CVE-2026-61818: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition reads partconfig.timeencoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partmanuser access can store...

PT-2026-95290

Name of the Vulnerable Software and Affected Versions WP Inventory Manager versions prior to 2.5.2 Description Authenticated attackers with Contributor-level access and above can perform SQL Injection through the where shortcode attribute of the wpinventory shortcode. The issue occurs in the...

PT-2026-95598

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the site id GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

CVE-2026-18442: Improper Neutralization of Special Elements used in an SQL Command

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmpuserlocationlng' parameter in all versions up to, and including, 3.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

PT-2026-95267

Name of the Vulnerable Software and Affected Versions InfiniteWP Client plugin for WordPress versions prior to 1.14.0 Description An issue exists in the get comments action where insufficient escaping of array-key names in the JSON request body allows for SQL Injection. The IWP MMB Comment::get...

PT-2026-95245

Name of the Vulnerable Software and Affected Versions Tz Weekly Radio Schedule versions prior to 1.8.2 Description The plugin fails to sanitize and escape the week parameter before incorporating it into a SQL query within an AJAX action. This flaw allows unauthenticated attackers to execute SQL...

CVE-2026-84073: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-61820: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherittemplateproperties manually surrounds primary-key column names from pgattribute.attname with double quotes without escaping embedded double-quote characters. A partmanuser who owns a template...

CVE-2026-61817: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...

CVE-2026-52745: Improper Neutralization of Special Elements used in an SQL Command

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression...

CVE-2026-17619: Improper Neutralization of Special Elements used in an SQL Command

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2026-80441: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting...

CVE-2023-54399: Improper Neutralization of Special Elements used in an SQL Command

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

CVE-2021-48008: Improper Neutralization of Special Elements used in an SQL Command

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the siteid GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

CVE-2026-77927: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...

CVE-2026-93594: Incorrect Authorization

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93591: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGrap...

CVE-2026-4036: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-13683: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

CVE-2026-75961: Improper Neutralization of Special Elements used in an SQL Command

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...