CVE-2026-78472: Improper Neutralization of Special Elements used in an SQL Command

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks...

PT-2026-118160

Уязвимость платформы управления политиками соединений Cisco Identity Services Engine ISE связана с непринятием мер по защите структуры запроса SQL, Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольные SQL-запросы...

CVE-2026-86865: Improper Neutralization of Special Elements used in an SQL Command

Tanium addressed a SQL injection vulnerability in Asset...

CVE-2026-92406: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/btnfunctions.php?action=add. Performing a manipulation of the argument difficultyid results in sql injection. Remote exploitatio...

CVE-2026-76556: Improper Neutralization of Special Elements used in an SQL Command

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some export filter values before using them in SQL statements, allowing users holding its export permission, which administrators have by default and may also grant to lower roles, to perform SQL...

ALSA-2026:67848 Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: SQL injection in pgcreatesubscriber allows arbitrary SQL execution as superuser CVE-2026-6476 postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector an...

Cisco Secure Email Gateway SQLi (cisco-sa-esa-inj-2bLVGmhX)

According to its self-reported version, Cisco Secure Email Gateway is affected by a SQL injection vulnerability. - A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to execute arbitrary commands with root...

PT-2026-93994

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to perform a SQL injection attack. This occurs due to insufficient validation of...

CVE-2026-92465: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Themeum WP Mega Menu allows Blind SQL Injection. This issue affects WP Mega Menu: from n/a through 1.4.2...

CVE-2026-20344: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, remote attacker to perform a SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have a valid account on the device with the role of...

PT-2026-93845

Name of the Vulnerable Software and Affected Versions MikroORM versions prior to 6.6.16 MikroORM versions prior to 7.1.7 Description The shared SQL layer validates the field key of an orderBy clause but fails to validate its direction value before the AbstractSqlPlatform.getOrderByExpression...

CVE-2026-16588: Improper Neutralization of Special Elements used in an SQL Command

The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

PT-2026-93938

Tanium addressed a SQL injection vulnerability in Threat Response...

PT-2026-93708

Name of the Vulnerable Software and Affected Versions Themeum WP Mega Menu versions prior to 1.4.3 Description An improper neutralization of special elements used in an SQL command allows for Blind SQL Injection. Blind SQL Injection is a technique where an attacker asks the database true or false...

PT-2026-93740

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

PT-2026-94014

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-94016

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-94013

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine ISE affected versions not specified Cisco ISE Passive Identity Connector ISE-PIC affected versions not specified Description An authenticated remote attacker with valid administrative credentials can perform SQL ...

PT-2026-94065

Name of the Vulnerable Software and Affected Versions Coze Studio versions prior to 0.5.2 Description Authenticated attackers can execute SQL statements against memory databases of other workspaces to read, insert, or delete data. This occurs because the software fails to validate that table name...

PT-2026-94133

New CVE published: CVE-2026-71548 Sometimes you don't need to break the syntax, just go with it 🎯 Authenticated SQL injection in SuiteCRM's AOR Reports module High, CVSS 8.8. Any low-privileged user who can save a report could read the whole database, including the admin password hash. Fixed in...