PT-2026-114154

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1 Description An SQL injection issue exists in version 1 of the Microsoft SQL node. The node substitutes expression values from the Query field directly into SQL text without using...

PT-2026-113961

Name of the Vulnerable Software and Affected Versions Nessus affected versions not specified Description An SQL injection allows an authenticated user to read or modify data stored by the system. SQL injection is a technique where malicious SQL statements are inserted into entry fields for...

CVE-2026-95808: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-103307: Improper Neutralization of Special Elements used in an SQL Command

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

CVE-2026-42093: Improper Neutralization of Special Elements used in an SQL Command

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

CVE-2026-104142: Improper Neutralization of Special Elements used in an SQL Command

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store crafted FieldGroupDTO.min, FieldGroupDTO.max, FieldGroupDTO.startTime, or FieldGroupDTO.endTime values in dataset group-field binning definitions. Utils.transGroupFieldToSql inserts...

CVE-2026-110614: Improper Neutralization of Special Elements used in an SQL Command

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers can reach any generic list route of controllers extending BaseQueryController or BaseQueryRestful...

PT-2026-113980

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

PT-2026-114354

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-89310: Improper Neutralization of Special Elements used in an SQL Command

A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary SQL statements in the context of the application's database account...

PT-2026-114216

Name of the Vulnerable Software and Affected Versions e107 versions prior to 2.3.7 Description The bundled alt auth plugin in this content management system CMS contains a flaw in the otherdb and e107db authentication backends. The login methods in e107 plugins/alt auth/otherdb auth.php and e107...

RHEL 8 : mariadb-connector-c (RHSA-2026:83080)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83080 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

RHEL 8 : mariadb-connector-c (RHSA-2026:83079)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83079 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

CVE-2026-63165

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-63146

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile and DbInstall::dbControl, combined with an SQL injection issue enabl...

CVE-2026-63152

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

CVE-2026-110083

Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized...

EUVD-2026-100578

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...

CVE-2026-63165

The Omnispace Agora Project version prior to 26.10.0 is vulnerable to a SQL injection flaw within its calendar functionality. The root cause is the lack of sanitization for the sortEvents parameter, which is directly concatenated into an ORDER BY clause in the app/ModCalendar/CtrlCalendar.php fil...

CVE-2026-63165 Omnispace Agora Project < 26.10.0 SQL Injection via sortEvents Parameter

Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject malicious SQL by manipulating the sortEvents parameter, which is concatenated into the ORDER BY clause without sanitization in...