickhouse.protocol.js calls applySqlVariables from...