CVE-2026-108964: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/admin/addproduct.php. Performing a manipulation of the argument prodcategory results in sql injection. The attack can be initiated remotely. The exploit has been made publ...

CVE-2026-88084: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network...

CVE-2026-65674: Deserialization of Untrusted Data

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-55823: Improper Neutralization of Special Elements used in an SQL Command

Frappe is a full-stack web application framework. Prior to 16.23.0, the getcount method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23...

PT-2026-111272

A security vulnerability has been detected in itsourcecode Online Cake Ordering System 1.0. This impacts an unknown function of the file /addtransacdetail.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

Microsoft SQL Server: CVE-2026-88088: Microsoft SQL Server Elevation of Privilege Vulnerability

Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally...

Microsoft SQL Server: CVE-2026-85876: Microsoft SQL Server Elevation of Privilege Vulnerability

Use after free in SQL Server allows an authorized attacker to elevate privileges locally...

Microsoft SQL Server: CVE-2026-88082: Microsoft SQL Server Elevation of Privilege Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally...

Microsoft SQL Server: CVE-2026-85919: Microsoft SQL Server Elevation of Privilege Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally...

CVE-2026-109607: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. Th...

PT-2026-113431

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2019 affected versions not specified Microsoft SQL Server 2022 affected versions not specified Microsoft SQL Server 2025 affected versions not specified Description An authenticated attacker with low privileges can execute...

PT-2026-113331

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0 Description An authenticated attacker can perform a second-order SQL injection, where malicious input is first stored by the application and later executed in a different context. The issue...

PT-2026-113455

Use of externally-controlled format string in SQL Server allows an authorized attacker to deny service over a network...

CVE-2026-96956: Stack-based Buffer Overflow

Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network...

Microsoft SQL Server: CVE-2026-67625: Microsoft SQL Server Remote Code Execution Vulnerability

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-88075: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network...

CVE-2025-46773: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud...

CVE-2026-70266: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...

CVE-2026-70189: Heap-based Buffer Overflow

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally...

CVE-2026-103572: Improper Control of Generation of Code

Improper control of generation of code 'code injection' in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network...