PT-2026-95599

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

CVE-2026-61819: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pgjobmon is installed and partconfig.jobmon is true, exception handlers in multiple pgpartman functions place pparenttable verbatim inside a SQL string literal used to call pgjobmon.addjob. A...

CVE-2026-87767: Improper Neutralization of Special Elements used in an SQL Command

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data...

CVE-2026-18912: Improper Neutralization of Special Elements used in an SQL Command

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

PT-2026-95243

Name of the Vulnerable Software and Affected Versions Price Drop Alert for Woo Commerce WordPress plugin versions prior to 1.2 Description An issue exists where the plugin fails to sanitize and escape parameters used in a SQL query within an AJAX action accessible to unauthenticated users. This...

CVE-2026-13683: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability in EventScheduler API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to obtain...

CVE-2026-77927: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...

PT-2026-95792

Name of the Vulnerable Software and Affected Versions GoPay for WooCommerce versions prior to 1.0.37 Description An issue exists where authenticated attackers with shop manager-level access or higher can perform a generic SQL Injection. This occurs because the plugin fails to sufficiently escape...

CVE-2026-87774: Improper Neutralization of Special Elements used in an SQL Command

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

PT-2026-95597

Name of the Vulnerable Software and Affected Versions Weaver E-cology affected versions not specified Description An unauthenticated SQL injection allows remote attackers to execute arbitrary SQL queries. This occurs when malicious input is submitted through the userIdentifiers GET parameter in t...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-sql-inj-3QTKR947)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input...

CVE-2026-67100: Improper Neutralization of Special Elements used in an SQL Command

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

ColdFusion SQL Injection Code Execution

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-85705: Improper Neutralization of Special Elements used in an SQL Command

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

EulerOS Virtualization 2.12.0 : perl-DBI (EulerOS-SA-2026-3659)

According to the versions of the perl-DBI package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : DBI::ProfileData versions before 1.651 for Perl do not limit the path index.The path index column of profile dump files is used to...

EulerOS 2.0 SP10 : proftpd (EulerOS-SA-2026-3760)

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the...

CVE-2021-48008: Improper Neutralization of Special Elements used in an SQL Command

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the siteid GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

PT-2026-95304

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management affected versions not specified Description An authenticated attacker can exploit a SQL Injection flaw and a Cross-Tenant Data Exposure flaw. These issues allow the injection of database commands to extract...

PT-2026-95244

Name of the Vulnerable Software and Affected Versions Product Question and Answer versions prior to 1.1.1 Description The Product Question and Answer WordPress plugin fails to sanitize and escape parameters used in SQL queries during AJAX actions accessible to unauthenticated users. This allows a...

PT-2026-95690

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An issue exists where a remote authenticated attacker can obtain sensitive information. This occurs due to improper neutralization of special elements used in an SQL command, a condition...