CVE-2026-63314 SQL Injection in WebCTI

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/adminjson.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100...

CVE-2026-63314 SQL Injection in WebCTI

WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/adminjson.php enpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks. This issue was fixed in IPx series version 6.62.0100...

CVE-2026-15090

The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'linkurl' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-15090 Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter

The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'linkurl' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-15090 Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' Parameter

The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'linkurl' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EUVD-2026-101847

The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'linkurl' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-15090

The Link Library plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 7.9.2 . The root cause is insufficient escaping on the link_url parameter and a lack of sufficient preparation on the existing SQL query. This flaw allows unauthenticated attacker...

DEBIAN-CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-110911

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders such as findOneByEmail, the query builder's whereproperty, value and whereproperty, operator, value, string/UUID-key lookup paths findByKey, updateByKey, deleteByKey and...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

EUVD-2026-101821

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-93484

The software Znuny (versions through 7.3.6 ) is vulnerable to SQL Injection (CWE-89) due to improper sanitization of user-supplied input. The vulnerability exists in the Kernel::System::Ticket::TicketSearch and Kernel::System::Ticket::ArticleSearchIndex::DB components when processing the ContentS...

CVE-2026-93484

Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...

CVE-2026-110911

The Wheels library versions 1.1.8 through 4.1.1 are vulnerable to SQL injection because the parser incorrectly treats a doubled single quote as the end of a literal. This flaw affects dynamic finders like findOneByEmail , query builder methods including where() , and various string/UUID-key looku...

CVE-2026-110911

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders such as findOneByEmail, the query builder's whereproperty, value and whereproperty, operator, value, string/UUID-key lookup paths findByKey, updateByKey, deleteByKey and...

CVE-2026-110911

Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders such as findOneByEmail, the query builder's whereproperty, value and whereproperty, operator, value, string/UUID-key lookup paths findByKey, updateByKey, deleteByKey and...