CVE-2025-60736

CVE-2025-60736: SQL Injection Vulnerability in Online Medicine Guide Executive Summary This document outlines a critical SQL injection vulnerability discovered in the Online Medicine Guide web application. The vulnerability allows unauthorized database access and poses significant security risks ...

CVE-2026-63152 Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

CVE-2026-63152

The Omnispace Agora Project (versions prior to 26.10.0 ) is vulnerable to a second-order SQL injection in the _idCategoryFilter parameter. Authenticated attackers can inject a malicious payload that is persisted into the session. This payload is subsequently concatenated into a SQL statement with...

CVE-2026-63152

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization...

PT-2026-113331

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 26.10.0 Description An authenticated attacker can perform a second-order SQL injection, where malicious input is first stored by the application and later executed in a different context. The issue...

CVE-2026-1907

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

CVE-2026-1907

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

CVE-2026-1907

A SQL Injection (SQLi) vulnerability exists in the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode . The flaw is triggered by sending specially crafted RPC requests to the Control Plane (CP) , which could allow an attacker to achieve unauthor...

CVE-2026-1907 SQL Injection in Clustering Communication (Hybrid Mode)

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

EUVD-2026-97300

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

CVE-2026-1907 SQL Injection in Clustering Communication (Hybrid Mode)

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

CVE-2026-1907 SQL Injection in Clustering Communication (Hybrid Mode)

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

PT-2026-110513

Name of the Vulnerable Software and Affected Versions Kong Gateway versions prior to 3.9.4 Description A SQL Injection SQLi exists in the clustering communication logic of Kong Gateway Enterprise and Open Source when operating in Hybrid Mode. An attacker can trigger this issue by sending speciall...

CVE-2026-1907: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection SQLi affects the Kong Gateway Enterprise and Open Source clustering communication logic when operating in Hybrid Mode. The issue can be triggered by sending specially crafted RPC requests to the Control Plane CP, leading to potential unauthorized database access. Leveraging the...

CVE-2026-101092

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...

PT-2026-93786

Name of the Vulnerable Software and Affected Versions code-projects Matrimonial System version 1.0 Description An SQL injection issue exists in the Regular Search component within the '/search.php' endpoint. A remote attacker can exploit this by manipulating the sex, mothertongue, maritialstatus,...

CVE-2026-91924

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

PT-2026-72070

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

PT-2026-64827

About 14 HTTP handlers resolve the database path param and call getDatabase... WITHOUT user.canAccessToDatabase... and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler which holds the only per-database gate at...

PT-2026-43595

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the view.html.php files UpdateParam function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical...