238012 matches found
CVE-2026-6230
The CVE-2026-6230 entry concerns the Tainacan WordPress plugin vulnerable to a time-based blind SQL Injection via the REST API parameter 'geoquery' in all versions up to 1.0.3. Root cause is insufficient escaping of the user-supplied parameter and inadequate preparation of the existing SQL query,...
CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter
The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
CVE-2026-6230
The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
CVE-2026-9700 Eventer <= 4.4.2 - Unauthenticated SQL Injection via 'code' Parameter
The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2026-9700
The CVE covers the WordPress Eventer plugin vulnerability up to version 4.4.2, caused by insufficient escaping of the user-supplied code parameter and inadequate SQL query preparation. This enables time-based SQL injection by unauthenticated attackers to append additional SQL to existing queries ...
CVE-2026-39178
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...
PT-2026-56314
Name of the Vulnerable Software and Affected Versions Eventer versions prior to 4.4.3 Description The plugin implements an insecure password reset mechanism. When a password reset is requested, a plaintext copy of the reset key is stored in the eventer verification code user meta field within the...
CVE-2026-39178
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint...
PT-2026-56661
Name of the Vulnerable Software and Affected Versions Location Selector versions 0.0.0 through 1.3.0 Description An SQL injection issue exists in the Location Selector module, which provides a Views filter for selecting location values. A specific Views filter fails to sufficiently sanitize value...
PT-2026-56409
Name of the Vulnerable Software and Affected Versions My Calendar – Accessible Event Manager versions prior to 3.7.9 Description An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of user-supplied input and a lack o...
PT-2026-56448
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.61 n8n versions prior to 2.27.4 n8n versions 2.28.0 through 2.28.0 Description A SQL injection issue exists in the legacy MySQL v1 node during the executeQuery operation. The system substitutes evaluated...
CVE-2026-39179
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality...
The vulnerability of the socket.io parser library’s encoder and decoder modules allows attackers to induce a service failure.
The vulnerability of the socket.io parser library’s encoder and decoder relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows an attacker to cause service failures remotely...
CVE-2026-39179
A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functionality...
Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072
The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist...
Linux Distros Unpatched Vulnerability : CVE-2026-14740
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the escapePostgreConnectionParameter function. An attacker can inject arbitrary PostgreSQL connection parameters by supplying specially crafted values containing non-space whitespace or backslash characters, which are...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the escapePostgreConnectionParameter function. An attacker can inject arbitrary PostgreSQL connection parameters by supplying specially crafted values containing non-space whitespace or backslash characters, which are...
CVE-2026-14740
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byt...
DEBIAN-CVE-2026-14740
DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byt...