CVE-2026-111444

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...

EUVD-2026-102606

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...

CVE-2026-111444

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...

CVE-2026-111444

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...

CVE-2026-111444

The Wheels library versions through 4.1.2 is vulnerable to SQL injection when used with MySQL/MariaDB databases that have backslash escaping enabled (missing NO_BACKSLASH_ESCAPES). The root cause is that doubling single quotes without accounting for backslash escapes allows an attacker to alter q...

CVE-2026-111444

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...

CVE-2026-111389

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2024-9465

CVE-2024-9465 Checkpoint SQL Injection via Time-Based Attack CVE-2024-9465 SHODAN SEARCH https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA SEARCH https://en.fofa.info/ body="Expedition Project" || title="Expedition Project" USAGE python3...

rConfig 3.9 - SQL Injection

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. id: CVE-2020-10220 info: name: rConfig 3.9 - SQL Injection author: ritikchaddha,theamanrawat severity: critical description: | An issue was discovered i...

CVE-2026-111389 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111389 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111389 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

EUVD-2026-102570

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111389

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111389

The Frappe HRMS software contains a SQL injection vulnerability in several endpoints across versions 14.x before 14.38.2 , 15.x before 15.64.0 , and 16.x before 16.18.0 . The root cause is missing input validation , which allows an authenticated attacker (including those with low-privilege accoun...

PT-2026-115498

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to generic SQL Injection via the 'dataorderby' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-111634: Improper Neutralization of Special Elements used in an SQL Command

Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken SqlDetect guard to...

PT-2026-115467

Name of the Vulnerable Software and Affected Versions Mobile builder WordPress plugin versions prior to 1.4.3 Description Unauthenticated users can perform SQL injection attacks on sites that use the WCFM Delivery add-on. This occurs because the plugin fails to sanitize and escape a parameter...

PT-2026-115603

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 5 through 5.0.4 Description An issue involving missing authentication for critical functions and improper neutralization of special elements used in SQL commands allows for SQL Injection. This occurs when certain backend...

PT-2026-116033

🚨 CVE-2026-111634 Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken...