CVE-2026-61852: Improper Neutralization of Special Elements used in an SQL Command

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-61851: Incomplete List of Disallowed Inputs

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-88402: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

CVE-2026-94110: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-94144: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library ormlib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been...

MariaDB SQL Injection

The vulnerability of the mysqlrealescapestring function in the MariaDB database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker to execute SQL injections remotely...

CVE-2026-88756

Pagekit CMS versions

Linux Distros Unpatched Vulnerability : CVE-2026-54354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and...

PT-2026-96030

Name of the Vulnerable Software and Affected Versions QCMS versions prior to 6.0.7 Description A remote SQL injection exists in the Content Detail Page component within the self Tmp function located in the Lib/Config/Controllers.php library. The issue occurs when the ID argument is manipulated...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

VulnCheck KEV: CVE-2026-48842

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuserquery plugin via a pregreplace backslash escape bypass...

CVE-2026-88402

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

PT-2026-96301

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description The runQuery function in server/modules/ai/orchestrator/tools/runQuery.js fails to perform runtime integer validation on the row limit parameter before interpolating it into a SQL LIMIT clause...

CVE-2026-88402

A SQL injection vulnerability exists in the checkSQL function of nocobase v2.1.21 . This flaw allows an attacker to inject crafted SQL statements to access sensitive database information . The vulnerability is rated as CRITICAL with a CVSS 3.1 score of 9.8, indicating a high impact on confidentia...

PT-2026-96305

Name of the Vulnerable Software and Affected Versions Pagekit CMS versions prior to 1.0.19 Description An unauthenticated attacker can perform SQL injection, a technique used to manipulate database queries, by submitting a malicious credentials array to the public login endpoint 'POST...

PT-2026-96288

Name of the Vulnerable Software and Affected Versions nocobase version 2.1.21 Description A SQL injection issue exists in the checkSQL function, which allows attackers to access sensitive database information by injecting crafted SQL statements. SQL injection is a technique where malicious SQL co...

PT-2026-96045

Name of the Vulnerable Software and Affected Versions drogonframework drogon versions prior to 1.9.14 Description A flaw in the ORM component affects the makeCriteria function within the orm lib/src/Criteria.cc library. A remote attacker can perform a SQL injection by manipulating the filter...

PT-2026-96040

Name of the Vulnerable Software and Affected Versions drogonframework drogon versions prior to 1.9.14 Description A remote SQL injection is possible within the ORM Mapper component. The issue resides in the Mapper::orderBy function located in the Mapper.h library, where improper handling of the...