CVE-2025-55787

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

Linux Distros Unpatched Vulnerability : CVE-2026-77874

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - org.hibernate/hibernate-core: Hibernate ORM: SQL Injection via unescaped JSON path segment allows data exfiltration and authorization...

PT-2026-95065

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.7.0 Description An authenticated user with the HR User role can perform SQL injection through filters in the Salary Payments Based on Payment Mode report. The issue occurs in the salary payments based on payment...

PT-2026-95130

Name of the Vulnerable Software and Affected Versions SigNoz versions 0.87.0 through 0.141.0 Description Authenticated users with a Viewer role or higher can perform SQL injection by providing specially crafted telemetry field-key names. The application fails to properly escape these names in the...

CVE-2026-54596: Improper Neutralization of Special Elements used in an SQL Command

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-66625: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WC Vendors Marketplace = 2.7.2.1 versions...

EmailTrack Component Code Execution

The vulnerability of the EmailTrack component in the cPanel web hosting control panel is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and gain full control over the server...

CVE-2026-54524: Improper Neutralization of Special Elements used in an SQL Command

Frappe HR is an open-source human resources management solution HRMS. Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In...

PT-2026-95101

Name of the Vulnerable Software and Affected Versions MapServer versions prior to 8.6.4 Description MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and the msPostGISLayerTranslateFilter function fails to verify that input from the CGI qstring or OGC API Features featureId is ...

PT-2026-95082

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

CVE-2026-53556: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2025-55787: Improper Neutralization of Special Elements used in an SQL Command

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists...

CVE-2026-92926: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partnerpreference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-66624: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...

CVE-2026-66619: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in Newsletters = 4.18 versions...

CVE-2026-87963: Improper Neutralization of Special Elements used in an SQL Command

The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database...

PT-2026-95138

Name of the Vulnerable Software and Affected Versions SQLBot versions prior to 1.9.0 Description An issue exists where the POST /api/v1/datasource/previewData endpoint incorporates the client-controlled table name value into generated SQL without safe identifier handling. An authenticated user ca...

CVE-2026-66630: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in PublishPress Series = 3.1.3 versions...

CVE-2026-93426: Improper Neutralization of Special Elements used in an SQL Command

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 queryrange API, allowing authenticated users to inject SQL. Attackers with Viewer role or higher can embed backticks and quotes in field names to break out of identifiers and string literals,...

PT-2026-95155

Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.5 Description An issue exists in the ecommerce software where the endpoint 'admin/sources/settings.index.inc.php' directly concatenates the download expire POST parameter into a raw UPDATE statement for CubeCart...