VulnCheck KEV: CVE-2015-7297

SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858...

PT-2026-115917

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

Frappe HRMS 16.x Authenticated Blind SQL Injection

Frappe HRMS versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contain an authenticated blind SQL injection vulnerability that permits extraction of sensitive database information. https://packetstorm.news/download/236048...

CVE-2026-110179: Improper Neutralization of Special Elements used in an SQL Command

The affiliate-toolkit WordPress plugin before 3.8.9 does not validate a user-supplied sort value against an allowlist before using it in a database query, and the affected administrative list screen requires only a lower-privilege capability rather than an administrator one, so users with...

PT-2026-115670

Name of the Vulnerable Software and Affected Versions MariaDB server versions 10.6.1 through 10.6.27 MariaDB server version 10.11.18 and earlier MariaDB server version 11.4.12 and earlier MariaDB server version 11.8.8 and earlier MariaDB server version 12.3.2 and earlier MariaDB server version...

PT-2026-116091

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to ga...

PT-2026-115918

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO BACKSLASH ESCAPES mode, including in...

PT-2026-116158

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 15.60.3 Frappe HR versions prior to 16.7.1 Description The Salary Payments via ECS report constructs report conditions using unsafe SQL string interpolation. An authenticated HR user can inject SQL by providing...

Apache Kylin information disclosure vulnerability

Versions 4 through 5.0.4 of Apache Kylin contain an information disclosure vulnerability. This vulnerability arises from SQL blacklists being exposed to unauthorized actors, potentially leading to unauthorized access to those SQL blacklists...

CVE-2026-94388: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3...

CVE-2026-103518: Improper Neutralization of Special Elements used in an SQL Command

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants. ' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-111389: Improper Neutralization of Special Elements used in an SQL Command

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extra...

CVE-2026-111106: Improper Neutralization of Special Elements used in an SQL Command

The Mail Mint plugin for WordPress is vulnerable to SQL Injection via the 'filters' parameter of the /wp-json/mrm/v1/segments/contacts REST endpoint in versions up to, and including, 1.31.4 This is due to insufficient escaping on the user supplied filter 'value' before it is appended to a SQL que...

CVE-2026-109414: Improper Neutralization of Special Elements used in an SQL Command

The Vitepos – Point of Sale POS for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the 'srcby.val.start / srcby.val.end operator 'bt'' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2026-111685: Improper Neutralization of Special Elements used in an SQL Command

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a crafted num path parameter to /WebResource/findresourcebynum. Attackers can append SQL after the LIMIT clause concatenated via QueryWrapper.last to extract databa...

CVE-2026-93953: Improper Neutralization of Special Elements used in an SQL Command

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field second-order, via restore in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient...

Linux Distros Unpatched Vulnerability : CVE-2026-86047

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW...

CVE-2026-111700: Improper Neutralization of Special Elements used in an SQL Command

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/enUS/eql, escaping the unsanitized EqlBuilder SQL...

PT-2026-116099

🚨 CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQL query API. Attackers can send crafted single-quoted literals to POST /api/v3/en US/eql, escaping the unsanitized...

PT-2026-115400

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products.variants.' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...