CVE-2026-111444

Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled NOBACKSLASHESCAPES absent when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings th...

CVE-2026-111389

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2024-9465

CVE-2024-9465 Checkpoint SQL Injection via Time-Based Attack CVE-2024-9465 SHODAN SEARCH https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA SEARCH https://en.fofa.info/ body="Expedition Project" || title="Expedition Project" USAGE python3...

CVE-2026-111389 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111389

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111389 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111389

The Frappe HRMS software contains a SQL injection vulnerability in several endpoints across versions 14.x before 14.38.2 , 15.x before 15.64.0 , and 16.x before 16.18.0 . The root cause is missing input validation , which allows an authenticated attacker (including those with low-privilege accoun...

CVE-2026-111389 Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

EUVD-2026-102570

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

PT-2026-115477

Name of the Vulnerable Software and Affected Versions affiliate-toolkit WordPress plugin versions prior to 3.8.9 Description The plugin fails to validate a user-supplied sort value against an allowlist before incorporating it into a database query. Because the affected administrative list screen...

PT-2026-115440

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value $value-$xarg s from $wpdb-get results' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for...

Wheels 4.1.2 SQL Injection

Wheels versions through 4.1.2 contain a SQL injection issue on MySQL and MariaDB when request data reaches inline-literal query paths. This proof of concept verifies the issue and can extract scalar query results. https://packetstorm.news/download/236047...

PT-2026-115847

When Gitea's built-in SSH server is enabled START SSH SERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

PT-2026-116033

🚨 CVE-2026-111634 Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to /executeDatasource. Attackers can supply crafted Numeric or String placeholder values that bypass the broken...

PT-2026-115894

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO BACKSLASH ESCAPES mode, including in...

PT-2026-115893

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

PT-2026-116153

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

PT-2026-115537

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint...

CVE-2026-111472: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint...

CVE-2026-100158: Improper Neutralization of Input During Web Page Generation

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value $value-$xargs from $wpdb-getresults' parameter in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for...