220250 matches found
Fortra FileCatalyst Workflow <= v5.1.6 - SQL Injection
A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this...
WordPress Ultimate Member 2.1.3 - 2.8.2 – SQL Injection
The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘sorting’ parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied parameter and lack of...
PT-2026-71515
Subscriber SQL Injection in Do Lasso = 358 versions...
PT-2026-71528
Subscriber SQL Injection in Form Maker by 10Web = 1.15.44 versions...
PT-2026-71577
Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...
PT-2026-71909
Budibase before 3.40.0 contains a SQL injection vulnerability in the Oracle datasource connector's post-write row lookup that fails to escape table names in identifiers. Attackers with write permission on a table with a double-quote in its name can inject SQL that executes as the datasource's...
PT-2026-71822
IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...
PT-2026-71478
Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description An SQL injection exists in the EXTRACT deparse...
PT-2026-71916
Budibase is an open-source low-code platform. Prior to 3.39.18, packages/server/src/integrations/mysql.ts enabled multipleStatements and inserted an unescaped tableName into a DESCRIBE statement. An attacker able to create a MySQL table with a backtick and stacked statement in its name could wait...
PT-2026-71557
Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...
PT-2026-71674
A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be...
PT-2026-71601
Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...
PT-2026-71539
Unauthenticated SQL Injection in Listdom = 5.6.0 versions...
VulnCheck KEV: CVE-2019-25765
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...
Vulnerability in core server (CVE-2026-15741)
PostgreSQL expression deparse allows SQL injection via EXTRACT argument SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands...
PT-2026-71908
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...
PT-2026-71507
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...
PT-2026-71520
Subscriber SQL Injection in CubeWP = 1.1.30 versions...
PT-2026-71884
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...