240881 matches found
VulnCheck KEV: CVE-2019-25765
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...
PT-2026-71601
Administrator SQL Injection in MailChimp For WooCommerce 6.2 versions...
Vulnerability in contrib module (CVE-2026-15742)
PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL...
Vulnerability in core server (CVE-2026-15741)
PostgreSQL expression deparse allows SQL injection via EXTRACT argument SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands...
Vulnerability in core server (CVE-2026-18024)
PostgreSQL ascii function reads past end of buffer Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less...
Linux Distros Unpatched Vulnerability : CVE-2026-18024
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This...
PT-2026-71908
Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...
PT-2026-71691
A CMS contains a SQL injection vulnerability in admin/db data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table name GET or POST parameter. Attackers can perform table traversal,...
PT-2026-71520
Subscriber SQL Injection in CubeWP = 1.1.30 versions...
PT-2026-71501
Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...
PT-2026-71708
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...
PT-2026-71884
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can...
PT-2026-71507
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...
PT-2026-71511
Unauthenticated SQL Injection in Web Directory Free = 1.7.13 versions...
VulnCheck KEV: CVE-2024-58374
Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...
Vulnerability in client (CVE-2026-6464)
PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fai...
PT-2026-71506
Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...
PT-2026-71707
ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by...
Linux Distros Unpatched Vulnerability : CVE-2026-15741
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect...
