CVE-2026-67100: Improper Neutralization of Special Elements used in an SQL Command

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to...

CVE-2026-15275: Improper Neutralization of Special Elements used in an SQL Command

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-87775: Improper Neutralization of Special Elements used in an SQL Command

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-87771: Improper Neutralization of Special Elements used in an SQL Command

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

CVE-2026-18912: Improper Neutralization of Special Elements used in an SQL Command

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module...

PT-2026-95373

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.9.1 Description Access-control rules for per-type and per-record permissions are only enforced in LocalBucket. Query-execution paths accessing record data via LSM Log-Structured Merge-tree index files or the...

PT-2026-95315

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...

PT-2026-95287

Name of the Vulnerable Software and Affected Versions WP Multi Store Locator Pro versions prior to 4.5.2 Description An issue exists where unauthenticated attackers can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs...

PT-2026-95293

Name of the Vulnerable Software and Affected Versions NEX-Forms – Ultimate Forms Plugin for WordPress versions prior to 9.3.1 Description An issue exists where authenticated attackers with custom-level access and above can perform a generic SQL Injection. This occurs because the additional params...

PT-2026-95294

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions prior to 1.8.45 Description This issue is a time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait for a...

PT-2026-95649

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The inherit template properties function manually surrounds primary-key column names from pg attribute.attname with double quotes without escaping embedded double-quote characters. A user with...

PT-2026-95370

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.3 Description An SQL injection issue exists in the query2Stmt function within graph.go. The flaw occurs because tag values are concatenated directly into SQL string literals without escaping single quotes. A...

PT-2026-95242

Name of the Vulnerable Software and Affected Versions wp shortcut link and advertisement baner WordPress plugin versions prior to 1.2.1 Description An issue exists where a parameter is not sanitized or escaped before being used in a SQL query within an AJAX action accessible to unauthenticated...

PT-2026-95690

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An issue exists where a remote authenticated attacker can obtain sensitive information. This occurs due to improper neutralization of special elements used in an SQL command, a condition...

PT-2026-95647

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description The undo partition function reads the time encoder variable from the part config table as unrestricted text and interpolates it into a dynamically executed SELECT statement without identifier...

PT-2026-95648

Name of the Vulnerable Software and Affected Versions pg partman versions prior to 5.5.0 Description When pg jobmon is installed and part config.jobmon is set to true, exception handlers in several functions place the p parent table variable verbatim into a SQL string literal used to call the pg...

PT-2026-95684

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Improper neutralization of special elements used in an SQL command allows a remote attacker to execute arbitrary SQL commands. This issue is a form of SQL injection, where an attacker can...

PT-2026-95267

Name of the Vulnerable Software and Affected Versions InfiniteWP Client plugin for WordPress versions prior to 1.14.0 Description An issue exists in the get comments action where insufficient escaping of array-key names in the JSON request body allows for SQL Injection. The IWP MMB Comment::get...

PT-2026-95246

Name of the Vulnerable Software and Affected Versions Tz Weekly Radio Schedule versions prior to 1.8.2 Description The plugin fails to sanitize and escape a parameter used to construct a SQL query within an AJAX action accessible to unauthenticated users. This allows remote attackers to execute S...

PT-2026-95243

Name of the Vulnerable Software and Affected Versions Price Drop Alert for Woo Commerce WordPress plugin versions prior to 1.2 Description An issue exists where the plugin fails to sanitize and escape parameters used in a SQL query within an AJAX action accessible to unauthenticated users. This...