288143 matches found
PT-2026-111281
A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been...
PT-2026-118111
Уязвимость среды для администрирования баз данных SQL Server Management Studio SSMS и набора инструментов Visual Studio Tools for Applications VSTA средства разработки программного обеспечения Microsoft Visual Studio связана с неверным управлением генерацией кода. Эксплуатация уязвимости может...
PT-2026-112353
Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description An issue exists where improper neutralization of special elements used in an SQL command leads to SQL injection. This allows an authorized attacker to elevate privileges...
PT-2026-113435
Name of the Vulnerable Software and Affected Versions SQL Server affected versions not specified Description A heap-based buffer overflow allows an authorized attacker to elevate privileges over a network. A heap-based buffer overflow occurs when a program writes more data to a heap memory buffer...
PT-2026-111676
Name of the Vulnerable Software and Affected Versions SourceCodester Online Exam System version 1.0 Description An issue exists in the Login Endpoint within the file adminpanel/admin/query/loginExe.php. Remote manipulation of the username and pass arguments allows for SQL injection, a technique...
CVE-2026-63154: Improper Neutralization of Special Elements used in an SQL Command
Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged...
Siemens RUGGEDCOM CROSSBOW
SUMMARY RUGGEDCOM CROSSBOW contains multiple vulnerabilities that could allow an attacker to execute arbitrary SQL commands on the underlying database, retrieve sensitive administrative credentials, escalate privileges, and perform unauthorized operations such as modifying system configurations...
CVE-2026-89201: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute...
PT-2026-111306
The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...
PT-2026-111672
An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...
CVE-2026-70049: Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network...
Microsoft SQL Server: CVE-2026-88085: Microsoft SQL Server Elevation of Privilege Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally...
PT-2026-111395
Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Authenticated attackers with specific privileges can execute arbitrary SQL commands on the underlying database. This occurs because the system fails to properly validate or sanitize the...
CVE-2026-23707: Improper Neutralization of Special Elements used in an SQL Command
An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...
CVE-2026-89196: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL...
CVE-2026-89198: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the...
Microsoft SQL Server: CVE-2026-83945: Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...
Microsoft SQL Server: CVE-2026-88089: Microsoft SQL Server Remote Code Execution Vulnerability
Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally...
Microsoft SQL Server: CVE-2026-88083: Microsoft SQL Server Remote Code Execution Vulnerability
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network...