CVE-2026-81626: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated user can inject SQL statements through the Load Balancer Servlet endpoint, potentially resulting in unauthorized access to data and impact to the...

CVE-2026-87770: Improper Neutralization of Special Elements used in an SQL Command

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the...

PT-2026-95230

Name of the Vulnerable Software and Affected Versions ManageEngine DataSecurity Plus versions prior to 6310 Description An authenticated technician can execute arbitrary SQL queries through the Reports module. This is caused by a SQL injection, which occurs when untrusted data is inserted into a...

CVE-2026-84105: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command...

CVE-2026-84239: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization of special elements used in an SQL command...

CVE-2026-61818: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition reads partconfig.timeencoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partmanuser access can store...

PT-2026-95245

Name of the Vulnerable Software and Affected Versions Tz Weekly Radio Schedule versions prior to 1.8.2 Description The plugin fails to sanitize and escape the week parameter before incorporating it into a SQL query within an AJAX action. This flaw allows unauthenticated attackers to execute SQL...

CVE-2026-84064: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

EulerOS 2.0 SP10 : proftpd (EulerOS-SA-2026-3760)

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-mult-vul-ymSsTLCc)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. CVE-2026-20284 - A vulnerability in the SXP REST API of Cisco ISE could all...

Cisco Nexus Dashboard Software Security Hardening Release: September 2026 (cisco-sa-hardening-ndw1-psFvnrg)

According to its self-reported version, Cisco Nexus Dashboard is affected by multiple vulnerabilities. - An improper access control vulnerability affecting authorization, authentication, privileges, and bypasses. CVE-2026-20322 - An improper neutralization of special elements used in a command...

EulerOS 2.0 SP10 : proftpd (EulerOS-SA-2026-3713)

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the...

PT-2026-95290

Name of the Vulnerable Software and Affected Versions WP Inventory Manager versions prior to 2.5.2 Description Authenticated attackers with Contributor-level access and above can perform SQL Injection through the where shortcode attribute of the wpinventory shortcode. The issue occurs in the...

CVE-2026-93426

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 queryrange API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals,...

CVE-2026-54647

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled downloadexpire POST parameter into a raw UPDATE statement for CubeCartdownloads without numeric validation. An authenticated administrator can supply...

CVE-2026-54646

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated...

CVE-2026-53557

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53556

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-54647 CubeCart : SQL Injection via download_expire Parameter in settings.index.inc.php

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled downloadexpire POST parameter into a raw UPDATE statement for CubeCartdownloads without numeric validation. An authenticated administrator can supply...

CVE-2026-54647

CubeCart (ecommerce software) prior to 6.7.5 contains an SQL injection vulnerability in admin/sources/settings.index.inc.php (line 184). The administrator-controlled download_expire POST parameter is concatenated directly into a raw UPDATE statement on CubeCart_downloads without numeric validatio...