PT-2026-113637

Name of the Vulnerable Software and Affected Versions Hyyan WooCommerce Polylang Integration versions prior to 1.5.1 Description An issue exists where authenticated users with Subscriber-level access and above can perform SQL Injection. This occurs via the variation ids parameter of the...

PT-2026-113618

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-55683: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract$REQUEST and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT...

PT-2026-113961

Name of the Vulnerable Software and Affected Versions Nessus affected versions not specified Description An SQL injection allows an authenticated user to read or modify data stored by the system. SQL injection is a technique where malicious SQL statements are inserted into entry fields for...

CVE-2026-104141: Improper Neutralization of Special Elements used in an SQL Command

DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvid...

PT-2026-113610

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta value in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the...

CVE-2026-94348: Improper Neutralization of Special Elements used in an SQL Command

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-105067: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

CVE-2026-97668: Improper Neutralization of Special Elements used in an SQL Command

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent metavalue in all versions up to, and including, 10.8.0 due to insufficient escaping on user supplied data and lack of sufficient preparation on the existing SQL query in the...

CVE-2026-105107: Improper Neutralization of Special Elements used in an SQL Command

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-55681: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit idproduto to web/html/matPat/restaurarprodutodesocultar.php, where a second extract$REQUEST overwrites the value previously sanitized by intval. The...

CVE-2026-96661: Improper Neutralization of Special Elements used in an SQL Command

The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmediain' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2026-113849

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on SRX Series affected versions not specified Description An SQL Injection issue exists in the ipfd component, where special elements used in an SQL command are not properly neutralized. This allows an unauthenticated...

PT-2026-114328

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An SQL injection issue exists within the Custom Reports module. This occurs due to the improper neutralization of special elements used i...

CVE-2026-89076: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Progress MOVEit Transfer Custom Reports module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

PT-2026-114106

A vulnerability was found in cemtan sar2html 4.0.0. The affected element is the function updateDb of the file sar2html.py of the component Archive Processing. The manipulation of the argument s2host results in sql injection. The attack can be launched remotely. The project was informed of the...

CVE-2026-55680: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastrocobranca.php can place a quoted SQL expression in the codigo parameter, which extract$REQUEST passes into the WHERE codigo= clause of an UPDATE statement without...

CVE-2026-101926: Improper Neutralization of Special Elements used in an SQL Command

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...

CVE-2026-73796: SQL Injection: Hibernate

A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query...

CVE-2026-103946: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...