282590 matches found
CVE-2026-108604
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass
CVE-2026-17351 — pgAdmin 4 AI Assistant Read-Only Bypass via Lexer Differential PoC for CVE-2026-17351, a critical CVSS 9.0 SQL injection bypass in pgAdmin 4's AI Assistant. Vulnerability Summary pgAdmin 4 versions 9.13 through 9.16 use Python's sqlparse library to validate that LLM-generated SQL...
CVE-2019-9053
CMS Made Simple Extracts data character by character by checking response delays. Extracts: Salt cmssiteprefs table Admin username cmsusers Admin email cmsusers Admin password hash cmsu...
CVE-2023-25157
CVE-2023-25157 GeoServer OGC Filter SQL Injection Vulnerabilities...
CVE-2021-26837
CVE-2021-26837 SQL Injection in HelpSystems / Fortra DeliverNow The SearchTextbox parameter on DeliverNow's log search page /LogGrid.aspx is concatenated directly into a SQL Server query with no parameterisation and no server-side validation. The application also rendered the resulting SQL Server...
CVE-2026-108604 Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
EUVD-2026-96505
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62117 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - SQL Injection vulnerability
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62117
The WordPress Barcode Scanner with Inventory & Order Manager plugin (versions
EUVD-2026-96466
Unauthenticated SQL Injection in uListing = 2.2.0 versions...
CVE-2026-62031 WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in uListing = 2.2.0 versions...
CVE-2026-62031
The uListing WordPress plugin (versions
EUVD-2026-96456
Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...
CVE-2026-45440 WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability
Administrator SQL Injection in WP Ultimate CSV Importer = 9.2 versions...
CVE-2026-45440
The WP Ultimate CSV Importer plugin for WordPress, specifically versions
EUVD-2026-96452
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-42722 WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - SQL Injection vulnerability
Administrator SQL Injection in Frontend Admin by DynamiApps = 3.29.13 versions...
CVE-2026-42722
The Frontend Admin by DynamiApps WordPress plugin, in versions