CVE-2026-56097 Rubygem-katello: sql injection in registry proxy via labels

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...

CVE-2026-56097 Rubygem-katello: sql injection in registry proxy via labels

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...

PYSEC-2026-4048 Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

Apache Doris MCP Server is vulnerable to SQL Injection via metadata query path

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

CVE-2026-102796

A flaw was found in the MediaWiki UserPageViewTracker extension. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted input through the filterusers or ignoreusers parameters. This allows the attacker to perform Structured Query Language SQL injection, potentiall...

CVE-2026-103690

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

Exploit for CVE-2026-62059

CVE-2026-62059 - Ultimate Member Stored SQL Injection Validati...

EUVD-2026-90888

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

CVE-2026-103690 itsourcecode Leave Management System controller.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

CVE-2026-103690 itsourcecode Leave Management System controller.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

CVE-2026-103690

A flaw in itsourcecode Leave Management System 1.0 allows for SQL injection due to insufficient handling of the LEAVEID argument within the /module/leave/controller.php file. This vulnerability can be exploited remotely, and an exploit has been published and may be used. No specific remediation o...

CVE-2026-62071

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

rubygem-katello: SQL injection in Registry Proxy via labels

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...

GHSA-33JQ-P8C2-Q3Q4 SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Summary The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when...

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Summary The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when...

EUVD-2026-90852

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62071 WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62071

The WordPress File Upload plugin (versions

CVE-2026-62071 WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62059

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...