CVE-2026-85714

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

CVE-2026-55572

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

CVE-2026-42093

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

CVE-2026-55572 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

CVE-2026-55572 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

CVE-2026-55572

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

CVE-2026-55572

The e107 content management system (CMS) is vulnerable to SQL injection in versions prior to 2.3.7 . The issue exists within the bundled alt_auth plugin 's otherdb and e107db authentication backends. Specifically, the login() methods in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_...

EUVD-2026-101531

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

CVE-2026-55572 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

CVE-2026-42093

The Redash data visualization package (versions after 8.0.0 until 26.9.0 ) is vulnerable to SQL Injection in the Query Results query runner located in redash/query_runner/query_results.py. The flaw occurs because the system accepts param_query_N_{key=value} parameters and passes attacker-controll...

EUVD-2026-101515

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

CVE-2026-42093 Redash: SQL Injection via Query Results parameterized query substitution

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

CVE-2026-42093 Redash: SQL Injection via Query Results parameterized query substitution

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

CVE-2026-42093 Redash: SQL Injection via Query Results parameterized query substitution

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

CVE-2026-42093

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

CVE-2026-103946

An SQL injection vulnerability could allow an authenticated user to read or modify data stored by Nessus...

CVE-2026-101997

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection...

CVE-2026-101997 Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection...

CVE-2026-101997

Juniper Networks Junos OS on SRX Series is vulnerable to an SQL Injection vulnerability within the ipfd component. An unauthenticated network-based attacker can exploit this flaw to achieve Remote Code Execution with root privileges when a Security Intelligence feed connection is configured witho...

CVE-2026-101997 Junos OS: SRX Series: A network-based attacker causes Remote Code Execution when Security Intelligence is used without a tls-profile authentication

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ipfd of Juniper Networks Junos OS on SRX Series allows an unauthenticated network-based attacker to execute code with root privileges via a configured Security Intelligence feed connection...