237373 matches found
CVE-2026-12512
The Quotes llama WordPress plugin before 3.1.6 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform UNION-based SQL injection and read arbitrary data from the database, including password hashes...
SUSE CVE-2026-15043
DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the ismatched method, = was evaluated using Perl's le operator...
CVE-2026-11851
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' ...
PT-2026-58893
Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An issue exists in the Report Execution API 'runreports' endpoint where report parameter values are incorporated into the generated SQL query without sufficient validation. This allows an...
PT-2026-60296
Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.0.61 Description An issue exists in the @nocobase/plugin-notification-in-app-message where the 'GET /api/myInAppChannels:list' endpoint is exposed. A signed-up authenticated user can exploit this by providing a val...
PT-2026-58895
Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An authenticated user with permissions to view clients can exploit a boolean-based SQL Injection in the Client Search API endpoint '/api/v1/clients'. The issue occurs because the orderBy and...
Ubuntu 26.04 LTS : MariaDB vulnerabilities (USN-8536-1)
The remote Ubuntu 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8536-1 advisory. It was discovered that MariaDB did not properly validate parameters supplied by a joiner node during a State Snapshot Transfer using the mariabackup...
CVE-2026-48324
ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary...
CVE-2026-48324
CVE-2026-48324 : ColdFusion is affected by an SQL Injection vulnerability (Improper Neutralization of Special Elements used in an SQL Command) that could lead to arbitrary code execution in the context of the current user. Exploitation does not require user interaction, and the scope is reported ...
CVE-2026-48324 ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary...
CVE-2026-47992
Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL...
GHSA-HWRQ-8WXH-Q4XV Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
Summary Anyquery's server mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules e.g., jsonreader, logreader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to internal network endpoints or...
CVE-2026-47992 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL...
CVE-2026-47992 Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL...
EUVD-2026-44031
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...
CVE-2026-45073
CVE-2026-45073 affects Symfony’s PHP framework, specifically the PdoAdapter::doClear() path. Prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the code builds a DELETE with a namespace derived from caller-supplied prefix without binding or escaping it, allowing an attacker who controls the pr...
CVE-2026-45073 Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller...
Vulnerabilities in Microsoft SQL Server
Microsoft has addressed vulnerabilities in various components of SQL Server. A malicious individual could exploit these vulnerabilities to gain elevated privileges, execute arbitrary code, and/or access sensitive data. SQL Server: | CVE-ID | CVSS | Impact | |-------|------|---------| |...