PT-2026-106421

Name of the Vulnerable Software and Affected Versions Woffice versions prior to 5.4.36 Description An SQL Injection issue exists in the subscriber component, allowing an attacker to interfere with the database queries. Recommendations Update to a version newer than 5.4.35...

PT-2026-106420

Name of the Vulnerable Software and Affected Versions Booknetic versions prior to 4.8.6 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database,...

PT-2026-106476

Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...

CVE-2026-42416: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in UDesign Core = 4.15.0 versions...

CVE-2026-103059: Authentication Bypass by Primary Weakness

When Gitea's built-in SSH server is enabled STARTSSHSERVER = true, the presented public key was looked up with an SQL LIKE comparison of its encoded content, which is case-insensitive on some databases, including the default SQLite. An attacker who can construct a case variant of another user's...

CVE-2025-45871: Improper Neutralization of Special Elements used in an SQL Command

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name...

AlmaLinux 8 : mariadb-connector-c (ALSA-2026:75674)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:75674 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted t...

RockyLinux 9 : mariadb-connector-c (RLSA-2026:75673)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:75673 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted...

WP < 7.1.3 - Author+ SQLi via WXR Export

Description WordPress does not properly validate some post meta values before using them in a database query when exporting content in some cases, which could allow users with Author-level access and above to store a crafted value that results in SQL injection executed when an administrator later...

CVE-2026-105472: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipulation of the argument Doctor/appointment causes sql...

PT-2026-106453

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1...

PT-2026-107144

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

PT-2026-106786

Name of the Vulnerable Software and Affected Versions SourceCodester Performance Indicator System version 1.0 Description An issue exists in the /opils/admin/view product.php file where manipulating the Category argument allows for SQL injection, a technique used to interfere with the queries tha...

CVE-2026-105317: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...

PT-2026-107209

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description A SQL injection flaw exists in the API of ClearPass Policy Manager. This issue allows a remote authenticated attacker with administrative privileges to perform SQL injection...

CVE-2025-45871

LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection in the WorkflowsDataServlet component, allowing authenticated user to manipulate SQL queries via crafted workflow template name...

CVE-2026-39795: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in SendPress Newsletters = 1.26.1.20 versions...

PT-2026-107194

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description A SQL injection flaw exists in the web-based management interface of ClearPass Policy Manager. This issue allows an authenticated remote attacker to execute arbitrary databas...

PT-2026-107197

SQL injection vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow a low-privileged authenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitra...

PT-2026-107169

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When the built-in SSH server is enabled via the START SSH SERVER variable, the system performs a lookup of the presented public key using an SQL LIKE comparison of its encoded content. Because...