CVE-2025-45871

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name...

PT-2026-106461

Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...

PT-2026-106436

Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services = 1.0.19 versions...

PT-2026-106777

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.87.9 Payload versions 4.0.0-canary.0 through 4.0.0-canary.26 Description An untrusted user can trigger SQL injection in the SQLite and Postgres adapters by submitting requests that query readable collections...

PT-2026-106789

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload versions prior to 4.0.0-canary.34 Payload Postgres packages versions prior to 3.73.0 Description An attacker with read and create or update access to a collection containing a json field or a blocks fie...

PT-2026-106485

SQL injection SQLi vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an...

PT-2026-106335

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin transaction.php. This manipulation of the argument Username causes sql...

PT-2026-106389

Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...

CVE-2026-105920: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file studentsignup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack ma...

WP < 7.1.3 - Author+ SQLi via WXR Export

Description WordPress does not properly validate some post meta values before using them in a database query when exporting content in some cases, which could allow users with Author-level access and above to store a crafted value that results in SQL injection executed when an administrator later...

PT-2026-107197

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...

AlmaLinux 8 : mariadb-connector-c (ALSA-2026:75674)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75674 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted t...

CVE-2026-105957: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/admin/viewproduct.php. Performing a manipulation of the argument Category results in sql injection. Remote exploitation of the attack is possible. The...

PT-2026-106421

Subscriber SQL Injection in Woffice = 5.4.35 versions...

PT-2026-106475

Subscriber SQL Injection in UDesign Core = 4.15.0 versions...

PT-2026-106443

Subscriber SQL Injection in Buddyboss Platform = 3.1.0 versions...

AlmaLinux 9 : mariadb-connector-c (ALSA-2026:75673)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75673 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted t...

dovecot security, bug fix, and enhancement update

1:2.3.16-15 - fix CVE-2026-33605: ManageSieve login deadlock caused by lone CR protocol violation RHEL-251995 1:2.3.16-14 - fix CVE-2026-42007: heap use-after-free in pigeonhole editmailsnapshot after deleteheader operation RHEL-251946 1:2.3.16-13 - fix CVE-2026-40018: incorrect escaping of...

RHEL 7 : Red Hat Single Sign-On 7.6.13 security update on RHEL 7 (Important) (RHSA-2026:76128)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76128 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 8 : Red Hat Single Sign-On 7.6.13 security update on RHEL 8 (Important) (RHSA-2026:76129)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76129 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...