CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

CVE-2026-64657

Budibase is an open-source low-code platform affected by three SQL injection vulnerabilities in its PostgreSQL , Microsoft SQL Server , and MySQL database connectors (prior to 3.39.19). The root cause is that user-controlled schema and table configuration fields are interpolated directly into raw...

CVE-2026-75014

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getbarcodedata.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

EUVD-2026-60439

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getbarcodedata.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-75014

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getbarcodedata.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-75014

SourceCodester Pet Grooming Management Software 1.0 has a SQL injection in /admin/get_barcode_data.php via the barcode parameter, exploitable remotely without authentication. CVSS 7.5 HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:P/I:P/A:P), proof-of-concept published; no patch version or vendor fix d...

CVE-2026-75014 SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getbarcodedata.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-71472

The flaw resides in postgresql-start.sh within the search-v2-operator of acm-search-v2-rhel9. The WORK_MEM string supplied via a Search Custom Resource is passed unvalidated into both a bash script and an SQL query, enabling authenticated hub administrators or CR editors to inject shell commands ...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472 Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

EUVD-2026-60362

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-74254

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend...

CVE-2026-71491

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, groupcomments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAXGROUPINGTOKENS guard, causing quadratic CPU consumption through sqlparse.parse and sqlparse.formatsql, stripcomments=Tru...

CVE-2026-59894

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2026-50769

The CRM+ application before and including version 2025.6 from Brainformatik is vulnerable to SQL Injection time-based vulnerability. The check conflict endpoint index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true which is used to check any conflicts for user calendar is...

UBUNTU-CVE-2026-59893

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-54284 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...