CVE-2026-55683: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract$REQUEST and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT...

CVE-2026-110668: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and coul...

CVE-2026-110609: Improper Neutralization of Special Elements used in an SQL Command

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-94348: Improper Neutralization of Special Elements used in an SQL Command

Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service...

CVE-2026-105067: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

CVE-2026-103307: Improper Neutralization of Special Elements used in an SQL Command

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL...

...[ More ]

This Metasploit module exploits an authenticated command injection vulnerability in Grafana's experimental SQL Expressions feature. Affected Grafana releases are 11.0.0 through 11.0.6, 11.1.0 through 11.1.7, and 11.2.0 through 11.2.2. They pass attacker-controlled SQL expressions to DuckDB withou...

CVE-2026-42093: Improper Neutralization of Special Elements used in an SQL Command

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryNkey=value parameters and passed attacker-controlled values to replacequeryparameters for raw substitution into a...

PT-2026-114222

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro cobranca.php endpoint accepts POST input through extract$ REQUEST and directly incorporates valor, valor pago, id pessoa, id socio, and id sociotipo into UPDATE, INSERT, and...

CVE-2026-101926: Improper Neutralization of Special Elements used in an SQL Command

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variationids' parameter of the 'woocommerceremovevariations' AJAX action in versions up to, and including, 1.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficie...

Security Updates for Microsoft SQL Server (October 2026)

The Microsoft SQL Server installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. CVE-2026-65674 - Heap-based buffer overflow...

RHEL 8 : mariadb-connector-c (RHSA-2026:83079)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:83079 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes: mariad...

CVE-2026-95808: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all versions up to, and including, 1.15.48 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-105107: Improper Neutralization of Special Elements used in an SQL Command

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/catissuestop.pl script sub calculate concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an...

CVE-2026-102251: Improper Neutralization of Special Elements used in an SQL Command

The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versions up to, and including, 10.8.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-78193: Improper Neutralization of Special Elements used in an SQL Command

The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL quer...

CVE-2026-108065: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection CWE-89 in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce VERSION — missing allows an unauthenticated remote attacker to read, write, and potentially execute commands on the backend Microsoft SQL Server via a crafted sUserID...

PT-2026-113980

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Webnus Modern Events Calendar Lite modern-events-calendar-lite allows Blind SQL Injection.This issue affects Modern Events Calendar Lite: from n/a before 7.37.0...

PT-2026-113976

DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat for a dataset field. DatasetTableFieldDTO.dateFormat is inserted without validation into date conversion templates used by Dimension2SQLObj, CustomWhere2Str...

PT-2026-114328

Name of the Vulnerable Software and Affected Versions MOVEit Transfer versions prior to 2025.1.6 MOVEit Transfer versions 2026.0.0 through 2026.0.3 Description An SQL injection issue exists within the Custom Reports module. This occurs due to the improper neutralization of special elements used i...