The vulnerability of the ReadyScript e-commerce management system lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary code.

The vulnerability of the ReadyScript e-commerce management system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-59827

CVE-2026-59827 — Metabase에서 H2 쿼리 결과의 안전하지 않은 역직렬화 GHSA-w95f-x9v9-wv36 | CVSS 9.9 치명적 | CWE-502: 신뢰할 수 없는 데이터의 역직렬화 개요 CVE-2026-59827은 인기 있는 오픈소스 비즈니스 인텔리전스 및 데이터 분석 플랫폼인 Metabase의 치명적인 원격 코드 실행 취약점입니다. 이 결함은 Metabase가 H2 데이터베이스 연결에서 반환된 쿼리 결과를 처리하는 방식에서 비롯됩니다. H2 소스에 대한 네이티브 SQL 쿼리가 OTHER로 타입이 지...

ROS-20261002-73-0033

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261002-73-0031

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261001-73-0056

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

ROS-20261001-73-0057

The vulnerability of the SOGo collaborative software server lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to cause service failures remotely...

ROS-20260922-73-0135

The vulnerability in postgresqlanonymizer17 is related to the failure to implement proper protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

ROS-20260921-73-0136

The vulnerability in pgadmin4 is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-47252: Improper Control of Generation of Code

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...

Security Bulletin: IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine [CVE-2026-18069]

Summary IBM i is vulnerable to obtaining ownership of a file due to a time-of-check to time-of-use race condition CVE-2026-18069 in SQL Query Engine SQE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18069 DESCRIPTION: IBM i could allow a local attacker to...

CVE-2026-18069 IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use TOCTOU race condition...

CVE-2026-18069

CVE-2026-18069 is a time-of-check to time-of-use (TOCTOU) race condition in the SQL Query Engine (SQE) of IBM i (versions 7.3, 7.4, 7.5, and 7.6). A local attacker with low privileges can obtain ownership of arbitrary file system objects , resulting in a changed scope with low impact on confident...

CVE-2026-18069 IBM i is Affected By A Race Condition Vulnerability in SQL Query Engine []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use TOCTOU race condition...

CVE-2026-50006: Improper Limitation of a Pathname to a Restricted Directory

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...

GO-2026-6353 SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content in github.com/siyuan-note/siyuan/kernel

SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content in github.com/siyuan-note/siyuan/kernel...

PYSEC-2026-3945 WsgiDAV MySQL provider has a blind SQL injection

Summary The sample MySQLBrowserProvider builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read shares are...

CVE-2026-86123: Server-Side Request Forgery (SSRF)

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...

CVE-2026-78080: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite 5.1.0 - The cid parameter is used in queries without validation, allowing SQLi vectors...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

The vulnerability of the jsonArrayContains() function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, allows a perpetrator to execute arbitrary code.

The vulnerability of the jsonArrayContains function in the GeoTools library, a software solution for administrative and publishing of geodata on the OSGeo GeoServer server, is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability could allow an...