EUVD-2026-101441

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...

CVE-2026-89076

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

WordPress Link Library SQL Injection Vulnerability

WordPress Link Library versions 7.9.2 and earlier have a SQL injection vulnerability. This vulnerability stems from time-based SQL injections via the linkurl parameter. The user input parameters are not properly escaped, and existing SQL queries lack proper preparation. This allows unauthenticate...

WordPress Amelia SQL Injection Vulnerability

WordPress Amelia versions 2.4.10 and earlier have a SQL injection vulnerability. This vulnerability stems from improper neutralization of special elements in SQL commands, making them susceptible to SQL injection attacks...

MsgByte Tianji SQL Injection Vulnerability

Versions of MsgByte Tianji before 1.31.29 have a SQL injection vulnerability. This vulnerability stems from the getDateQuery function in src/server/utils/prisma.ts, which interpolates the timezone request value using Prisma.sql. Without parameter binding, attackers can inject SQL statements throu...

WordPress Mang Board SQL Injection Vulnerability

WordPress’s Mang Board versions 2.4.4 and earlier have a SQL injection vulnerability. This vulnerability arises due to improper handling of special elements in SQL commands, which can lead to SQL injections...

Mayer Balint GYM has a SQL injection vulnerability

Mayer Balint GYM versions prior to 1.4.1 have a SQL injection vulnerability. This vulnerability arises from the use of GET parameters for searchname and searchemail in the admin/users/index.php file. These parameters are concatenated with the COUNT queries for user list and pagination...

WordPress Link Whisper – Free SQL Injection Vulnerability

WordPress Link Whisper Free 0.9.7 and earlier versions have a SQL injection vulnerability. This vulnerability stems from improper handling of special elements in SQL commands, which may lead to blind SQL injections...

Slican IPX SQL Injection Vulnerability

Slican versions prior to IPx 6.62.0100 have a SQL injection vulnerability. This vulnerability stems from the WebCTI service’s improper handling of user input in files such as webcti/adminjson.php. This could allow authenticated attackers to execute SQL injection attacks...

CVE-2026-110614

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful...

CVE-2026-110609

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-89076 MOVEit Transfer SQL injection in custom reporting

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89076

Progress MOVEit Transfer is impacted by an SQL injection vulnerability (CWE-89) within the Custom Reports module . The flaw stems from the improper neutralization of special elements used in SQL commands. This issue affects versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4 . The...

EUVD-2026-101158

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89076 MOVEit Transfer SQL injection in custom reporting

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-94348

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-108065

SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...

[SECURITY] [DSA 6561-1] sogo security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6561-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 14, 2026 https://www.debian.org/security/faq -...

CVE-2026-110614

The Yiuman citrus framework (versions through 0.15.0 ) is vulnerable to an ORDER BY SQL Injection within the citrus-support generic query framework. The root cause is the failure to validate the sortBy request parameter, allowing attackers to append unvalidated SQL to the ORDER BY clause. This vu...

CVE-2026-110614 Yiuman citrus through 0.15.0 ORDER BY SQL Injection via sortBy Parameter

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful...