CVE-2026-57308

Apache Syncope is vulnerable to an SQL Injection flaw due to improper handling of the sort parameter in the Audit Events search interface. Specifically, the query builders in JPAAuditEventDAO and Neo4jAuditEventDAO append requested sort fields directly into the ORDER BY clause without proper neut...

EUVD-2026-45959

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

CVE-2026-57308

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: fr...

PT-2026-24633

Summary Craft Commerce is vulnerable to SQL Injection in the inventory levels table data endpoint. The sort0direction and sort0sortField parameters are concatenated directly into an addOrderBy clause without any validation or sanitization. An authenticated attacker with access to the Commerce...