CVE-2025-69295

CVE-2025-69295 — TeconceTheme Coven Core Blind SQL Injection Vulnerability CVE-2025-69295 is a SQL Injection vulnerability affecting the Coven Core component of the TeconceTheme Coven Core WordPress theme. The vulnerability exists due to improper neutralization of user-supplied input before it is...

PT-2026-95646

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The extension manages partitioned tables by time or ID. The functions run maintenance, show partitions, show partition info, undo partition, and partition data time interpolate the writable part...

CVE-2026-61819: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pgjobmon is installed and partconfig.jobmon is true, exception handlers in multiple pgpartman functions place pparenttable verbatim inside a SQL string literal used to call pgjobmon.addjob. A...

PT-2026-95599

Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is passed to a database query without sanitization after HRMS-encoding is stripped. An unauthenticated remote attacker can supply a crafted UNION SELECT payloa...

PT-2026-95628

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description The Analytic Grid Service Handler contains a SQL injection flaw. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, which may lead to...

PT-2026-95693

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A remote authenticated attacker can obtain sensitive information due to improper neutralization of special elements used in an SQL command, which leads to an SQL injection. SQL injection is...

CVE-2026-61820: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherittemplateproperties manually surrounds primary-key column names from pgattribute.attname with double quotes without escaping embedded double-quote characters. A partmanuser who owns a template...

CVE-2026-61818: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition reads partconfig.timeencoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partmanuser access can store...

CVE-2026-52745: Improper Neutralization of Special Elements used in an SQL Command

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page endpoint allows an authenticated caller with MODULESETTING:UPDATE to place a crafted sort.name value into a dynamic SQL ORDER BY expression...

CVE-2026-4036: Improper Neutralization of Special Elements used in an SQL Command

An improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Sharing API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain arbitrary sharing files...

CVE-2026-67100: Improper Neutralization of Special Elements used in an SQL Command

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

CVE-2026-93591: Improper Neutralization of Special Elements used in an SQL Command

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGrap...

CVE-2026-77928: Improper Neutralization of Special Elements used in an SQL Command

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msgid parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass unsanitize...

CVE-2026-85705: Improper Neutralization of Special Elements used in an SQL Command

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2026-75961: Improper Neutralization of Special Elements used in an SQL Command

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additionalparams' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2026-84073: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-84064: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

CVE-2026-81626: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-80441: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting...

CVE-2026-84239: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command...