Aruba ClearPass Policy Manager 6.11.x < 6.11.16 / 6.14.x < 6.14.1 Multiple Vulnerabilities (HPESBNW05158)

The version of Aruba ClearPass Policy Manager installed on the remote host is 6.11.x prior to 6.11.16, or 6.14.x prior to 6.14.1. It is, therefore, affected by multiple vulnerabilities as referenced in the HPESBNW05158 advisory. - Deserialization of untrusted data vulnerabilities exist in the web...

CVE-2026-84209: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...

PT-2026-108109

Name of the Vulnerable Software and Affected Versions JHipster versions 7.0.0 through 9.3.x Description Reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database are susceptible to SQL injection. The issue occurs because the sort request parameter in paginated...

PT-2026-108672

SQL Injection in the sort Parameter of JHipster-Generated Reactive WebFlux + R2DBC Applications - Product: jhipster/generator-jhipster npm package generator-jhipster - Affected versions: v7.0.0 through v9.2.0 - Component: generated reactive-application code, template EntityManager reactive.java.e...

PT-2026-108673

Description When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NO BACKSLASH ESCAPES SQL mode. The server status flag was declared STATUS NO BACKSLASH ESCAPES but never read. Und...

PT-2026-108679

Description With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out...

PT-2026-107920

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1...

PT-2026-108148

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.5 MariaDB Connector/Node.js versions prior to 3.3.4 MariaDB Connector/Node.js versions prior to 3.4.7 MariaDB Connector/Node.js versions prior to 3.5.4 Description Text-protocol escaping fails to...

PT-2026-108276

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.1 IBM Guardium Data Protection version 12.2.2 Description Improper neutralization of special elements used in an SQL command allows a remote attacker to execute arbitrary SQL commands. This issue is caus...

Microsoft SQL Server Buffer Overflow

The vulnerability of the Microsoft SQL Server database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Microsoft SQL Server Privilege Escalation

The vulnerability of the Microsoft SQL Server database management system is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

Microsoft SQL Server Deserialization RCE

The vulnerability of the Microsoft SQL Server database management system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Microsoft SQL Server Privilege Escalation

The vulnerability of the Microsoft SQL Server database management system is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

CVE-2026-12260: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable component is the ‘user-name’ POST parameter in the ‘/module/auth/recovery.php’ endpoint. The parameter is vulnerable to blind attacks based on Boolean, error, time-based and UNION techniques. Exploitation allows attacke...

CVE-2026-107375: Improper Neutralization of Special Elements used in an SQL Command

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the attacker-controlled sort request paramete...

CVE-2025-71428: Improper Neutralization of Special Elements used in an SQL Command

Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.getAccountByNameLike that allows authenticated administrators to inject SQL via the username parameter. Attackers with the Admin role can submit crafted input to /admin/user/userListAction to read database contents,...

PT-2026-108268

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

VulnCheck KEV: CVE-2026-4815

A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls0messageids' parameter in '/supportboard/include/ajax.php' endpoint...

EulerOS 2.0 SP15 : perl-DBI (EulerOS-SA-2026-3935)

According to the versions of the perl-DBI packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.x000D x000D The fi...

CVE-2026-76270

In Splunk Enterprise versions below 10.4.3, a user that holds a role with the listspl2modules capability could use SQL injection in SPL2 module filtering to access all relevant data available through the affected Representational State Transfer REST API, including private SPL2 module definitions...